phalcon/cphalcon · error · UnsupportedAlgorithm

The algorithm ' ' is not supported on this system.

Error message

The {} algorithm '{}' is not supported on this system.

What it means

Crypt::setCipher() and the hash-algorithm equivalents route through checkCipherHashIsAvailable(): it fetches the system's available list (openssl_get_cipher_methods(true) for ciphers, getAvailableHashAlgorithms for hashes), lowercases the requested name, and throws UnsupportedAlgorithm('The {type} algorithm "{name}" is not supported on this system.') if it is absent. The check runs at set time so an unusable cipher fails immediately, not on first encrypt.

Solutions

1. List what the target system supports: php -r 'print_r(openssl_get_cipher_methods(true));' and pick from that.
2. Standardize on aes-256-cbc or aes-256-gcm (gcm only where confirmed available) across environments.
3. If a specific algorithm is mandatory, provision the runtime so OpenSSL supports it (newer libssl, correct php-openssl build) and pin base images so dev/prod match.
4. Never hardcode an unverified cipher from a tutorial - resolve it from config validated at boot against the available list.

Example fix

// before
$crypt->setCipher('aes-256-ocb'); // not in openssl_get_cipher_methods on this host

// after
$cipher = 'aes-256-gcm';
if (!in_array($cipher, openssl_get_cipher_methods(true), true)) {
    $cipher = 'aes-256-cbc';
}
$crypt->setCipher($cipher);

$cipher = $config->path('encryption.cipher');
if (!in_array(mb_strtolower($cipher), array_map('mb_strtolower', openssl_get_cipher_methods(true)), true)) {
    throw new \RuntimeException("Cipher '{$cipher}' not supported by this system's OpenSSL");
}
$crypt->setCipher($cipher);

function isCipherSupportedOnThisSystem(string $cipher): bool
{
    return in_array(mb_strtolower($cipher), openssl_get_cipher_methods(true), true);
}

try {
    $crypt->setCipher($desired);
} catch (\Phalcon\Encryption\Crypt\Exception\UnsupportedAlgorithm $e) {
    $crypt->setCipher('aes-256-cbc'); // negotiated fallback, log the difference
    $logger->warning($e->getMessage() . ' - falling back to aes-256-cbc');
}

When it happens

Trigger: setCipher('aes-256-gcm') on an OpenSSL build without GCM (some older distro builds, certain FIPS builds); setCipher('camellia-256-cbc') where libssl lacks camellia; a hash algorithm string not in hash_algos(); or a typo/mixed-case name that is otherwise fine ('AES-256-CBC' works since it is lowercased before comparison).

Common situations: Deploying to a different OS/base image (Debian -> Alpine, older CentOS) whose OpenSSL lacks the cipher; local dev on macOS with a richer OpenSSL than production; PHP linked against a minimal openssl; requiring gcm while the shared host's libssl predates it.

Related errors

• Cannot calculate Random Pseudo Bytes
• Cannot calculate the initialization vector (IV) length of…
• This class requires the openssl extension for PHP
• Could not decrypt data
• Could not encrypt data

AI-assisted analysis of phalcon/cphalcon@b7419de9cd (2026-08-21). Data as JSON: /api/errors/47e2edf73d3f07ee. Report an issue: GitHub.

Appendix: source

Thrown at phalcon/Encryption/Crypt.zep:663

     * @param string $cipher
     * @param string $type
     *
     * @throws Exception
     */
    protected function checkCipherHashIsAvailable(string cipher, string type) -> void
    {
        var available, lower, method;

        if "hash" === type {
            let method = "getAvailableHashAlgorithms";
        } else {
            let method = "getAvailableCiphers";
        }

        let available = this->{method}(),
            lower     = mb_strtolower(cipher);
        if true !== in_array(lower, available) {
            throw new UnsupportedAlgorithm(type, cipher);
        }
    }

    /**
     * Pads texts before encryption. See
     * [cryptopad](https://www.di-mgt.com.au/cryptopad.html)
     *
     * @param string $input
     * @param string $mode
     * @param int    $blockSize
     * @param int    $paddingType
     *
     * @return string
     * @throws Exception
     */
    protected function cryptPadText(
        string input,
        string mode,

View on GitHub (pinned to b7419de9cd)