phalcon/cphalcon · error · UnsupportedAlgorithm

The {} algorithm '{}' is not supported on this system.

Error message

The {} algorithm '{}' is not supported on this system.

What it means

Crypt::setCipher() and the hash-algorithm equivalents route through checkCipherHashIsAvailable(): it fetches the system's available list (openssl_get_cipher_methods(true) for ciphers, getAvailableHashAlgorithms for hashes), lowercases the requested name, and throws UnsupportedAlgorithm('The {type} algorithm "{name}" is not supported on this system.') if it is absent. The check runs at set time so an unusable cipher fails immediately, not on first encrypt.

Source

Thrown at phalcon/Encryption/Crypt.zep:663

     * @param string $cipher
     * @param string $type
     *
     * @throws Exception
     */
    protected function checkCipherHashIsAvailable(string cipher, string type) -> void
    {
        var available, lower, method;

        if "hash" === type {
            let method = "getAvailableHashAlgorithms";
        } else {
            let method = "getAvailableCiphers";
        }

        let available = this->{method}(),
            lower     = mb_strtolower(cipher);
        if true !== in_array(lower, available) {
            throw new UnsupportedAlgorithm(type, cipher);
        }
    }

    /**
     * Pads texts before encryption. See
     * [cryptopad](https://www.di-mgt.com.au/cryptopad.html)
     *
     * @param string $input
     * @param string $mode
     * @param int    $blockSize
     * @param int    $paddingType
     *
     * @return string
     * @throws Exception
     */
    protected function cryptPadText(
        string input,
        string mode,

View on GitHub (pinned to b7419de9cd)

Solutions

1. List what the target system supports: php -r 'print_r(openssl_get_cipher_methods(true));' and pick from that.
2. Standardize on aes-256-cbc or aes-256-gcm (gcm only where confirmed available) across environments.
3. If a specific algorithm is mandatory, provision the runtime so OpenSSL supports it (newer libssl, correct php-openssl build) and pin base images so dev/prod match.
4. Never hardcode an unverified cipher from a tutorial - resolve it from config validated at boot against the available list.

Example fix

// before
$crypt->setCipher('aes-256-ocb'); // not in openssl_get_cipher_methods on this host

// after
$cipher = 'aes-256-gcm';
if (!in_array($cipher, openssl_get_cipher_methods(true), true)) {
    $cipher = 'aes-256-cbc';
}
$crypt->setCipher($cipher);

$cipher = $config->path('encryption.cipher');
if (!in_array(mb_strtolower($cipher), array_map('mb_strtolower', openssl_get_cipher_methods(true)), true)) {
    throw new \RuntimeException("Cipher '{$cipher}' not supported by this system's OpenSSL");
}
$crypt->setCipher($cipher);

function isCipherSupportedOnThisSystem(string $cipher): bool
{
    return in_array(mb_strtolower($cipher), openssl_get_cipher_methods(true), true);
}

try {
    $crypt->setCipher($desired);
} catch (\Phalcon\Encryption\Crypt\Exception\UnsupportedAlgorithm $e) {
    $crypt->setCipher('aes-256-cbc'); // negotiated fallback, log the difference
    $logger->warning($e->getMessage() . ' - falling back to aes-256-cbc');
}

When it happens

Trigger: setCipher('aes-256-gcm') on an OpenSSL build without GCM (some older distro builds, certain FIPS builds); setCipher('camellia-256-cbc') where libssl lacks camellia; a hash algorithm string not in hash_algos(); or a typo/mixed-case name that is otherwise fine ('AES-256-CBC' works since it is lowercased before comparison).

Common situations: Deploying to a different OS/base image (Debian -> Alpine, older CentOS) whose OpenSSL lacks the cipher; local dev on macOS with a richer OpenSSL than production; PHP linked against a minimal openssl; requiring gcm while the shared host's libssl predates it.

Related errors

• Cannot calculate Random Pseudo Bytes
• This class requires the openssl extension for PHP
• Cannot calculate the initialization vector (IV) length of th
• Could not decrypt data
• Could not encrypt data

AI-assisted analysis of phalcon/cphalcon@b7419de9cd (2026-08-21). Data as JSON: /api/errors/47e2edf73d3f07ee. Report an issue: GitHub.