spring-projects/spring-security · error · IllegalArgumentException
Not a valid encryption algorithm
Error message
Not a valid encryption algorithm
What it means
Thrown by CipherUtils.newSecretKey when SecretKeyFactory.getInstance(algorithm) cannot find the requested PBE algorithm (NoSuchAlgorithmException). The algorithm name string passed to the encryptor/encoder is not recognized by the installed JCE providers.
Source
Thrown at crypto/src/main/java/org/springframework/security/crypto/encrypt/CipherUtils.java:63
}
/**
* Generates a SecretKey.
*/
static SecretKey newSecretKey(String algorithm, String password) {
return newSecretKey(algorithm, new PBEKeySpec(password.toCharArray()));
}
/**
* Generates a SecretKey.
*/
static SecretKey newSecretKey(String algorithm, PBEKeySpec keySpec) {
try {
SecretKeyFactory factory = SecretKeyFactory.getInstance(algorithm);
return factory.generateSecret(keySpec);
}
catch (NoSuchAlgorithmException ex) {
throw new IllegalArgumentException("Not a valid encryption algorithm", ex);
}
catch (InvalidKeySpecException ex) {
throw new IllegalArgumentException("Not a valid secret key", ex);
}
}
/**
* Constructs a new Cipher.
*/
static Cipher newCipher(String algorithm) {
try {
return Cipher.getInstance(algorithm);
}
catch (NoSuchAlgorithmException ex) {
throw new IllegalArgumentException("Not a valid encryption algorithm", ex);
}
catch (NoSuchPaddingException ex) {
throw new IllegalStateException("Should not happen", ex);View on GitHub (pinned to 96852e8860)
Solutions
- Check the algorithm string spelling against CipherUtils constants (e.g. "PBKDF2WithHmacSHA1", "PBKDF2WithHmacSHA256").
- Register the provider: Security.addProvider(new BouncyCastleProvider()) before creating BC-based encryptors.
- Use a JDK-supported algorithm variant available on your JVM (query Security.getProviders() / SecretKeyFactory algorithms to list what exists).
- Upgrade the JDK or add BouncyCastle bcprov dependency if the required PBE variant is missing.
Example fix
// before
SecretKey key = CipherUtils.newSecretKey("PBKDF2WithHmacSHA512", keySpec); // NoSuchAlgorithmException on some JDKs
// after
Security.addProvider(new BouncyCastleProvider());
SecretKey key = CipherUtils.newSecretKey("PBKDF2WithHmacSHA256", keySpec); Defensive patterns
Strategy: validation
Validate before calling
boolean supported = java.util.Arrays.stream(java.security.Security.getProviders())
.flatMap(p -> java.util.Arrays.stream(p.getServices()))
.filter(s -> s.getType().equals("SecretKeyFactory"))
.anyMatch(s -> s.getAlgorithm().equalsIgnoreCase("PBKDF2WithHmacSHA256")); Try / catch
try {
return CipherUtils.newSecretKey(algorithm, keySpec);
} catch (IllegalArgumentException ex) {
throw new ConfigurationException("Unsupported PBE algorithm: " + algorithm, ex);
} Prevention
- Reference Spring Security's CipherUtils constants instead of hardcoding algorithm strings.
- Register BouncyCastleProvider at application startup when using BC variants.
- Fail fast at startup with a smoke encrypt/decrypt call.
- Check JDK release notes for algorithm availability before upgrades/downgrades.
When it happens
Trigger: Calling new SecretKeyFactory-based encryptors such as new BouncyCastleAesCbcBytesEncryptor(password, salt) with a keystrength/algorithm variant, or directly invoking CipherUtils.newSecretKey("PBKDF2WithHmacSHA...", keySpec) with a misspelled or unsupported algorithm name (e.g. "PBKDF2WithHMACSHA256" on a JDK whose providers only expose certain variants, or "PBEWITHSHA256AND128BITAES-CBC-BC" without the BouncyCastle provider registered).
Common situations: Typos in algorithm constants; running on a JDK that lacks the algorithm variant (older JDKs missing PBKDF2WithHmacSHA256); forgetting to register Security.addProvider(new BouncyCastleProvider()) before using the *-BC encryptors with BC-specific algorithm names; FIPS-only JVMs.
Understand the failure class
Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.
Related errors
AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10).
Data as JSON: /api/errors/fbc345c760160f00.
Report an issue: GitHub.