What causes "Should not happen" in spring-projects/spring-security?

Replace the padding name with a JCE-standard one: "PKCS5Padding" or "NoPadding".

spring-projects/spring-security · error · IllegalStateException

Should not happen

Error message

Should not happen

What it means

Thrown by CipherUtils.newCipher when Cipher.getInstance succeeds in finding the transformation but rejects the requested padding scheme (NoSuchPaddingException). The library declares this 'should not happen' because all transformations it uses include valid padding names, so hitting it indicates an unusual custom algorithm string.

Source

Thrown at crypto/src/main/java/org/springframework/security/crypto/encrypt/CipherUtils.java:81

			throw new IllegalArgumentException("Not a valid encryption algorithm", ex);
		}
		catch (InvalidKeySpecException ex) {
			throw new IllegalArgumentException("Not a valid secret key", ex);
		}
	}

	/**
	 * Constructs a new Cipher.
	 */
	static Cipher newCipher(String algorithm) {
		try {
			return Cipher.getInstance(algorithm);
		}
		catch (NoSuchAlgorithmException ex) {
			throw new IllegalArgumentException("Not a valid encryption algorithm", ex);
		}
		catch (NoSuchPaddingException ex) {
			throw new IllegalStateException("Should not happen", ex);
		}
	}

	/**
	 * Initializes the Cipher for use.
	 */
	static <T extends AlgorithmParameterSpec> T getParameterSpec(Cipher cipher, Class<T> parameterSpecClass) {
		try {
			return cipher.getParameters().getParameterSpec(parameterSpecClass);
		}
		catch (InvalidParameterSpecException ex) {
			throw new IllegalArgumentException("Unable to access parameter", ex);
		}
	}

	/**
	 * Initializes the Cipher for use.
	 */

View on GitHub (pinned to 96852e8860)

Solutions

Replace the padding name with a JCE-standard one: "PKCS5Padding" or "NoPadding".
Register the BouncyCastle provider if using padding schemes it supplies.
Review the transformation string format: Algorithm/Mode/Padding, each segment valid.
If this fires with Spring Security's own constants, report it — the library treats it as an internal invariant.

Example fix

// before
Cipher cipher = CipherUtils.newCipher("AES/CBC/PKCS7Padding");
// after
Cipher cipher = CipherUtils.newCipher("AES/CBC/PKCS5Padding");

Defensive patterns

Strategy: try-catch

Try / catch

try {
    return CipherUtils.newCipher(transformation);
} catch (IllegalStateException ex) {
    throw new ConfigurationException("Invalid padding in transformation: " + transformation, ex);
}

Prevention

Use NoPadding or PKCS5Padding — the only padding names standard JCE recognizes for these modes.
Treat 'Should not happen' as a sign your custom transformation string is malformed.
Validate transformation format (Algorithm/Mode/Padding) in config validation.
Keep Spring Security's default algorithm constants unless you have a tested reason to change.

When it happens

Trigger: Requesting a Cipher transformation whose padding component is unrecognized by any provider, e.g. "AES/CBC/PKCS7Padding" or a malformed "AES/CBC/NoSuchPad" transformation passed to a custom AesBytesEncryptor variant.

Common situations: Hand-editing algorithm constants copied from non-Java documentation (PKCS7 naming); provider-restricted (FIPS) JVMs that lack standard padding implementations; copy-paste from other-language examples.

Understand the failure class

Background: "This is a bug, please report it": internal invariant violations, unreachable panics, and SNH errors explained — this error's family across 47 libraries.

Related errors

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/97b14c4da2b64dbb. Report an issue: GitHub.