spring-projects/spring-security · error · IllegalArgumentException

Unable to access parameter

Error message

Unable to access parameter

What it means

Thrown by CipherUtils.getParameterSpec when cipher.getParameters().getParameterSpec(parameterSpecClass) throws InvalidParameterSpecException. The cipher's algorithm parameters cannot be converted to the requested AlgorithmParameterSpec class (e.g. requesting GCMParameterSpec from a cipher in CBC mode, or a provider that doesn't expose parameters).

Source

Thrown at crypto/src/main/java/org/springframework/security/crypto/encrypt/CipherUtils.java:93

			return Cipher.getInstance(algorithm);
		}
		catch (NoSuchAlgorithmException ex) {
			throw new IllegalArgumentException("Not a valid encryption algorithm", ex);
		}
		catch (NoSuchPaddingException ex) {
			throw new IllegalStateException("Should not happen", ex);
		}
	}

	/**
	 * Initializes the Cipher for use.
	 */
	static <T extends AlgorithmParameterSpec> T getParameterSpec(Cipher cipher, Class<T> parameterSpecClass) {
		try {
			return cipher.getParameters().getParameterSpec(parameterSpecClass);
		}
		catch (InvalidParameterSpecException ex) {
			throw new IllegalArgumentException("Unable to access parameter", ex);
		}
	}

	/**
	 * Initializes the Cipher for use.
	 */
	static void initCipher(Cipher cipher, int mode, SecretKey secretKey) {
		initCipher(cipher, mode, secretKey, null);
	}

	/**
	 * Initializes the Cipher for use.
	 */
	static void initCipher(Cipher cipher, int mode, SecretKey secretKey, byte[] salt, int iterationCount) {
		initCipher(cipher, mode, secretKey, new PBEParameterSpec(salt, iterationCount));
	}

	/**

View on GitHub (pinned to 96852e8860)

Solutions

1. Match the spec class to the cipher mode: IvParameterSpec for CBC, GCMParameterSpec for GCM.
2. Call getParameterSpec only after cipher.init(...) so the parameters are generated.
3. Check cipher.getParameters() for null before requesting a spec (some transformations have none).
4. If switching algorithms, update all parameter-handling code, including IV storage/serialization.

Example fix

// before
IvParameterSpec iv = CipherUtils.getParameterSpec(cipher, IvParameterSpec.class); // cipher is GCM
// after
GCMParameterSpec spec = CipherUtils.getParameterSpec(cipher, GCMParameterSpec.class);

if (cipher.getParameters() == null) throw new IllegalStateException("cipher has no algorithm parameters; call init() first");
// pick spec class from mode: IvParameterSpec for CBC, GCMParameterSpec for GCM

try {
    return CipherUtils.getParameterSpec(cipher, specClass);
} catch (IllegalArgumentException ex) {
    throw new IllegalStateException("Wrong parameter spec class for cipher mode", ex);
}

When it happens

Trigger: Calling getParameterSpec(cipher, GCMParameterSpec.class) on a Cipher initialized with a CBC/IvParameterSpec-based transformation; calling it before cipher.init(...); using a provider that doesn't return parameters for the transformation; requesting the wrong spec class for the active algorithm mode.

Common situations: Custom encryptor code reusing CipherUtils across mixed CBC/GCM ciphers; refactors that swap a GCM cipher for CBC (or vice versa) without updating the spec class; storing/persisting IVs after a mode change.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• Unable to initialize due to invalid decryption parameter spe
• Should not happen
• Unable to invoke Cipher due to illegal block size
• Bad salt length
• Invalid prefix

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/249aedf6cdd0fec7. Report an issue: GitHub.