SecretKeyFactory doesn't support algorithm "PBEWithHmacSHA256AndDESede"

Question

I'm working on Java 1.7 - Window 7 (64 bit). I want to get SecretKeyFactory instance and Cipher instance of PBEWithHmacSHA256AndDESede algorithm. Unfortunately, I only got exceptions

java.security.NoSuchAlgorithmException: Cannot find any provider supporting PBEWithHmacSHA256AndDESede
at javax.crypto.Cipher.getInstance(Cipher.java:524)

Can you share me your solution of this problem?

Answer 1

The solution to this problem is two-part:

First, you need to call SecretKeyFactory.getInstance("PBEWithHmacSHA256AndDESede") instead of Cipher.getInstance("PBEWithHmacSHA256AndDESede"), as indicated by your stacktrace.

Second, you need to find the security provider that supports that algorithm. Neither SunJCE no BC 1.50 support it, by the way, so you will have to search for more exotic variants.

You can use the following code to check all installed providers and SecretKeyFactory algorithms supported by them:

// Security.addProvider( new BouncyCastleProvider() );
for ( Provider provider : Security.getProviders() ) {
    System.out.println( provider );
    for ( Provider.Service service : provider.getServices() ) {
        if ( "SecretKeyFactory".equals( service.getType() ) ) {
            System.out.println( service );
        }
    }
}

BC 1.50 definitely supports PBE with SHA-256 and AES variants under the names PBEWITHSHA256AND128BITAES-CBC-BC (OID 1.3.6.1.4.1.22554.1.2.1.2.1.2), PBEWITHSHA256AND192BITAES-CBC-BC (OID 1.3.6.1.4.1.22554.1.2.1.2.1.22) and PBEWITHSHA256AND256BITAES-CBC-BC (OID 1.3.6.1.4.1.22554.1.2.1.2.1.42).

It also supports a SecretKeyFactory algorithm with the name PBEWITHHMACSHA256 and OID 2.16.840.1.101.3.4.2.1, but that OID designates the plain SHA-256 hash function, meaning that this secret factory will use only hash instead of hash+cipher.

Answer 2

Have you:

• Confirmed that security provider you are using supports 'PBEWithHmacSHA256AndDESede'
• Have you installed the unlimited crypto -> http://www.oracle.com/technetwork/java/javase/downloads/jce-7-download-432124.html
• If the current security provider does not support 'PBEWithHmacSHA256AndDESede' use https://www.bouncycastle.org/ and be sure to add it as a security provider.

Answer 3

As @user3465651 points out, you have to have a library that supports this, such as BouncyCastle. In my case the error was:

java.security.NoSuchAlgorithmException: PBEWithSHA256And256BitAES-CBC-BC SecretKeyFactory not available

In troubleshooting, you can explicitly specify the library that contains the algorithm this way:

SecretKeyFactory.getInstance("PBEWithSHA256And256BitAES-CBC-BC","BC");

If you've done that you may still get this error if you're using Maven's shade plugin:

java.security.NoSuchProviderException: JCE cannot authenticate the provider BC

The shade plugin breaks the the cryptographic signature (explanation).

You can instead use the executable packer maven plugin solution that uses a jar-in-jar approach which preserves the signature for JCE in a single, executable jar.

Answer 4

Try this:

Old code:

String passphrase = "test";
KeySpec keySpec = new PBEKeySpec(passphrase.toCharArray());
SecretKey key = SecretKeyFactory.getInstance("PBEWithMD5AndDES").generateSecret(keySpec);
ecipher = Cipher.getInstance(key.getAlgorithm());
...
ecipher.init(Cipher.ENCRYPT_MODE, ket, paramSpec);
...

New Code :

String passphrase = "test";
KeySpec keySpec = new PBEKeySpec(passphrase.toCharArray());
SecretKey key = SecretKeyFactory.getInstance("PBEWithMD5AndDES").generateSecret(keySpec);
ecipher = Cipher.getInstance("PBEWithMD5AndDES");
...
ecipher.init(Cipher.ENCRYPT_MODE, ket, paramSpec);