how to fix jdk11 "AES/CTR/PKCS5PADDING" works , but jdk17 fails

Question

given code

      byte[] lDecoded = Base64.getDecoder().decode(pValueBase64Encoded);
      Cipher lCipher = Cipher.getInstance("AES/CTR/PKCS5PADDING");

getting exception on getInstance() in JDK17

    Exception in thread "main" java.security.NoSuchAlgorithmException: Cannot find any provider supporting AES/CTR/PKCS5PADDING
        at java.base/javax.crypto.Cipher.getInstance(Cipher.java:571)
Pop3Handler.main(Pop3Handler.java:81)
    Caused by: javax.crypto.NoSuchPaddingException: CTR mode must be used with NoPadding
        at java.base/com.sun.crypto.provider.CipherCore.setPadding(CipherCore.java:258)
        at java.base/com.sun.crypto.provider.AESCipher.engineSetPadding(AESCipher.java:206)
        at java.base/javax.crypto.Cipher$Transform.setModePadding(Cipher.java:388)
        at java.base/javax.crypto.Cipher.getInstance(Cipher.java:564)
        ... 4 more

but works well in JDK11

implemented this tests

  @Test
   public void testProviders() {
      Provider[] provs = Security.getProviders();
      for (Provider provider : provs) {
          Service service = provider.getService("Cipher", "AES");
          if (service == null) {
              continue;
          }

          String modes = service.getAttribute("SupportedModes");
          if (modes != null && modes.matches("(?i).*CTR.*")) {
             System.out.println("CTR found:");
              System.out.println(service);
          } else {
             System.out.println("CTR NOT found:");
          }
          
          String paddings = service.getAttribute("SupportedPaddings");
          if (paddings != null && paddings.matches("(?i).*PKCS5PADDING.*")) {
             System.out.println("PKCS5PADDING found:");
             System.out.println(service);
          } else {
             System.out.println("PKCS5PADDING NOT found:");
         }
      }

JDK17:

CTR found:
SunJCE: Cipher.AES -> com.sun.crypto.provider.AESCipher$General
  aliases: [OID.2.16.840.1.101.3.4.1, 2.16.840.1.101.3.4.1]
  attributes: {SupportedKeyFormats=RAW, SupportedModes=ECB|CBC|PCBC|CTR|CTS|CFB|OFB|CFB8|CFB16|CFB24|CFB32|CFB40|CFB48|CFB56|CFB64|OFB8|OFB16|OFB24|OFB32|OFB40|OFB48|OFB56|OFB64|CFB72|CFB80|CFB88|CFB96|CFB104|CFB112|CFB120|CFB128|OFB72|OFB80|OFB88|OFB96|OFB104|OFB112|OFB120|OFB128, SupportedPaddings=NOPADDING|PKCS5PADDING|ISO10126PADDING}

PKCS5PADDING found:
SunJCE: Cipher.AES -> com.sun.crypto.provider.AESCipher$General
  aliases: [OID.2.16.840.1.101.3.4.1, 2.16.840.1.101.3.4.1]
  attributes: {SupportedKeyFormats=RAW, SupportedModes=ECB|CBC|PCBC|CTR|CTS|CFB|OFB|CFB8|CFB16|CFB24|CFB32|CFB40|CFB48|CFB56|CFB64|OFB8|OFB16|OFB24|OFB32|OFB40|OFB48|OFB56|OFB64|CFB72|CFB80|CFB88|CFB96|CFB104|CFB112|CFB120|CFB128|OFB72|OFB80|OFB88|OFB96|OFB104|OFB112|OFB120|OFB128, SupportedPaddings=NOPADDING|PKCS5PADDING|ISO10126PADDING}

JDK11

CTR found:
SunJCE: Cipher.AES -> com.sun.crypto.provider.AESCipher$General
  aliases: [Rijndael]
  attributes: {SupportedKeyFormats=RAW, SupportedModes=ECB|CBC|PCBC|CTR|CTS|CFB|OFB|CFB8|CFB16|CFB24|CFB32|CFB40|CFB48|CFB56|CFB64|OFB8|OFB16|OFB24|OFB32|OFB40|OFB48|OFB56|OFB64|GCM|CFB72|CFB80|CFB88|CFB96|CFB104|CFB112|CFB120|CFB128|OFB72|OFB80|OFB88|OFB96|OFB104|OFB112|OFB120|OFB128, SupportedPaddings=NOPADDING|PKCS5PADDING|ISO10126PADDING}

PKCS5PADDING found:
SunJCE: Cipher.AES -> com.sun.crypto.provider.AESCipher$General
  aliases: [Rijndael]
  attributes: {SupportedKeyFormats=RAW, SupportedModes=ECB|CBC|PCBC|CTR|CTS|CFB|OFB|CFB8|CFB16|CFB24|CFB32|CFB40|CFB48|CFB56|CFB64|OFB8|OFB16|OFB24|OFB32|OFB40|OFB48|OFB56|OFB64|GCM|CFB72|CFB80|CFB88|CFB96|CFB104|CFB112|CFB120|CFB128|OFB72|OFB80|OFB88|OFB96|OFB104|OFB112|OFB120|OFB128, SupportedPaddings=NOPADDING|PKCS5PADDING|ISO10126PADDING}

It looks like everything is around but Algo cannot be used?

Possible dupe: https://stackoverflow.com/questions/10193567/java-security-nosuchalgorithmexceptioncannot-find-any-provider-supporting-aes-e I know that this question is using ECB (yikes), but the solution should still work. — SuperStormer, Sep 04 '22 at 09:21
the accepted solution refers to switch from PKCS7 to PKCS5, but this is done in my case already. Added the junit for it — cilap, Sep 04 '22 at 09:41
CTR is a stream cipher mode and does not require padding (probably why it is no longer supported with JDK17). As mentioned in the error message, you should use `NoPadding`. If padding was really used (unnecessarily) during encryption, you can simply remove it manually after decryption (for PKCS#5/PKCS#7 padding, the last byte indicates the number of bytes to remove). Alternatively you can use BouncyCastle, which still supports padding even for stream cipher modes. — Topaco, Sep 04 '22 at 09:45
let me try it, but it is really strange since the Service reports "SupportedPaddings=NOPADDING|PKCS5PADDING|ISO10126PADDING}" — cilap, Sep 04 '22 at 09:48
looks switching to NOPADDING fixed my issue. Have to test thoroughly. .... Anyway I would expect if the service reports the support that it also works like expected — cilap, Sep 04 '22 at 09:52
do you have me an example of padding bytes how they look? If you want to you can place an answer here — cilap, Sep 04 '22 at 10:00
@Topaco: based on some quick testing, the fix occurred in 15; below that it accepts the specification of CTR/PKCS5 but actually does not pad on encryption or depad on decryption. cilap: there is only one SupportedPadding attribute for the cipher, regardless of mode(s), and _some_ modes do require padding. — dave_thompson_085, Sep 04 '22 at 10:00
According to @dave_thompson_085's comment, the SunJCE provider did not pad/unpad with AES/CTR/PKCS5Padding in previous versions. But some providers, like BouncyCastle, do. So if the provider used for encryption is unknown, you should check for a possible padding, if you applied the SunJCE provider, this is not necessary. — Topaco, Sep 04 '22 at 10:42

how to fix jdk11 "AES/CTR/PKCS5PADDING" works , but jdk17 fails

0 Answers0