java.security.InvalidKeyException: Illegal key size

Question

When I run this code in Android it produces no errors, but when I run it in a standard Java program it produces the exception: java.security.InvalidKeyException: Illegal key size.

Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
SecretKeySpec keySpec = new SecretKeySpec(CHUNK_ENCRYPTION_KEY.getBytes(), 0, 32, "AES");
IvParameterSpec initVector = new IvParameterSpec(AES_INITIALIZATION_VECTOR.getBytes(), 0 , 16);
cipher.init(Cipher.ENCRYPT_MODE, keySpec, initVector);

CHUNK_ENCRYPTION_KEY is a 32 byte key hard-coded into the program. AES_INITIALIZATION_VECTOR is a 16 byte hard-coded initialization vector.

Does anyone know why it would work on Android and not on a Desktop?

Your question is missing a question mark.

Snicolas
– Snicolas

2011-08-01 15:29:16 +00:00
Commented Aug 1, 2011 at 15:29 — Snicolas
– Snicolas, Commented Aug 1, 2011 at 15:29
@Hank I am facing similar issue. Did you solve this or not?

NovusMobile
– NovusMobile

2015-05-11 08:32:30 +00:00
Commented May 11, 2015 at 8:32 — NovusMobile
– NovusMobile, Commented May 11, 2015 at 8:32
No, I was never able to solve this

Hank
– Hank

2015-05-11 16:35:53 +00:00
Commented May 11, 2015 at 16:35 — Hank
– Hank, Commented May 11, 2015 at 16:35
Possible duplicate of InvalidKeyException Illegal key size

Mark Rotteveel
– Mark Rotteveel

2016-03-21 10:33:00 +00:00
Commented Mar 21, 2016 at 10:33 — Mark Rotteveel
– Mark Rotteveel, Commented Mar 21, 2016 at 10:33

Maarten Bodewes · Accepted Answer · 2016-05-15 16:10:40Z

24

On a default desktop JVM installation (using the JRE or JDK from Sun/Oracle), AES is limited to 128-bit key size. This is a remnant of import/export laws on cryptographic software. To unlock the larger AES key sizes, you need to download and apply the "JCE Unlimited Strength Jurisdiction Policy Files" (see at the bottom of this page).

The key size restriction is enforced by the code within the Cipher class. Changing cryptographic providers (e.g. to one of the Bouncy Castle or IAIK providers) won't let you circumvent this restriction.

On an unrelated note, you do not want to use the raw getBytes() method on a String, because the result depends on the current locale (not everyone uses UTF-8 or even ASCII-compatible encodings). If you do want to represent your key as a literal string, at least use an explicit encoding, such as: CHUNK_ENCRYPTION_KEY.getBytes("UTF-8")

edited May 15, 2016 at 16:10

Maarten Bodewes

94.6k15 gold badges169 silver badges289 bronze badges

answered Aug 1, 2011 at 20:03

Thomas Pornin

74.9k15 gold badges152 silver badges191 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

ruruskyi · Accepted Answer · 2013-09-20 17:34:54Z

1

It's not stated clearly in README that "JCE Unlimited Strength Jurisdiction Policy Files" should be copied to jre inside your JDK, otherwise it would not work. Path for files should be: /path/to/jdk1.7.0_xx/jre/lib/security

answered Sep 20, 2013 at 17:34

ruruskyi

2,0872 gold badges26 silver badges38 bronze badges

Comments

Ovidiu Latcu · Accepted Answer · 2011-08-01 15:31:23Z

-1

Maybe your supplied KEY and Initialization Vector don't have 32 bytes, respectively 16 bytes length. You can also try to use the constructors that don't take the parameters the offset and length of the keys:

   SecretKeySpec keySpec = new SecretKeySpec(keyBytes, "AES");
   IvParameterSpec ivSpec = new IvParameterSpec(iv);

answered Aug 1, 2011 at 15:31

Ovidiu Latcu

72.4k15 gold badges78 silver badges86 bronze badges

4 Comments

Hank Over a year ago

I checked the byte lengths when I convert them to byte arrays, and if I don't do the offset and length, it produces the same exception.

Ovidiu Latcu Over a year ago

are you converting a Hex String to bytes?

Hank Over a year ago

yeah, my whole key string is consisted of 32 unicode characters.

Hank Over a year ago

I even tried changing it to a byte array, and it still doesn't work

Collectives™ on Stack Overflow

java.security.InvalidKeyException: Illegal key size

3 Answers 3

Comments

Comments

4 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

4 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related