[Solved] Illegal key size or default parameters in android

I got the following error and I got a little stuck:
Exception in thread “main” Illegal key size or default parameters
at javax.crypto.Cipher.checkCryptoPerm(
                at javax.crypto.Cipher.implInit(
                at javax.crypto.Cipher.chooseProvider(
                at javax.crypto.Cipher.init(
                at javax.crypto.Cipher.init(
                at net.nakou.indie.wtext.engineClass.Session.cryptString(

I’m stuck because all the answers I’ve found talk about the Java Cryptography Extension (JCE) which be normally included into the android SDK. So I think my problem is not this one.

I must have forgotten something, but I can’t find what. Maybe my code is wrong (it’s my first approach of cryptography in Java, I’m not an expert, and the following code is mostly some copy-pastes of tutorials).

I use this code to crypt and decrypt a String :

public String cryptString(String s) throws NoSuchPaddingException, NoSuchAlgorithmException, InvalidKeyException, UnsupportedEncodingException, BadPaddingException, IllegalBlockSizeException {
    byte[] KeyData = this.cryptKey.getBytes();
    SecretKeySpec KS = new SecretKeySpec(KeyData, "Blowfish");
    Cipher cipher = Cipher.getInstance("Blowfish");
    cipher.init(Cipher.ENCRYPT_MODE, KS);
    String ret = new String(cipher.doFinal(s.getBytes("UTF-8")));
    return ret;

public String decryptString(byte[] s) throws NoSuchPaddingException, NoSuchAlgorithmException, InvalidKeyException, BadPaddingException, IllegalBlockSizeException {
    byte[] KeyData = this.cryptKey.getBytes();
    SecretKeySpec KS = new SecretKeySpec(KeyData, "Blowfish");
    Cipher cipher = Cipher.getInstance("Blowfish");
    cipher.init(Cipher.DECRYPT_MODE, KS);
    String ret = new String(cipher.doFinal(s));
    return ret;

And the following key :

private String cryptKey = "[email protected]@FDFqf";

Thank you guys.

Solution #1:

private String cryptKey = "[email protected]@FDFqf";

By default Java supports only 128-bit encryption

128bits == 16Bytes == 16 Chars.

So cryptKey cannot exceed 16 characters.

If you want to exceed more than 16 character you have to install Java Cryptography Extension (JCE) Unlimited Strength.

Why 128bits?

Respondent: VenomVendor

Solution #2:

There have been updates since Java 8/9

  1. The Unlimited Strength Jurisdiction Policy Files are included with Java 9 and used by default
  2. Starting with Java 8 Update 161, Java 8 defaults to the Unlimited Strength Jurisdiction Policy.
  3. Starting with Java 8 Update 151, the Unlimited Strength Jurisdiction Policy is included with Java 8 but not used by default. To enable it, you need to edit the file in <java_home>/jre/lib/security (for JDK) or <java_home>/lib/security (for JRE). Uncomment (or include) the line


    Make sure you edit the file using an editor run as administrator.
    The policy change only takes effect after restarting the JVM

Before Java 8 Update 151 you have to download JCE Unlimited Strength Jurisdiction Policy files and replace.

For more details see How to install Java Cryptography Extension (JCE) unlimited strength jurisdiction policy files

PS: Above link goes to my personal blog that has additional details.

Respondent: Aniket Thakur

Solution #3:

Default JDK supports encryption only through 128 bit keys becuase of American restrictions. So to support encryption from 256 bit long key we have to replace local_policy.jar and US_export_policy.jars in $JAVA_HOME/java-8-oracle/jre/lib/security folder otherwise it will give Illegal key size or default

Respondent: Sulabh Jain

Solution #4:

This is a code only solution. No need to download or mess with configuration files.

It’s a reflection based solution, tested on java 8

Call this method once, early in your program or while application is being started.


import javax.crypto.Cipher;
import java.lang.reflect.Constructor;
import java.lang.reflect.Field;
import java.lang.reflect.Modifier;
import java.util.Map;


public static void fixKeyLength() {
    String errorString = "Failed manually overriding key-length permissions.";
    int newMaxKeyLength;
    try {
        if ((newMaxKeyLength = Cipher.getMaxAllowedKeyLength("AES")) < 256) {
            Class c = Class.forName("javax.crypto.CryptoAllPermissionCollection");
            Constructor con = c.getDeclaredConstructor();
            Object allPermissionCollection = con.newInstance();
            Field f = c.getDeclaredField("all_allowed");
            f.setBoolean(allPermissionCollection, true);

            c = Class.forName("javax.crypto.CryptoPermissions");
            con = c.getDeclaredConstructor();
            Object allPermissions = con.newInstance();
            f = c.getDeclaredField("perms");
            ((Map) f.get(allPermissions)).put("*", allPermissionCollection);

            c = Class.forName("javax.crypto.JceSecurityManager");
            f = c.getDeclaredField("defaultPolicy");
            Field mf = Field.class.getDeclaredField("modifiers");
            mf.setInt(f, f.getModifiers() & ~Modifier.FINAL);
            f.set(null, allPermissions);

            newMaxKeyLength = Cipher.getMaxAllowedKeyLength("AES");
    } catch (Exception e) {
        throw new RuntimeException(errorString, e);
    if (newMaxKeyLength < 256)
        throw new RuntimeException(errorString); // hack failed
Respondent: Kiran Sutar

Solution #5:

You can remove the maximum key restriction by replacing the existing JCE jars with unlimited strength policy jars.

For JAVA 8 the download JCE Jar from link –

(/usr/libexec/java_home -v to find Java_HOME in Mac)

Copy local_policy.jar and US_export_policy.jar extracted from above zip file to the $JAVA_HOME/jre/lib/security

Respondent: Sidharth Taneja

The answers/resolutions are collected from stackoverflow, are licensed under cc by-sa 2.5 , cc by-sa 3.0 and cc by-sa 4.0 .

Most Popular

To Top
India and Pakistan’s steroid-soaked rhetoric over Kashmir will come back to haunt them both clenbuterol australia bossier man pleads guilty for leadership role in anabolic steriod distribution conspiracy