We have an application that uses Symmetric Key for encrytping and decrypting. It was written with Java 8 and has been working fine. However, after we upgraded to OpenJDK 11, we are seeingc ases where the Key (javax.crypto.SecretKey) being generated for AES is of non-standard length.

The client application is complaining of [java.security.InvalidKeyException: Invalid AES key length: 25 bytes] when this Symmetric key is used to encrypt data on the client side.

public SecretKey generateRandomKey(String reqAppender) throws NoSuchAlgorithmException {
        KeyGenerator keyGenerator = KeyGenerator.getInstance("AES");
        keyGenerator.init(128);
        SecretKey sk = keyGenerator.generateKey();
        logger.info("Symmetric key generated:" + sk.getEncoded().toString() + "; byte length:" + sk.getEncoded().length);
        return sk;
    }

The code on the client side is simply using the Key to create a cipher and then encrypty a byte data from a String. Code on the client side is:

public static RequestData encryptUsingSymmetricKey(byte[] data, SecretKey key)
            throws IllegalBlockSizeException, BadPaddingException,
            InvalidKeyException, NoSuchAlgorithmException,
            NoSuchPaddingException {
        final Cipher symmetricCipher = Cipher
                .getInstance(SYMMETRIC_CIPHER_NAME);

        symmetricCipher.init(Cipher.ENCRYPT_MODE, key);
        byte[] encryptedData = symmetricCipher.doFinal(data);
        RequestData requestData = new RequestData();
        requestData.setRequestData(encryptedData);
        requestData.setIv(symmetricCipher.getIV());
        logger.info("encrypted using symmetric key and IV  : "+symmetricCipher.getIV());
        return requestData;
    }

I am unabl to understand how to solve this issue. I have looked into various resource sand wondering why the KeyGenerator is proividing a key that is of non-standard length and how do I restrict it to a standard length.