JuliusBrussee/caveman · error

envelope: ciphertext too short

Error message

envelope: ciphertext too short

What it means

Fires in open() when the ciphertext blob is shorter than the AES-GCM nonce size, meaning it cannot possibly contain a nonce plus a valid GCM-encrypted payload. This indicates truncation, corruption, or a wrong (non-envelope) value passed as ciphertext.

Source

Thrown at shared/platform/envelope/envelope.go:158

	wrapped, err := base64.StdEncoding.DecodeString(meta.WrappedDataKey)
	if err != nil {
		return nil, fmt.Errorf("envelope: decode wrapped key: %w", err)
	}
	dataKey, err := secretbox.DecryptPayloadKey(wrapped)
	if err != nil {
		return nil, fmt.Errorf("envelope: unwrap data key: %w", err)
	}
	block, err := aes.NewCipher(dataKey)
	if err != nil {
		return nil, fmt.Errorf("envelope: aes: %w", err)
	}
	gcm, err := cipher.NewGCM(block)
	if err != nil {
		return nil, fmt.Errorf("envelope: gcm: %w", err)
	}
	ns := gcm.NonceSize()
	if len(ciphertext) < ns {
		return nil, fmt.Errorf("envelope: ciphertext too short")
	}
	nonce, ct := ciphertext[:ns], ciphertext[ns:]
	plaintext, err := gcm.Open(nil, nonce, ct, aad)
	if err != nil {
		return nil, fmt.Errorf("envelope: open: %w", err)
	}
	return plaintext, nil
}

func scopeAAD(scope Scope) ([]byte, string, error) {
	scope.OrganizationID = strings.TrimSpace(scope.OrganizationID)
	scope.ProjectID = strings.TrimSpace(scope.ProjectID)
	scope.Kind = strings.TrimSpace(scope.Kind)
	if scope.OrganizationID == "" {
		return nil, "", fmt.Errorf("envelope: organization scope is required")
	}
	if scope.Kind == "" {
		return nil, "", fmt.Errorf("envelope: object kind is required")

View on GitHub (pinned to 766dce6b13)

Solutions

1. Check that the stored ciphertext was not truncated by the persistence layer or by a size-limited column/field
2. Confirm you are passing the original sealed output, not a decoded/derived representation
3. Re-seal the data if the stored blob is unrecoverable

When it happens

Trigger: Thrown at shared/platform/envelope/envelope.go:158 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of JuliusBrussee/caveman@766dce6b13 (2026-08-18). Data as JSON: /api/errors/e26a4922140e22ac. Report an issue: GitHub.