JuliusBrussee/caveman · error

envelope: data key entropy: %w

Error message

envelope: data key entropy: %w

What it means

The envelope sealer's crypto/rand read for the 32-byte data key failed. A failure from the system entropy source means secure key generation is impossible; the seal aborts before producing any ciphertext rather than encrypting under a possibly weak or empty key.

Source

Thrown at shared/platform/envelope/envelope.go:72

func Seal(plaintext []byte) (ciphertext []byte, metaJSON []byte, err error) {
	return seal(plaintext, schemeV1, nil, "")
}

// SealForScope binds ciphertext authentication to tenant/object scope. Moving
// ciphertext plus metadata to another tenant, project, or object class makes
// decryption fail even when storage and KMS credentials are compromised.
func SealForScope(plaintext []byte, scope Scope) (ciphertext []byte, metaJSON []byte, err error) {
	aad, scopeHash, err := scopeAAD(scope)
	if err != nil {
		return nil, nil, err
	}
	return seal(plaintext, schemeV2, aad, scopeHash)
}

func seal(plaintext []byte, scheme string, aad []byte, scopeHash string) (ciphertext []byte, metaJSON []byte, err error) {
	dataKey := make([]byte, 32)
	if _, err := rand.Read(dataKey); err != nil {
		return nil, nil, fmt.Errorf("envelope: data key entropy: %w", err)
	}
	block, err := aes.NewCipher(dataKey)
	if err != nil {
		return nil, nil, fmt.Errorf("envelope: aes: %w", err)
	}
	gcm, err := cipher.NewGCM(block)
	if err != nil {
		return nil, nil, fmt.Errorf("envelope: gcm: %w", err)
	}
	nonce := make([]byte, gcm.NonceSize())
	if _, err := rand.Read(nonce); err != nil {
		return nil, nil, fmt.Errorf("envelope: nonce entropy: %w", err)
	}
	ciphertext = gcm.Seal(nonce, nonce, plaintext, aad)

	wrapped, err := secretbox.EncryptPayloadKey(dataKey)
	if err != nil {
		return nil, nil, fmt.Errorf("envelope: wrap data key: %w", err)

View on GitHub (pinned to 766dce6b13)

Solutions

1. Check system entropy source availability (/dev/urandom, getrandom)
2. If persistent, the host or container runtime is broken — restart or replace it

When it happens

Trigger: Thrown at shared/platform/envelope/envelope.go:72 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of JuliusBrussee/caveman@766dce6b13 (2026-08-18). Data as JSON: /api/errors/ffbb7988d56933ee. Report an issue: GitHub.