JuliusBrussee/caveman · error

envelope: nonce entropy: %w

Error message

envelope: nonce entropy: %w

What it means

The crypto/rand read for the AES-GCM nonce failed during envelope sealing. Like the data-key entropy failure, this aborts the seal immediately: a weak or repeated nonce would catastrophically break GCM authentication, so no ciphertext is emitted without full nonce entropy.

Source

Thrown at shared/platform/envelope/envelope.go:84

	return seal(plaintext, schemeV2, aad, scopeHash)
}

func seal(plaintext []byte, scheme string, aad []byte, scopeHash string) (ciphertext []byte, metaJSON []byte, err error) {
	dataKey := make([]byte, 32)
	if _, err := rand.Read(dataKey); err != nil {
		return nil, nil, fmt.Errorf("envelope: data key entropy: %w", err)
	}
	block, err := aes.NewCipher(dataKey)
	if err != nil {
		return nil, nil, fmt.Errorf("envelope: aes: %w", err)
	}
	gcm, err := cipher.NewGCM(block)
	if err != nil {
		return nil, nil, fmt.Errorf("envelope: gcm: %w", err)
	}
	nonce := make([]byte, gcm.NonceSize())
	if _, err := rand.Read(nonce); err != nil {
		return nil, nil, fmt.Errorf("envelope: nonce entropy: %w", err)
	}
	ciphertext = gcm.Seal(nonce, nonce, plaintext, aad)

	wrapped, err := secretbox.EncryptPayloadKey(dataKey)
	if err != nil {
		return nil, nil, fmt.Errorf("envelope: wrap data key: %w", err)
	}
	meta := Metadata{Scheme: scheme, WrappedDataKey: base64.StdEncoding.EncodeToString(wrapped), ScopeHash: scopeHash}
	metaJSON, err = json.Marshal(meta)
	if err != nil {
		return nil, nil, fmt.Errorf("envelope: marshal metadata: %w", err)
	}
	return ciphertext, metaJSON, nil
}

// Open reverses Seal: it unwraps the data key from metadata and decrypts the
// ciphertext. An unknown scheme fails closed.
func Open(ciphertext []byte, metaJSON []byte) ([]byte, error) {

View on GitHub (pinned to 766dce6b13)

Solutions

1. Diagnose the host entropy source (getrandom blocking, container seccomp restrictions)
2. Retry the seal once entropy is available

When it happens

Trigger: Thrown at shared/platform/envelope/envelope.go:84 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of JuliusBrussee/caveman@766dce6b13 (2026-08-18). Data as JSON: /api/errors/892b04f59334e11e. Report an issue: GitHub.