apache/cassandra · error · IllegalStateException

no initialization vector (IV) found in this context

Error message

no initialization vector (IV) found in this context

What it means

EncryptionContext.getDecryptor() requires the random IV stored with the encrypted data. If the context has no IV (null or empty array) decryption cannot start, so it throws IllegalStateException. This is an internal-state check, not a config error.

Solutions

1. Ensure the EncryptionContext is created with IV bytes read from the segment header (EncryptionUtils/EncryptionContextSerializer).
2. Check for corruption/truncation of the encrypted segment's header; restore from backup if the file is damaged.
3. Only call getDecryptor() on contexts that came from deserializing a valid encrypted header.

Example fix

// before
EncryptionContext ctx = new EncryptionContext(options); // no IV
Cipher c = ctx.getDecryptor();
// after
try (FileInputStream in = ...) {
    EncryptionContext ctx = EncryptionContextSerializer.deserialize(options, DataInputBuffer, true);
    Cipher c = ctx.getDecryptor();
}

if (ctx.getIV() == null || ctx.getIV().length == 0)
    throw new IllegalStateException("context has no IV; cannot decrypt");

boolean hasIv(EncryptionContext ctx) { byte[] iv = ctx.getIV(); return iv != null && iv.length > 0; }

if (!hasIv(ctx)) return null; // skip; only decrypt contexts deserialized from valid headers
try { Cipher c = ctx.getDecryptor(); } catch (IllegalStateException e) { /* missing IV: corrupt header */ }

When it happens

Trigger: Calling getDecryptor() on an EncryptionContext constructed without IV bytes — e.g. context read from data that lacks the IV header, or programmatically built with iv == null/EMPTY.

Common situations: Corrupt or truncated encrypted commit log segment where the IV was never written/read, or misuse of the API by building a context only for encryption but attempting decryption with it.

Understand the failure class

Background: "This is a bug, please report it": internal invariant violations, unreachable panics, and SNH errors explained — this error's family across 47 libraries.

Related errors

• 0x0000
• a hints file cannot be configured for both compression and…
• Attempted to set an element on a list which is null
• Binlog is already configured
• Bootstrap can be started exactly once, but seems to have…

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/8a9d15ee817ed830. Report an issue: GitHub.

Appendix: source

Thrown at src/java/org/apache/cassandra/security/EncryptionContext.java:103

        }

        cipherFactory = factory;
    }

    public ICompressor getCompressor()
    {
        return compressor;
    }

    public Cipher getEncryptor() throws IOException
    {
        return cipherFactory.getEncryptor(tdeOptions.cipher, tdeOptions.key_alias);
    }

    public Cipher getDecryptor() throws IOException
    {
        if (iv == null || iv.length == 0)
            throw new IllegalStateException("no initialization vector (IV) found in this context");
        return cipherFactory.getDecryptor(tdeOptions.cipher, tdeOptions.key_alias, iv);
    }

    public boolean isEnabled()
    {
        return tdeOptions.enabled;
    }

    public int getChunkLength()
    {
        return chunkLength;
    }

    public byte[] getIV()
    {
        return iv;
    }

View on GitHub (pinned to 88fd0f6a0e)