{"record":{"id":"00bb884f160bc072","repo":"apache/iceberg","slug":"metadata-file-might-have-been-modified-dek-length","errorCode":null,"errorMessage":"Metadata file might have been modified. DEK length %s differs from HMS value %s","messagePattern":"Metadata file might have been modified\\. DEK length (.+?) differs from HMS value (.+?)","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"hive-metastore/src/main/java/org/apache/iceberg/hive/HiveTableOperations.java","lineNumber":606,"sourceCode":"\n    String encryptionKeyIdFromMetadata =\n        propertiesFromMetadata.get(TableProperties.ENCRYPTION_TABLE_KEY);\n    if (!Objects.equals(encryptionKeyIdFromHMS, encryptionKeyIdFromMetadata)) {\n      String errMsg =\n          String.format(\n              \"Metadata file might have been modified. Encryption key id %s differs from HMS value %s\",\n              encryptionKeyIdFromMetadata, encryptionKeyIdFromHMS);\n      throw new RuntimeException(errMsg);\n    }\n\n    String dekLengthFromMetadata =\n        propertiesFromMetadata.get(TableProperties.ENCRYPTION_DEK_LENGTH);\n    if (!Objects.equals(dekLengthFromHMS, dekLengthFromMetadata)) {\n      String errMsg =\n          String.format(\n              \"Metadata file might have been modified. DEK length %s differs from HMS value %s\",\n              dekLengthFromMetadata, dekLengthFromHMS);\n      throw new RuntimeException(errMsg);\n    }\n  }\n\n  @VisibleForTesting\n  HiveLock lockObject(TableMetadata metadata) {\n    if (hiveLockEnabled(metadata, conf)) {\n      return new MetastoreLock(conf, metaClients, catalogName, database, tableName);\n    } else {\n      return new NoLock();\n    }\n  }\n}\n","sourceCodeStart":588,"sourceCodeEnd":619,"githubUrl":"https://github.com/apache/iceberg/blob/86d9c8fc543e7c56c9f624eb725f76c9baff9570/hive-metastore/src/main/java/org/apache/iceberg/hive/HiveTableOperations.java#L588-L619","documentation":"During refresh, HiveTableOperations verifies that the DEK (data encryption key) length recorded in the Iceberg metadata file matches the DEK length stored in HMS table parameters. A mismatch means the metadata file may have been altered outside Iceberg's commit protocol, so a RuntimeException is thrown. This prevents loading a table whose encryption configuration cannot be trusted.","triggerScenarios":"Any refresh path (doRefresh via table refresh/load) where TableProperties.ENCRYPTION_DEK_LENGTH in the metadata JSON differs from the dekLength value in HMS parameters.","commonSituations":"Out-of-band edits to HMS parameters or metadata files; restoring old metadata versions; configuring DEK length differently on two writer versions or tools; migration between encryption configurations done manually.","solutions":["Compare TableProperties.ENCRYPTION_DEK_LENGTH in the metadata file with the HMS table parameter value and re-align them via a proper Iceberg property commit.","Restore the correct metadata file version so it matches HMS, or update HMS through the same Iceberg commit that wrote the metadata.","Ensure all writers use the same encryption/DEK configuration; check for versions or tools that set a different DEK length.","Stop any manual mutation of HMS table parameters for Iceberg tables."],"exampleFix":"// before: metadata says dek length 32, HMS says 16\n// after: fix through Iceberg\nTable table = catalog.loadTable(identifier);\ntable.updateProperties().set(TableProperties.ENCRYPTION_DEK_LENGTH, \"32\").commit();\ntable.refresh();","handlingStrategy":"validation","validationCode":"String dekInMetadata = table.operations().current().properties().get(TableProperties.ENCRYPTION_DEK_LENGTH);\nString dekInHms = hmsTable.getParameters().get(TableProperties.ENCRYPTION_DEK_LENGTH);\nif (!Objects.equals(dekInMetadata, dekInHms)) {\n  throw new IllegalStateException(\"DEK length mismatch between metadata and HMS\");\n}","typeGuard":null,"tryCatchPattern":"try {\n  table.refresh();\n} catch (RuntimeException e) {\n  if (e.getMessage() != null && e.getMessage().contains(\"DEK length\")) {\n    // re-align DEK length via updateProperties, then retry\n  } else { throw e; }\n}","preventionTips":["Use a single, consistent ENCRYPTION_DEK_LENGTH configuration across all writers.","Avoid restoring old metadata files without updating HMS in the same operation.","Set encryption properties only via Iceberg APIs.","Document and control who may modify encryption settings for the table."],"tags":["hive-metastore","encryption","integrity-check","dek-length"],"backgroundTag":"checksum-mismatch","analyzedSha":"86d9c8fc543e7c56c9f624eb725f76c9baff9570","analyzedAt":"2026-09-12T00:46:39.097Z","contentChangedAt":"2026-09-12T00:46:39.097Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}