{"record":{"id":"062cbd7ee29079f8","repo":"hashicorp/nomad","slug":"invalid-algorithm-s","errorCode":null,"errorMessage":"invalid algorithm %s","messagePattern":"invalid algorithm (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/encrypter.go","lineNumber":675,"sourceCode":"\tif rootKey == nil || rootKey.Meta == nil {\n\t\treturn nil, fmt.Errorf(\"missing metadata\")\n\t}\n\tvar wrapper kms.Wrapper\n\n\tswitch rootKey.Meta.Algorithm {\n\tcase structs.EncryptionAlgorithmAES256GCM:\n\t\twrapper = aead.NewWrapper()\n\t\t_, err := wrapper.SetConfig(context.Background(),\n\t\t\taead.WithAeadType(kms.AeadTypeAesGcm),\n\t\t\taead.WithHashType(kms.HashTypeSha256),\n\t\t\taead.WithKey(rootKey.Key),\n\t\t\tkms.WithKeyId(rootKey.Meta.KeyID),\n\t\t)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"could not configure cipher: %w\", err)\n\t\t}\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"invalid algorithm %s\", rootKey.Meta.Algorithm)\n\t}\n\n\ted25519Key := ed25519.NewKeyFromSeed(rootKey.Key)\n\n\tcs := cipherSet{\n\t\trootKey:         rootKey,\n\t\twrapper:         wrapper,\n\t\teddsaPrivateKey: ed25519Key,\n\t}\n\n\t// Unmarshal RSAKey for Workload Identity JWT signing if one exists. Prior to\n\t// 1.7 only the ed25519 key was used.\n\tif len(rootKey.RSAKey) > 0 {\n\t\trsaKey, err := x509.ParsePKCS1PrivateKey(rootKey.RSAKey)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error parsing rsa key: %w\", err)\n\t\t}\n","sourceCodeStart":657,"sourceCodeEnd":693,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/encrypter.go#L657-L693","documentation":"generateCipher only supports root keys whose Meta.Algorithm is a known value (e.g. EncryptionAlgorithmAES256GCM). An unrecognized algorithm string falls through the switch's default case and returns \"invalid algorithm %s\".","triggerScenarios":"A root key record carries an Algorithm value not in the switch — e.g. data written by a newer Nomad version introducing a new algorithm, or a hand-edited/corrupted Meta.Algorithm.","commonSituations":"Cluster state restored from a newer Nomad into an older agent; manual edits to keyring records; typo'd algorithm when constructing keys programmatically.","solutions":["Read the %s in the message and compare against supported structs.EncryptionAlgorithm* constants for your Nomad version","Upgrade all agents to a version that supports the algorithm in the key record","Rotate the key to one using a supported algorithm (e.g. aes256-gcm)","Never hand-edit Meta.Algorithm in state; use the keyring API"],"exampleFix":"// before\nMeta: &structs.RootKeyMeta{Algorithm: \"aes128-gcm\"}  // unsupported\n// after\nMeta: &structs.RootKeyMeta{Algorithm: structs.EncryptionAlgorithmAES256GCM}","handlingStrategy":"validation","validationCode":"switch rootKey.Meta.Algorithm {\ncase structs.EncryptionAlgorithmAES256GCM:\n    // ok\ndefault:\n    return fmt.Errorf(\"unsupported algorithm %q for this Nomad version\", rootKey.Meta.Algorithm)\n}","typeGuard":"func supportedAlgorithm(a structs.EncryptionAlgorithm) bool { return a == structs.EncryptionAlgorithmAES256GCM }","tryCatchPattern":"if err != nil && strings.HasPrefix(err.Error(), \"invalid algorithm\") { /* upgrade agents or rotate key to aes256-gcm */ }","preventionTips":["Pin all agents to a Nomad version supporting every algorithm present in keyring state","Never hand-write Meta.Algorithm values","Test cross-version state upgrades in staging"],"tags":["encryption","keyring","invalid-algorithm","version-compatibility"],"backgroundTag":"invalid-algorithm","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}