{"record":{"id":"162a10eec76173d9","repo":"hashicorp/nomad","slug":"could-not-configure-cipher-w","errorCode":null,"errorMessage":"could not configure cipher: %w","messagePattern":"could not configure cipher: %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/encrypter.go","lineNumber":672,"sourceCode":"\nfunc (e *Encrypter) generateCipher(rootKey *structs.UnwrappedRootKey) (*cipherSet, error) {\n\n\tif rootKey == nil || rootKey.Meta == nil {\n\t\treturn nil, fmt.Errorf(\"missing metadata\")\n\t}\n\tvar wrapper kms.Wrapper\n\n\tswitch rootKey.Meta.Algorithm {\n\tcase structs.EncryptionAlgorithmAES256GCM:\n\t\twrapper = aead.NewWrapper()\n\t\t_, err := wrapper.SetConfig(context.Background(),\n\t\t\taead.WithAeadType(kms.AeadTypeAesGcm),\n\t\t\taead.WithHashType(kms.HashTypeSha256),\n\t\t\taead.WithKey(rootKey.Key),\n\t\t\tkms.WithKeyId(rootKey.Meta.KeyID),\n\t\t)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"could not configure cipher: %w\", err)\n\t\t}\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"invalid algorithm %s\", rootKey.Meta.Algorithm)\n\t}\n\n\ted25519Key := ed25519.NewKeyFromSeed(rootKey.Key)\n\n\tcs := cipherSet{\n\t\trootKey:         rootKey,\n\t\twrapper:         wrapper,\n\t\teddsaPrivateKey: ed25519Key,\n\t}\n\n\t// Unmarshal RSAKey for Workload Identity JWT signing if one exists. Prior to\n\t// 1.7 only the ed25519 key was used.\n\tif len(rootKey.RSAKey) > 0 {\n\t\trsaKey, err := x509.ParsePKCS1PrivateKey(rootKey.RSAKey)\n\t\tif err != nil {","sourceCodeStart":654,"sourceCodeEnd":690,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/encrypter.go#L654-L690","documentation":"The aead KMS wrapper's SetConfig (via options aead.WithAeadType/WithHashType/WithKey/WithKeyId) failed while configuring AES-GCM for the cipher set, wrapped as \"could not configure cipher\". This indicates the wrapper rejected the key material or options.","triggerScenarios":"aead.NewWrapper().SetConfig(...) errors — most commonly because rootKey.Key is the wrong length for AES-256-GCM (must be 32 bytes) or KeyID is empty.","commonSituations":"Root key records with truncated/zeroed key bytes after a bad restore; hand-crafted keys in dev/test clusters; keys generated by an incompatible Nomad version.","solutions":["Check the wrapped SetConfig error for the exact option that failed (usually key length or key ID)","Ensure rootKey.Key is exactly 32 bytes for AES256GCM; rotate the key if it is malformed","Regenerate the key via nomad keyring API rather than hand-importing key bytes","Verify key records weren't truncated during snapshot export/import"],"exampleFix":"// before: manually imported 16-byte key into an AES256GCM root key record\n// after: rotate to a properly generated key\nnomad keygen / 'nomad operator keyring rotate'  # generates correct 32-byte AES-256 key","handlingStrategy":"validation","validationCode":"if len(rootKey.Key) != 32 { return fmt.Errorf(\"AES256GCM requires 32-byte key, got %d\", len(rootKey.Key)) }\nif rootKey.Meta.KeyID == \"\" { return errors.New(\"empty key ID\") }","typeGuard":"func aes256KeyValid(key []byte) bool { return len(key) == 32 }","tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"could not configure cipher\") { /* check key length/key ID, rotate key */ }","preventionTips":["Generate keys via the keyring API, never import ad-hoc byte slices","Assert 32-byte key length for aes256-gcm in tooling","Checksum key material after snapshot export/import"],"tags":["encryption","aes-gcm","kms","key-length"],"backgroundTag":"cipher-configuration-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}