{"record":{"id":"1cf9d0e9301cf09c","repo":"siyuan-note/siyuan","slug":"316","errorCode":"316","errorMessage":"Decryption failed: incorrect key or corrupted data","messagePattern":"Decryption failed: incorrect key or corrupted data","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"kernel/model/crypto.go","lineNumber":1187,"sourceCode":"func deriveNotebookCryptoBackupCandidate(password string) (backup *conf.NotebookCrypto, kek []byte, err error) {\n\tbackup, err = loadNotebookCryptoBackup()\n\tif err != nil || backup == nil || len(backup.MasterSalt) == 0 || len(backup.KEKVerifier) == 0 {\n\t\treturn nil, nil, errors.New(Conf.Language(310))\n\t}\n\tparams, validErr := util.ValidateArgon2Params(backup.KDFParams)\n\tif validErr != nil {\n\t\treturn nil, nil, errors.New(Conf.Language(317))\n\t}\n\tkek = util.DeriveKey(password, backup.MasterSalt, params)\n\tdecrypted, decryptErr := util.DecryptWithAAD(kek, backup.KEKVerifier, []byte(\"siyuan:kek-verifier\"))\n\tif decryptErr != nil || string(decrypted) != string(kekVerifierMagic) {\n\t\tzeroAndClear(kek)\n\t\treturn nil, nil, errors.New(Conf.Language(311))\n\t}\n\tif backup.Spec != conf.CurrentNotebookCryptoSpec || backup.Checksum == \"\" ||\n\t\tlen(backup.KEKMAC) == 0 || !verifyKEKMAC(backup, kek) {\n\t\tzeroAndClear(kek)\n\t\treturn nil, nil, errors.New(Conf.Language(316))\n\t}\n\tif !verifyKEKAgainstExistingBoxes(kek) || !verifyKEKAgainstEncryptedHistory(kek) {\n\t\tzeroAndClear(kek)\n\t\treturn nil, nil, errors.New(Conf.Language(316))\n\t}\n\tbackup.KDFParams = params\n\treturn backup, kek, nil\n}\n\n// deriveKEK 从主密码派生 KEK 并校验。校验失败返回错误。KEK 仅在函数作用域内有效，调用方负责使用。\nfunc deriveKEK(password string) ([]byte, error) {\n\tConf.m.RLock()\n\tnc := *Conf.NotebookCrypto\n\tConf.m.RUnlock()\n\n\tif !nc.Enabled {\n\t\t// 本机未启用：可能是数据同步到新设备后本机 conf.json 还没有加密配置。\n\t\t// 尝试从 DataDir 备份恢复（备份会随 DataDir 同步过来）；恢复成功时直接复用其派生的 KEK。","sourceCodeStart":1169,"sourceCodeEnd":1205,"githubUrl":"https://github.com/siyuan-note/siyuan/blob/251596fc0de2f9528c00c224252fd073a99973f4/kernel/model/crypto.go#L1169-L1205","documentation":"Thrown by deriveNotebookCryptoBackupCandidate (crypto.go:1187, i18n code 316) when the KEK passed the verifier magic check but the backup fails integrity authentication: the Spec is not CurrentNotebookCryptoSpec, Checksum is empty, KEKMAC is empty, or verifyKEKMAC fails. A backup that decrypts but does not authenticate is treated as corrupted or tampered, so it is rejected to prevent using untrusted key material.","triggerScenarios":"deriveNotebookCryptoBackupCandidate: backup.Spec != conf.CurrentNotebookCryptoSpec, backup.Checksum == \"\", len(backup.KEKMAC) == 0, or the HMAC computed over the backup does not equal backup.KEKMAC under the derived KEK.","commonSituations":"Backup from an incompatible spec version (upgrade/downgrade across format changes). Backup truncated or bit-flipped (MAC mismatch). Backup hand-edited. Sync delivered a partially-updated backup.","solutions":["Restore a complete, spec-compatible backup from a known-good sync snapshot or another device.","Upgrade/downgrade the kernel to a version whose CurrentNotebookCryptoSpec matches the backup, if the backup is intentionally from another spec era.","If the local conf.json authenticates instead (localAuthenticated path in deriveKEK), prefer it and let the model repair the backup automatically."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Confirm backup integrity before recovery.\nb, err := loadNotebookCryptoBackup()\nif err != nil || b == nil {\n    return errors.New(\"no backup\")\n}\nif b.Spec != conf.CurrentNotebookCryptoSpec || b.Checksum == \"\" || len(b.KEKMAC) == 0 {\n    return errors.New(\"backup fails spec/checksum/MAC; restore a complete backup\")\n}","typeGuard":null,"tryCatchPattern":"if err := model.UnlockBox(boxID, password, boxCrypt); err != nil {\n    if err.Error() == model.Conf.Language(316) {\n        respond(c, \"key backup failed integrity check; restore a trusted backup\")\n        return\n    }\n    respond(c, err.Error())\n}","preventionTips":["Never edit or truncate the backup file.","Keep kernel version aligned with the backup's NotebookCryptoSpec.","Maintain a known-good backup copy for restore."],"tags":["encryption","notebook-crypto","integrity","mac","backup"],"backgroundTag":null,"analyzedSha":"251596fc0de2f9528c00c224252fd073a99973f4","analyzedAt":"2026-08-12T21:18:37.123Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}