{"record":{"id":"1e5e8adca71118d9","repo":"pulumi/pulumi","slug":"encryptedlog-invalid-session-key-size-d","errorCode":null,"errorMessage":"encryptedlog: invalid session key size %d","messagePattern":"encryptedlog: invalid session key size (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/engine/encryptedlog/reader.go","lineNumber":77,"sourceCode":"\n\tvar keyLenBuf [2]byte\n\tif _, err := io.ReadFull(r, keyLenBuf[:]); err != nil {\n\t\treturn nil, fmt.Errorf(\"encryptedlog: reading key length: %w\", err)\n\t}\n\tkeyLen := binary.BigEndian.Uint16(keyLenBuf[:])\n\n\tencryptedKeyBytes := make([]byte, keyLen)\n\tif _, err := io.ReadFull(r, encryptedKeyBytes); err != nil {\n\t\treturn nil, fmt.Errorf(\"encryptedlog: reading encrypted key: %w\", err)\n\t}\n\n\tdecryptedKey, err := dec.DecryptValue(ctx, string(encryptedKeyBytes))\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"encryptedlog: decrypting session key: %w\", err)\n\t}\n\tsessionKey := []byte(decryptedKey)\n\tif len(sessionKey) != keySize {\n\t\treturn nil, fmt.Errorf(\"encryptedlog: invalid session key size %d\", len(sessionKey))\n\t}\n\n\t// Set up AES-256-GCM from the session key.\n\tblock, err := aes.NewCipher(sessionKey)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"encryptedlog: creating cipher: %w\", err)\n\t}\n\taesgcm, err := cipher.NewGCM(block)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"encryptedlog: creating GCM: %w\", err)\n\t}\n\n\treturn &Reader{cd: &chunkDecrypter{r: r, aesgcm: aesgcm}}, nil\n}\n\n// Read reads decrypted, decompressed log data.\nfunc (elr *Reader) Read(p []byte) (int, error) {\n\treturn elr.cd.Read(p)","sourceCodeStart":59,"sourceCodeEnd":95,"githubUrl":"https://github.com/pulumi/pulumi/blob/793f7b2e160db4321fb7fb6b0607461e01cb251e/pkg/engine/encryptedlog/reader.go#L59-L95","documentation":"The session key decrypted from the header does not have the expected keySize length (32 bytes for AES-256). Decryption succeeded, but the plaintext key is the wrong size, so the reader rejects it instead of constructing a cipher with an invalid key.","triggerScenarios":"Calling NewReader with a Decrypter that returns something other than the raw 32-byte session key — e.g. decrypting ciphertext that was not the session key (wrong stack's ciphertext), or a decrypter that returns a wrapper/JSON envelope rather than raw bytes.","commonSituations":"Pointing a decrypter at a ciphertext from a different stack or file; secrets providers that base64-wrap values; mixing log files and secret configurations from different deployments.","solutions":["Confirm the encrypted log and the decrypter belong to the same stack/deployment (same secret key material).","Check whether your secrets provider returns decoded raw bytes; unwrap/base64-decode if it returns an envelope.","Re-export the log so it is written with the current secrets provider and key."],"exampleFix":"// before: decrypting ciphertext from a different stack\ndec := stackDecrypter(otherStack)\nrdr, err := encryptedlog.NewReader(ctx, f, dec) // invalid session key size\n// after: use the decrypter for the stack that produced the log\ndec := stackDecrypter(logSourceStack)\nrdr, err := encryptedlog.NewReader(ctx, f, dec)","handlingStrategy":"validation","validationCode":"plain, err := dec.DecryptValue(ctx, ciphertextB64)\nif err == nil && len(plain) != 32 {\n\treturn fmt.Errorf(\"decrypter returned %d bytes, expected a 32-byte AES-256 key; wrong stack/provider?\", len(plain))\n}","typeGuard":null,"tryCatchPattern":"rdr, err := encryptedlog.NewReader(ctx, r, dec)\nif err != nil && strings.Contains(err.Error(), \"invalid session key size\") {\n\treturn errors.New(\"decrypter does not correspond to this log's secrets provider; use the originating stack's decrypter\")\n}","preventionTips":["Pair each log with the decrypter of the stack that wrote it.","Test-decrypt a known ciphertext after changing secrets providers.","Avoid decrypters that return wrapped/encoded values; unwrap to raw bytes first."],"tags":["go","crypto","aes","key-size","encryptedlog"],"backgroundTag":"invalid-key-size","analyzedSha":"793f7b2e160db4321fb7fb6b0607461e01cb251e","analyzedAt":"2026-08-31T09:36:43.099Z","schemaVersion":2},"datasetVersion":"2026-09-01T08:17:40.651Z"}