{"record":{"id":"1f730f21406720d1","repo":"apache/cassandra","slug":"failed-to-create-encyption-context-for-hints-file","errorCode":null,"errorMessage":"failed to create encyption context for hints file. ignoring encryption for hints.","messagePattern":"failed to create encyption context for hints file\\. ignoring encryption for hints\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"src/java/org/apache/cassandra/hints/HintsDescriptor.java","lineNumber":187,"sourceCode":"                    cipher = encryptionContext.getDecryptor();\n                }\n                else\n                {\n                    cipher = encryptionContext.getEncryptor();\n                    ImmutableMap<String, Object> encParams = ImmutableMap.<String, Object>builder()\n                                                                 .putAll(encryptionContext.toHeaderParameters())\n                                                                 .put(EncryptionContext.ENCRYPTION_IV, Hex.bytesToHex(cipher.getIV()))\n                                                                 .build();\n\n                    Map<String, Object> map = new HashMap<>(params);\n                    map.put(ENCRYPTION, encParams);\n                    params = ImmutableMap.<String, Object>builder().putAll(map).build();\n                }\n                return new EncryptionData(cipher, encryptionContext.getCompressor(), params);\n            }\n            catch (IOException ioe)\n            {\n                logger.warn(\"failed to create encyption context for hints file. ignoring encryption for hints.\", ioe);\n                return null;\n            }\n        }\n        else\n        {\n            return null;\n        }\n    }\n\n    private static final class EncryptionData\n    {\n        final Cipher cipher;\n        final ICompressor compressor;\n        final ImmutableMap<String, Object> params;\n\n        private EncryptionData(Cipher cipher, ICompressor compressor, ImmutableMap<String, Object> params)\n        {\n            this.cipher = cipher;","sourceCodeStart":169,"sourceCodeEnd":205,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/hints/HintsDescriptor.java#L169-L205","documentation":"When opening a hints file, HintsDescriptor attempts to build the encryption context (cipher, compressor, parameters) from the descriptor's parameters and the configured encryption context. If constructing the EncryptionData throws an IOException, encryption for that hints file is silently dropped: the error is logged with this warning and null is returned, so the file is read/written without encryption.","triggerScenarios":"createEncryption invoked with encryption parameters present but encryptionContext or cipher construction throws IOException — e.g. misconfigured cipher algorithm, missing/unreadable key material, bad compressor setting in the hint file parameters map.","commonSituations":"Transparent data encryption configured with an unavailable key provider; hints file written under a different encryption config than current node config; wrong cipher/transformation name in cassandra.yaml.","solutions":["Check cassandra.yaml encryption_options (hints) — verify cipher algorithm, key provider, and keystore paths are valid and readable","Fix the underlying IOException detail logged with the warning (it names the actual cause)","Once config is fixed, re-encrypt/rewrite hints or accept unencrypted hints for new files","Ensure the keystore/password files exist and have correct permissions on every node"],"exampleFix":"// before (cassandra.yaml)\nhints:\n  cipher: 'AES/UnknownMode'\n// after\nhints:\n  cipher: 'AES/CBC/PKCS5Padding'\n  key_provider: KmipKeyProvider\n  kmip_host: kmip.example.internal","handlingStrategy":"validation","validationCode":"// validate encryption config before enabling hints encryption\nEncryptionContext ctx = DatabaseDescriptor.getEncryptionContext();\nif (ctx.isEnabled()) {\n  Objects.requireNonNull(ctx.getKeyProvider(), \"key provider required\");\n  // verify keystore file readable and cipher supported before restart\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Test encryption config with a rolling restart on one node first","Keep keystore files and permissions consistent cluster-wide","Match cipher/compressor settings across nodes writing and reading hints","Read the chained IOException for the real cause"],"tags":["hints","encryption","config","io"],"backgroundTag":"invalid-config-value","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}