{"record":{"id":"2164e4320cf7bece","repo":"apache/cassandra","slug":"failed-to-load-key-from-cache","errorCode":null,"errorMessage":"failed to load key from cache: ","messagePattern":"failed to load key from cache: ","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/security/CipherFactory.java","lineNumber":151,"sourceCode":"        }\n        catch (NoSuchAlgorithmException | NoSuchPaddingException | InvalidAlgorithmParameterException | InvalidKeyException e)\n        {\n            logger.error(\"could not build cipher\", e);\n            throw new IOException(\"cannot load cipher\", e);\n        }\n    }\n\n    private Key retrieveKey(String keyAlias) throws IOException\n    {\n        try\n        {\n            return cache.get(keyAlias);\n        }\n        catch (CompletionException e)\n        {\n            if (e.getCause() instanceof IOException)\n                throw (IOException)e.getCause();\n            throw new IOException(\"failed to load key from cache: \" + keyAlias, e);\n        }\n    }\n\n    /**\n     * A simple struct to use with the thread local caching of Cipher as we can't get the mode (encrypt/decrypt) nor\n     * key_alias (or key!) from the Cipher itself to use for comparisons\n     */\n    private static class CachedCipher\n    {\n        public final int mode;\n        public final String keyAlias;\n        public final Cipher cipher;\n\n        private CachedCipher(int mode, String keyAlias, Cipher cipher)\n        {\n            this.mode = mode;\n            this.keyAlias = keyAlias;\n            this.cipher = cipher;","sourceCodeStart":133,"sourceCodeEnd":169,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/security/CipherFactory.java#L133-L169","documentation":"retrieveKey loads a key alias through a Caffeine cache; if the underlying loader completes exceptionally with a non-IOException (e.g. unchecked exception from the key provider), it is rethrown as IOException(\"failed to load key from cache: <alias>\"). The alias in the message identifies which key failed.","triggerScenarios":"cache.get(keyAlias) completes exceptionally with a CompletionException whose cause is not an IOException — e.g. KeyStoreException, RuntimeException, or UnrecoverableKeyException from the key provider.","commonSituations":"Corrupt keystore file, wrong keystore password, key alias removed during rotation while old commit log segments still reference it.","solutions":["Inspect the cause chain for the root error (wrong password, corrupt store, missing alias).","Verify the keystore password and that key_alias exists in the store.","Restore the referenced key version if it was rotated away; TDE segments still need the original key to decrypt."],"exampleFix":"// before: alias rotated out of keystore\nkeytool -delete -alias old_key -keystore .keystore\n// after: keep old keys while encrypted data referencing them exists\nkeytool -list -v -keystore .keystore  # confirm all aliases in use are retained","handlingStrategy":"try-catch","validationCode":"try (InputStream in = new FileInputStream(keystorePath)) {\n    KeyStore ks = KeyStore.getInstance(\"JCEKS\");\n    ks.load(in, password.toCharArray());\n    if (!ks.containsAlias(keyAlias)) throw new IllegalStateException(\"alias missing: \" + keyAlias);\n}","typeGuard":null,"tryCatchPattern":"try {\n    Key k = retrieveKey(alias);\n} catch (IOException e) {\n    if (e.getMessage().startsWith(\"failed to load key from cache\")) {\n        // root cause in e.getCause(); likely keystore/password/rotation issue\n    }\n}","preventionTips":["Never delete key aliases still referenced by encrypted commit log segments","Back up keystores before rotation","Alert on cache-load failures to catch keystore problems early"],"tags":["encryption","keystore","cache"],"backgroundTag":"file-read-failed","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}