{"record":{"id":"28e7354cdbe51b12","repo":"risingwavelabs/risingwave","slug":"failed-to-encrypt-or-decrypt-the-secret","errorCode":null,"errorMessage":"failed to encrypt or decrypt the secret","messagePattern":"failed to encrypt or decrypt the secret","errorType":"exception","errorClass":"SecretError","httpStatus":null,"severity":"error","filePath":"src/common/secret/src/error.rs","lineNumber":37,"sourceCode":"use super::SecretId;\n\npub type SecretResult<T> = Result<T, SecretError>;\n\n#[derive(Error, Debug, Construct)]\npub enum SecretError {\n    #[error(\"secret not found: {0}\")]\n    ItemNotFound(SecretId),\n\n    #[error(\"decode utf8 error: {0}\")]\n    DecodeUtf8Error(#[from] std::string::FromUtf8Error),\n\n    #[error(\"I/O error: {0}\")]\n    IoError(#[from] std::io::Error),\n\n    #[error(\"unspecified secret ref type: {0}\")]\n    UnspecifiedRefType(SecretId),\n\n    #[error(\"failed to encrypt or decrypt the secret\")]\n    AesError,\n\n    #[error(\"ser/de proto message error: {0}\")]\n    ProtoError(#[from] bincode::Error),\n\n    #[error(transparent)]\n    Internal(#[from] anyhow::Error),\n}\n","sourceCodeStart":19,"sourceCodeEnd":46,"githubUrl":"https://github.com/risingwavelabs/risingwave/blob/6469eb736d691e8e9b8a419a57edd6429ca77417/src/common/secret/src/error.rs#L19-L46","documentation":"SecretError::AesError is a fixed-message variant raised when encrypting or decrypting a secret fails. It carries no cause, so the AES cipher operation itself rejected the input (bad key size, invalid ciphertext, padding errors, etc.) and the code collapses it into this opaque error.","triggerScenarios":"Attempting to decrypt a secret blob with a key that does not match the one used to encrypt it; encrypt/decrypt helpers receiving malformed or truncated ciphertext; AES key material of invalid length being used in the secret encryption path.","commonSituations":"The cluster encryption key was rotated or changed while old encrypted secrets persisted in meta storage; secrets copied between environments with different encryption keys; corrupted secret blobs after a bad restore/migration.","solutions":["Restore/keep the original encryption key used when the secrets were written.","Re-create the affected secrets so they are encrypted with the current key.","Check for key rotation/migration procedures and re-encrypt stored secrets as part of it.","If blobs are corrupted, delete and re-ingest the secret values."],"exampleFix":"// before\n// env key changed after secrets were encrypted with the old key\nRW_ENCRYPTION_KEY=newkey risingwave --listen ... // decrypt fails: AesError\n\n// after\nRW_ENCRYPTION_KEY=<original-key> risingwave --listen ...\n// then re-CREATE SECRETs so they are re-encrypted under the current key","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"match manager.get(id).await {\n    Ok(secret) => secret,\n    Err(SecretError::AesError) => {\n        // decryption failed: key mismatch or corrupted blob.\n        // Non-retryable — re-create the secret under the current key.\n        return Err(anyhow!(\"cannot decrypt secret {id}; re-create it (AesError)\"));\n    }\n    Err(e) => return Err(e.into()),\n}","preventionTips":["Never rotate encryption keys in place; re-encrypt all secrets as part of rotation.","Keep encryption keys stable across restarts and environments.","Validate secret blobs after restores/migrations by test-decrypting them.","Use authenticated encryption consistently so corruption is detected early."],"tags":["secret","encryption","aes","crypto"],"backgroundTag":"checksum-mismatch","analyzedSha":"6469eb736d691e8e9b8a419a57edd6429ca77417","analyzedAt":"2026-09-11T21:06:21.487Z","contentChangedAt":"2026-09-11T21:06:21.487Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}