{"record":{"id":"2ba5d8c4f614adee","repo":"tursodatabase/turso","slug":"encryption-cipher-and-encryption-key-are-local-dat-2ba5d8","errorCode":null,"errorMessage":"Encryption Cipher and Encryption Key are local database options. Use Remote Encryption Cipher and Remote Encryption Key for embedded replicas.","messagePattern":"Encryption Cipher and Encryption Key are local database options\\. Use Remote Encryption Cipher and Remote Encryption Key for embedded replicas\\.","errorType":"validation","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"bindings/dotnet/src/Turso.Data/TursoConnection.cs","lineNumber":553,"sourceCode":"            AttachReplicaLease(lease);\n        }\n        catch\n        {\n            _turso?.Dispose();\n            _turso = null;\n            if (connectionCreated)\n                syncDatabase.ReleaseConnection();\n            _ = lease.Release();\n            throw;\n        }\n    }\n\n    internal TursoSyncDatabaseOptions CreateReplicaOptions()\n    {\n        if (_connectionOptions.GetEncryptionCipher().HasValue\n            || !string.IsNullOrWhiteSpace(_connectionOptions[\"Encryption Key\"]))\n        {\n            throw new InvalidOperationException(\n                \"Encryption Cipher and Encryption Key are local database options. \"\n                + \"Use Remote Encryption Cipher and Remote Encryption Key for embedded replicas.\");\n        }\n\n        TursoPartialSyncOptions? partialSync = null;\n        if (_connectionOptions.HasPartialSyncOptions)\n        {\n            partialSync = new TursoPartialSyncOptions\n            {\n                PrefixLength = _connectionOptions.PartialBootstrapPrefix == 0\n                    ? null\n                    : _connectionOptions.PartialBootstrapPrefix,\n                Query = string.IsNullOrWhiteSpace(_connectionOptions.PartialBootstrapQuery)\n                    ? null\n                    : _connectionOptions.PartialBootstrapQuery,\n                SegmentSize = _connectionOptions.PartialSyncSegmentSize == 0\n                    ? null\n                    : _connectionOptions.PartialSyncSegmentSize,","sourceCodeStart":535,"sourceCodeEnd":571,"githubUrl":"https://github.com/tursodatabase/turso/blob/6c7252267988c76e632af00a671e4b9788dfae13/bindings/dotnet/src/Turso.Data/TursoConnection.cs#L535-L571","documentation":"In the Turso .NET driver, local-database encryption is configured with 'Encryption Cipher'/'Encryption Key', but embedded replicas replicate from a remote primary whose encryption settings must match the remote database. CreateReplicaOptions() rejects local encryption options when building a replica so a mismatch between local and remote encryption cannot silently corrupt the replica; you must use 'Remote Encryption Cipher'/'Remote Encryption Key' instead.","triggerScenarios":"Calling Open()/OpenAsync() on a TursoConnection whose connection string sets 'Encryption Cipher' or 'Encryption Key' (non-empty) while using an embedded-replica data source (Replica Path / remote URL with replica), which invokes CreateReplicaOptions via syncDatabase/options/partial-sync-modifiers bootstrap paths.","commonSituations":"Copy-pasting a local-database connection string that already had Encryption Cipher/Key and switching the data source to an embedded replica; attempting to encrypt the local replica file with the same key as the primary.","solutions":["Remove 'Encryption Cipher' and 'Encryption Key' from the connection string.","If the remote primary is encrypted, add 'Remote Encryption Cipher=<cipher>' and 'Remote Encryption Key=<key>' matching the primary's settings.","If you only want a local encrypted database (no replication), open it as a plain local connection instead of an embedded replica."],"exampleFix":"// before\nnew TursoConnection(\"Data Source=replica.db;Replica Path=replica.db;Encryption Cipher=aes-256-cbc;Encryption Key=secret\");\n// after\nnew TursoConnection(\"Data Source=replica.db;Replica Path=replica.db;Remote Encryption Cipher=aes-256-cbc;Remote Encryption Key=secret\");","handlingStrategy":"validation","validationCode":"var opts = new TursoConnectionOptions(connectionString);\nif (opts.GetEncryptionCipher().HasValue || !string.IsNullOrWhiteSpace(opts[\"Encryption Key\"]))\n    throw new ArgumentException(\"Use Remote Encryption Cipher/Key for embedded replicas, not Encryption Cipher/Key.\");","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep two distinct connection-string templates: one for local-only databases (Encryption*) and one for replicas (Remote Encryption*).","Validate connection strings in app startup before opening connections."],"tags":["dotnet","embedded-replica","encryption","connection-string"],"backgroundTag":"wrong-encryption-option-for-replica","analyzedSha":"6c7252267988c76e632af00a671e4b9788dfae13","analyzedAt":"2026-08-31T11:17:35.598Z","contentChangedAt":"2026-08-31T11:17:35.598Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}