{"record":{"id":"2c8dbf6cb3739173","repo":"kopia/kopia","slug":"error-decrypting-blob-v","errorCode":null,"errorMessage":"error decrypting BLOB %v","messagePattern":"error decrypting BLOB (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"internal/blobcrypto/blob_crypto.go","lineNumber":79,"sourceCode":"\tif err := c.Encryptor().Encrypt(payload, iv, output); err != nil {\n\t\treturn \"\", errors.Wrapf(err, \"error encrypting BLOB %v\", blobID)\n\t}\n\n\treturn blobID, nil\n}\n\n// Decrypt decrypts the provided data using provided blobID to derive initialization vector.\nfunc Decrypt(c Crypter, payload gather.Bytes, blobID blob.ID, output *gather.WriteBuffer) error {\n\tiv, err := getIndexBlobIV(blobID)\n\tif err != nil {\n\t\treturn errors.Wrap(err, \"unable to get index blob IV\")\n\t}\n\n\toutput.Reset()\n\n\t// Decrypt will verify the payload.\n\tif err := c.Encryptor().Decrypt(payload, iv, output); err != nil {\n\t\treturn errors.Wrapf(err, \"error decrypting BLOB %v\", blobID)\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":61,"sourceCodeEnd":84,"githubUrl":"https://github.com/kopia/kopia/blob/82495e54b584c1ef6073c9e1be048f57f8aef078/internal/blobcrypto/blob_crypto.go#L61-L84","documentation":"After deriving the IV, Decrypt calls Encryptor().Decrypt(payload, iv, output), which also verifies payload integrity (AEAD authentication). Failure is wrapped with 'error decrypting BLOB %v'. This almost always means the payload is corrupt, was truncated, or was encrypted with a different key.","triggerScenarios":"Calling Decrypt on a payload whose authentication tag fails verification — corrupted or tampered index blob data, wrong repository format/key, or truncated storage object.","commonSituations":"Storage backend returning corrupted or partially-written blobs; restoring blobs incorrectly; wrong passphrase/key supplied; bit rot on disk/object store.","solutions":["Verify the repository key/passphrase is correct","Re-read the blob from storage and check its integrity; re-download if the object store allows versioned reads","Remove/rebuild the affected index blob if it is corrupt (kopia index rebuild / index recover)","Check for storage backend issues (truncated uploads, failed syncs) and upgrade kopia if a format mismatch is suspected"],"exampleFix":"// before\nif err := crypto.Decrypt(c, payload, blobID, output); err != nil { return err }\n// after\nif err := crypto.Decrypt(c, payload, blobID, output); err != nil {\n    log.Errorf(\"index blob %v undecryptable; rebuilding index\", blobID)\n    return rebuildIndexBlob(ctx, blobID)\n}","handlingStrategy":"try-catch","validationCode":"// verify blob integrity before decrypt if storage supports it\nif err := st.GetBlob(ctx, blobID, 0, -1, buf); err != nil { return err }","typeGuard":null,"tryCatchPattern":"if err := blobcrypto.Decrypt(c, payload, blobID, output); err != nil {\n    log.Errorf(\"index blob %v failed integrity check: %v\", blobID, err)\n    return rebuildIndex(ctx, blobID)\n}","preventionTips":["Use versioned/immutable object storage to avoid truncated reads","Keep repository passphrase and key secure and consistent","Monitor storage backend for bit rot; enable server-side checksums","Have an index-rebuild runbook for undecryptable index blobs"],"tags":["encryption","crypto","data-corruption"],"backgroundTag":"checksum-mismatch","analyzedSha":"82495e54b584c1ef6073c9e1be048f57f8aef078","analyzedAt":"2026-09-07T20:35:21.689Z","contentChangedAt":"2026-09-07T20:35:21.689Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}