{"record":{"id":"31cba6c8269b0bed","repo":"cakephp/cakephp","slug":"invalid-key-for-s-key-must-be-at-least-256-bits-32-bytes","errorCode":null,"errorMessage":"Invalid key for %s, key must be at least 256 bits (32 bytes) long.","messagePattern":"Invalid key for (.+?), key must be at least 256 bits \\(32 bytes\\) long\\.","errorType":"exception","errorClass":"InvalidArgumentException","httpStatus":null,"severity":"error","filePath":"src/Utility/Security.php","lineNumber":228,"sourceCode":"        $crypto = static::engine();\n        $ciphertext = $crypto->encrypt($plain, $encryptionKey);\n        $hmac = hash_hmac('sha256', $ciphertext, $hmacKey);\n\n        return $hmac . $ciphertext;\n    }\n\n    /**\n     * Check the encryption key for proper length.\n     *\n     * @param string $key Key to check.\n     * @param string $method The method the key is being checked for.\n     * @return void\n     * @throws \\InvalidArgumentException When key length is not 256 bit/32 bytes\n     */\n    protected static function _checkKey(#[SensitiveParameter] string $key, string $method): void\n    {\n        if (mb_strlen($key, '8bit') < 32) {\n            throw new InvalidArgumentException(\n                sprintf('Invalid key for %s, key must be at least 256 bits (32 bytes) long.', $method),\n            );\n        }\n    }\n\n    /**\n     * Generate a key pair of encryption and authentication tokens.\n     *\n     * Encapsulates the two key generation implementations we support.\n     * The previous implementation has a keyspace reduction weakness.\n     *\n     * It is recommended to enable `Security.encryptWithRawKey` in new applications,\n     * to take advantage of longer keys that are longer and have derived encryption\n     * and authentication keys.\n     *\n     * @param string $key The bare key to use.\n     * @param string $hmacSalt The hmac salt to use.\n     * @return array{string, string} A list of $encryption, $authentication keys intended for encrypt() and decrypt().","sourceCodeStart":210,"sourceCodeEnd":246,"githubUrl":"https://github.com/cakephp/cakephp/blob/1128eba9b09f1946df684811350e26f2cef68fac/src/Utility/Security.php#L210-L246","documentation":"Security::_checkKey() enforces that encryption keys are at least 32 bytes (256 bits), throwing InvalidArgumentException naming the method (encrypt()/decrypt()). Short keys cannot provide the required AES-256 key material.","triggerScenarios":"Calling Security::encrypt($data, 'shortkey') or decrypt with a key string under 32 bytes; a Security.salt/secret value too short; key truncated by env var length or misconfigured constant.","commonSituations":"Developers passing a human-memorable password as key; migration from older CakePHP where shorter salts were tolerated; secrets placeholders like 'changeme' in local config; key read from config that was never generated properly.","solutions":["Generate a 32+ byte key, e.g. bin2hex(Security::randomBytes(32)) and use it","Ensure Security::getSalt() / configured application salt is at least 32 characters before calling encrypt/decrypt","Pass a raw binary key of >= 32 bytes rather than a passphrase","Update local/dev config placeholders to real long secrets"],"exampleFix":"// before\n$cipher = Security::encrypt($data, 'secret');\n// after\n$key = bin2hex(Security::randomBytes(32)); // 64 chars = 256 bits\n$cipher = Security::encrypt($data, $key);","handlingStrategy":"validation","validationCode":"if (mb_strlen($key, '8bit') < 32) {\n    throw new InvalidArgumentException('Encryption key must be at least 32 bytes');\n}","typeGuard":null,"tryCatchPattern":"try {\n    $cipher = Security::encrypt($data, $key);\n} catch (\\InvalidArgumentException $e) {\n    // rotate/extend key or abort; never proceed with short keys\n    throw new RuntimeException('Configured encryption key is too short', 0, $e);\n}","preventionTips":["Generate keys with bin2hex(Security::randomBytes(32)) or random_bytes(32)","Never use short passwords/placeholders as encryption keys","Validate configured secrets length at bootstrap/startup","Store keys in env/secrets manager, not hardcoded strings"],"tags":["php","cakephp","security","encryption","key-length"],"backgroundTag":"invalid-config-value","analyzedSha":"1128eba9b09f1946df684811350e26f2cef68fac","analyzedAt":"2026-09-12T12:07:00.388Z","contentChangedAt":"2026-09-12T12:07:00.388Z","schemaVersion":2},"datasetVersion":"2026-09-19T12:17:13.211Z"}