{"record":{"id":"3334dfd539f547b3","repo":"dgraph-io/badger","slug":"errinvalidencryptionkey","errorCode":"ErrInvalidEncryptionKey","errorMessage":"Encryption key's length shouldeither 16, 24, or 32 bytes","messagePattern":"Encryption key's length shouldeither 16, 24, or 32 bytes","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"errors.go","lineNumber":107,"sourceCode":"\tErrTruncateNeeded = stderrors.New(\n\t\t\"Log truncate required to run DB. This might result in data loss\")\n\n\t// ErrBlockedWrites is returned if the user called DropAll. During the process of dropping all\n\t// data from Badger, we stop accepting new writes, by returning this error.\n\tErrBlockedWrites = stderrors.New(\"Writes are blocked, possibly due to DropAll or Close\")\n\n\t// ErrNilCallback is returned when subscriber's callback is nil.\n\tErrNilCallback = stderrors.New(\"Callback cannot be nil\")\n\n\t// ErrEncryptionKeyMismatch is returned when the storage key is not\n\t// matched with the key previously given.\n\tErrEncryptionKeyMismatch = stderrors.New(\"Encryption key mismatch\")\n\n\t// ErrInvalidDataKeyID is returned if the datakey id is invalid.\n\tErrInvalidDataKeyID = stderrors.New(\"Invalid datakey id\")\n\n\t// ErrInvalidEncryptionKey is returned if length of encryption keys is invalid.\n\tErrInvalidEncryptionKey = stderrors.New(\"Encryption key's length should be\" +\n\t\t\"either 16, 24, or 32 bytes\")\n\t// ErrGCInMemoryMode is returned when db.RunValueLogGC is called in in-memory mode.\n\tErrGCInMemoryMode = stderrors.New(\"Cannot run value log GC when DB is opened in InMemory mode\")\n\n\t// ErrGCInReadOnlyMode is returned when db.RunValueLogGC is called in read-only mode.\n\tErrGCInReadOnlyMode = stderrors.New(\"Cannot run value log GC when DB is opened in ReadOnly mode\")\n\n\t// ErrDBClosed is returned when a get operation is performed after closing the DB.\n\tErrDBClosed = stderrors.New(\"DB Closed\")\n)\n","sourceCodeStart":89,"sourceCodeEnd":118,"githubUrl":"https://github.com/dgraph-io/badger/blob/2a001d466f6b71a917319a1db41f99860e16e269/errors.go#L89-L118","documentation":"ErrInvalidEncryptionKey is returned by OpenKeyRegistry when the supplied EncryptionKey option has a length other than 16, 24, or 32 bytes (AES-128/192/256). Badger validates key size before building the registry.","triggerScenarios":"Calling OpenKeyRegistry (or opening a DB with encryption enabled) with opt.EncryptionKey set to an empty slice, a raw passphrase string, a base64 string not yet decoded, or a hex-decoded key of the wrong length.","commonSituations":"Passing a human password instead of a derived AES key; forgetting base64 decoding of a key from env/config; truncating a 32-byte key to fewer bytes; generating keys with an entropy function returning arbitrary-length slices.","solutions":["Generate a key of exactly 16, 24, or 32 bytes (e.g. crypto/rand.Read(make([]byte, 32)))","Decode base64/hex-encoded keys before assigning to opt.EncryptionKey and check the decoded length","Derive an AES key from a password with a KDF (e.g. scrypt/argon2) sized to 32 bytes","Add a startup assertion: len(key) must be 16, 24, or 32 before opening the DB"],"exampleFix":"// before\nopts.EncryptionKey = []byte(os.Getenv(\"DB_KEY\")) // arbitrary length\n// after\nraw, _ := base64.StdEncoding.DecodeString(os.Getenv(\"DB_KEY\"))\nif len(raw) != 32 {\n    return errors.New(\"DB_KEY must decode to 32 bytes\")\n}\nopts.EncryptionKey = raw","handlingStrategy":"validation","validationCode":"switch len(key) {\ncase 16, 24, 32:\n    // ok\ndefault:\n    return fmt.Errorf(\"encryption key must be 16, 24, or 32 bytes, got %d\", len(key))\n}","typeGuard":"func isValidAESKey(key []byte) bool {\n    return len(key) == 16 || len(key) == 24 || len(key) == 32\n}","tryCatchPattern":null,"preventionTips":["Generate keys with crypto/rand at a fixed AES size","Decode encoded keys (base64/hex) before use and assert decoded length","Never pass raw passwords as EncryptionKey; derive with a KDF","Unit-test key loading so bad lengths fail before badger.Open"],"tags":["badger","encryption","validation","key-length"],"backgroundTag":"invalid-encryption-key-length","analyzedSha":"2a001d466f6b71a917319a1db41f99860e16e269","analyzedAt":"2026-09-05T13:00:02.264Z","contentChangedAt":"2026-09-05T13:00:02.264Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}