{"record":{"id":"34b36b4d2ad1c96c","repo":"prestodb/presto","slug":"hive-invalid-encryption-metadata","errorCode":"HIVE_INVALID_ENCRYPTION_METADATA","errorMessage":"no column found for encryption field %s","messagePattern":"no column found for encryption field (.+?)","errorType":"error_code","errorClass":"PrestoException","httpStatus":null,"severity":"error","filePath":"presto-hive/src/main/java/com/facebook/presto/hive/DwrfEncryptionMetadata.java","lineNumber":167,"sourceCode":"        return toKeyMap(types, columnIndexMap);\n    }\n\n    public Map<Integer, Slice> toKeyMap(List<OrcType> types, Map<String, Integer> columnNamesToHiveIndex)\n    {\n        if (fieldToKeyData.containsKey(TABLE_IDENTIFIER)) {\n            return ImmutableMap.of(0, Slices.wrappedBuffer(fieldToKeyData.get(TABLE_IDENTIFIER)));\n        }\n\n        return fieldToKeyData.entrySet().stream()\n                .collect(toImmutableMap(entry -> toOrcColumnIndex(entry.getKey(), types, columnNamesToHiveIndex), entry -> Slices.wrappedBuffer(entry.getValue())));\n    }\n\n    private static int toOrcColumnIndex(String fieldString, List<OrcType> types, Map<String, Integer> columnNamesToHiveIndex)\n    {\n        ColumnEncryptionInformation.ColumnWithStructSubfield columnWithStructSubfield = ColumnEncryptionInformation.ColumnWithStructSubfield.valueOf(fieldString);\n\n        if (!columnNamesToHiveIndex.containsKey(columnWithStructSubfield.getColumnName())) {\n            throw new PrestoException(HIVE_INVALID_ENCRYPTION_METADATA, format(\"no column found for encryption field %s\", columnWithStructSubfield.getColumnName()));\n        }\n        int columnRoot = columnNamesToHiveIndex.get(columnWithStructSubfield.getColumnName());\n        return getOrcColumnIndexRecursive(types, types.get(0).getFieldTypeIndex(columnRoot), columnWithStructSubfield.getChildField());\n    }\n\n    private static int getOrcColumnIndexRecursive(List<OrcType> types, int typeId, Optional<ColumnEncryptionInformation.ColumnWithStructSubfield> subfield)\n    {\n        OrcType type = types.get(typeId);\n\n        int columnId = typeId;\n        if (subfield.isPresent()) {\n            verify(type.getOrcTypeKind() == STRUCT, \"subfield references are only permitted for struct types, but found %s for column %s\", subfield, columnId);\n            String name = subfield.get().getColumnName().toLowerCase(Locale.ENGLISH);\n            Optional<ColumnEncryptionInformation.ColumnWithStructSubfield> nextSubfield = subfield.get().getChildField();\n\n            int children = type.getFieldCount();\n            for (int i = 0; i < children; ++i) {\n                String fieldName = type.getFieldNames().get(i).toLowerCase(Locale.ENGLISH);","sourceCodeStart":149,"sourceCodeEnd":185,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-hive/src/main/java/com/facebook/presto/hive/DwrfEncryptionMetadata.java#L149-L185","documentation":"toOrcColumnIndex resolves an encryption field name (from DwrfEncryptionMetadata) to an ORC column index. It throws HIVE_INVALID_ENCRYPTION_METADATA when the column named in the encryption metadata does not exist in the Hive table's column-name-to-index mapping, meaning the encryption metadata refers to a column the table no longer (or never did) have.","triggerScenarios":"Reading a DWRF-encrypted table whose encryption metadata lists a column name absent from the current table schema — e.g. the column was dropped or renamed after encryption metadata was written, or the metadata key casing/format does not match the actual Hive column name.","commonSituations":"ALTER TABLE DROP/RENAME column on an encrypted table, hand-edited or corrupted serde properties, or reading a table with stale ColumnEncryptionInformation in metastore properties.","solutions":["Compare the column names in the table's encryption metadata (hive.encryption.metadata / ENCRYPT_COLUMNS properties) with the actual table schema and fix mismatches","Restore the dropped/renamed column or update the encryption metadata keys to match current column names","Regenerate encryption metadata by rewriting the table with correct column-level encryption properties","Verify column name case matches the Hive schema, since lookups are name-based"],"exampleFix":"// before: metadata references 'comments' but table has 'comment'\nENCRYPT_COLUMNS='comments'\n// after: match actual Hive column name\nENCRYPT_COLUMNS='comment'","handlingStrategy":"validation","validationCode":"Set<String> tableColumns = tableSchema.getColumns().stream()\n    .map(c -> c.getName().toLowerCase(Locale.ENGLISH))\n    .collect(Collectors.toSet());\nfor (String field : encryptionFields) {\n    String col = ColumnEncryptionInformation.ColumnWithStructSubfield.valueOf(field).getColumnName();\n    if (!tableColumns.contains(col.toLowerCase(Locale.ENGLISH))) {\n        throw new IllegalArgumentException(\"Encryption field not a table column: \" + col);\n    }\n}","typeGuard":"boolean columnExists(String field, Set<String> hiveColumns) {\n    return hiveColumns.contains(\n        ColumnEncryptionInformation.ColumnWithStructSubfield.valueOf(field).getColumnName().toLowerCase(Locale.ENGLISH));\n}","tryCatchPattern":"try {\n    readEncryptedTable(...);\n} catch (PrestoException e) {\n    if (\"HIVE_INVALID_ENCRYPTION_METADATA\".equals(e.getErrorCode().getName())) {\n        // refresh/rebuild encryption metadata against current schema\n    }\n    throw e;\n}","preventionTips":["Keep encryption metadata keys in sync with table schema changes (drop/rename)","Always lowercase column names in encryption metadata","After ALTER TABLE, regenerate column encryption properties"],"tags":["hive","dwrf","encryption","schema-mismatch"],"backgroundTag":"encryption-column-not-found","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}