{"record":{"id":"49e5ce3cf97780f3","repo":"docker/cli","slug":"could-not-decrypt-key","errorCode":null,"errorMessage":"could not decrypt key","messagePattern":"could not decrypt key","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/docker-trust/trust/key_load.go","lineNumber":113,"sourceCode":"\tif _, _, err = tufutils.ExtractPrivateKeyAttributes(privKeyBytes); err != nil {\n\t\treturn fmt.Errorf(\"provided file %s is not a supported private key - to add a signer's public key use docker trust signer add\", keyPath)\n\t}\n\tif privKeyBytes, err = decodePrivKeyIfNecessary(privKeyBytes, passRet); err != nil {\n\t\treturn fmt.Errorf(\"cannot load key from provided file %s: %w\", keyPath, err)\n\t}\n\t// Make a reader, rewind the file pointer\n\treturn trustmanager.ImportKeys(bytes.NewReader(privKeyBytes), privKeyImporters, keyName, \"\", passRet)\n}\n\nfunc decodePrivKeyIfNecessary(privPemBytes []byte, passRet notary.PassRetriever) ([]byte, error) {\n\tpemBlock, _ := pem.Decode(privPemBytes)\n\t_, containsDEKInfo := pemBlock.Headers[\"DEK-Info\"]\n\tif containsDEKInfo || pemBlock.Type == \"ENCRYPTED PRIVATE KEY\" {\n\t\t// if we do not have enough information to properly import, try to decrypt the key\n\t\tif _, ok := pemBlock.Headers[\"path\"]; !ok {\n\t\t\tprivKey, _, err := trustmanager.GetPasswdDecryptBytes(passRet, privPemBytes, \"\", \"encrypted\")\n\t\t\tif err != nil {\n\t\t\t\treturn []byte{}, errors.New(\"could not decrypt key\")\n\t\t\t}\n\t\t\tprivPemBytes = privKey.Private()\n\t\t}\n\t}\n\treturn privPemBytes, nil\n}\n","sourceCodeStart":95,"sourceCodeEnd":120,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cmd/docker-trust/trust/key_load.go#L95-L120","documentation":"Returned by decodePrivKeyIfNecessary when trustmanager.GetPasswdDecryptBytes fails to decrypt an encrypted private key (PEM with DEK-Info header or 'ENCRYPTED PRIVATE KEY' type). The passphrase retrieved interactively or from env vars did not match the key's encryption, so decryption failed.","triggerScenarios":"Running 'docker trust key load <file>' on a passphrase-protected key and entering the wrong passphrase, or having DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE set to the wrong value. Line 113 fires after GetPasswdDecryptBytes returns an error.","commonSituations":"Forgot the passphrase used when the key was created; env var passphrase mismatch after a key rotation; copy-paste error in the passphrase; key encrypted with a different tool's default passphrase.","solutions":["Re-run docker trust key load and enter the correct passphrase at the prompt.","Set DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE (or ROOT_PASSPHRASE for root keys) to the correct value.","If the passphrase is truly lost, regenerate a new key and re-add it to the repository's delegation roles."],"exampleFix":"# before: docker trust key load key.priv   # wrong passphrase\n# after:  DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE=correctpass docker trust key load key.priv","handlingStrategy":"retry","validationCode":"// Before loading, confirm the passphrase env var is set if the key is encrypted\nfunc ensurePassphraseEnv(blockType string) error {\n\tswitch blockType {\n\tcase \"ENCRYPTED PRIVATE KEY\":\n\t\tif os.Getenv(\"DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE\") == \"\" {\n\t\t\treturn errors.New(\"set DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE for this encrypted key\")\n\t\t}\n\t}\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":"// Allow a few passphrase attempts via the retriever loop; the PassRetriever\n// already supports numAttempts — surface a clear message on final failure.\nif errors.Is(err, /* decrypt error */) {\n    return fmt.Errorf(\"passphrase incorrect; re-run with the correct DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE: %w\", err)\n}","preventionTips":["Record the passphrase used when generating each key.","Set DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE / ROOT_PASSPHRASE env vars in CI.","If a passphrase is lost, rotate the key rather than guessing repeatedly."],"tags":["trust","notary","keys","encryption","passphrase"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}