{"record":{"id":"5e656fcb9e55947a","repo":"prestodb/presto","slug":"hive-invalid-encryption-metadata-5e656f","errorCode":"HIVE_INVALID_ENCRYPTION_METADATA","errorMessage":"Both %s and %s need to be set for DWRF encryption","messagePattern":"Both (.+?) and (.+?) need to be set for DWRF encryption","errorType":"error_code","errorClass":"PrestoException","httpStatus":null,"severity":"error","filePath":"presto-hive/src/main/java/com/facebook/presto/hive/DwrfTableEncryptionProperties.java","lineNumber":93,"sourceCode":"\n    public static DwrfTableEncryptionProperties forTable(String encryptTable, String encryptionAlgorithm, String encryptionProvider)\n    {\n        return new DwrfTableEncryptionProperties(Optional.of(encryptTable), Optional.empty(), encryptionAlgorithm, encryptionProvider);\n    }\n\n    public static DwrfTableEncryptionProperties forPerColumn(ColumnEncryptionInformation columnEncryptionInformation, String encryptionAlgorithm, String encryptionProvider)\n    {\n        return new DwrfTableEncryptionProperties(Optional.empty(), Optional.of(columnEncryptionInformation), encryptionAlgorithm, encryptionProvider);\n    }\n\n    public static Optional<DwrfTableEncryptionProperties> fromHiveTableProperties(Map<String, String> properties)\n    {\n        String encryptTable = properties.get(ENCRYPT_TABLE_KEY);\n        String encryptColumns = properties.get(ENCRYPT_COLUMNS_KEY);\n\n        if (encryptTable != null || encryptColumns != null) {\n            if (!properties.containsKey(DWRF_ENCRYPTION_ALGORITHM_KEY) || !properties.containsKey(DWRF_ENCRYPTION_PROVIDER_KEY)) {\n                throw new PrestoException(HIVE_INVALID_ENCRYPTION_METADATA, format(\"Both %s and %s need to be set for DWRF encryption\", DWRF_ENCRYPTION_ALGORITHM_KEY, DWRF_ENCRYPTION_PROVIDER_KEY));\n            }\n\n            if (encryptTable != null) {\n                return Optional.of(forTable(encryptTable, properties.get(DWRF_ENCRYPTION_ALGORITHM_KEY), properties.get(DWRF_ENCRYPTION_PROVIDER_KEY)));\n            }\n\n            return Optional.of(forPerColumn(\n                    fromHiveProperty(encryptColumns),\n                    properties.get(DWRF_ENCRYPTION_ALGORITHM_KEY),\n                    properties.get(DWRF_ENCRYPTION_PROVIDER_KEY)));\n        }\n\n        return Optional.empty();\n    }\n}\n","sourceCodeStart":75,"sourceCodeEnd":109,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-hive/src/main/java/com/facebook/presto/hive/DwrfTableEncryptionProperties.java#L75-L109","documentation":"DwrfTableEncryptionProperties.fromHiveTableProperties parses DWRF encryption settings from Hive table properties. If either ENCRYPT_TABLE or ENCRYPT_COLUMNS is present, both the encryption algorithm and encryption provider keys must also be set; otherwise it throws HIVE_INVALID_ENCRYPTION_METADATA, because encryption cannot be applied without knowing the algorithm and provider.","triggerScenarios":"Table properties contain ENCRYPT_TABLE_KEY or ENCRYPT_COLUMNS_KEY but are missing DWRF_ENCRYPTION_ALGORITHM_KEY and/or DWRF_ENCRYPTION_PROVIDER_KEY — typically from a table created/altered with incomplete encryption properties or manual metastore edits.","commonSituations":"Hand-editing Hive serde/table properties, partial migration from another engine, or a create-table script that sets encrypt columns but forgets the algorithm/provider properties.","solutions":["Add both missing properties to the table (e.g. dwrf.encryption.algorithm and dwrf.encryption.provider) via ALTER TABLE SET TBLPROPERTIES/SERDEPROPERTIES","Or remove the ENCRYPT_TABLE/ENCRYPT_COLUMNS properties if encryption was not intended","Recreate the table with complete encryption properties","Audit create-table DDL so encryption algorithm and provider are always supplied together with encrypt flags"],"exampleFix":"-- before\nCREATE TABLE t (...) WITH (encrypt_table='true');\n-- after\nCREATE TABLE t (...) WITH (\n  encrypt_table='true',\n  dwrf_encryption_algorithm='AES_GCM_CTR_V1',\n  dwrf_encryption_provider='HIVE');","handlingStrategy":"validation","validationCode":"Map<String, String> props = tableProperties;\nboolean encrypting = props.containsKey(\"encrypt_table\") || props.containsKey(\"encrypt_columns\");\nif (encrypting && (!props.containsKey(\"dwrf_encryption_algorithm\") || !props.containsKey(\"dwrf_encryption_provider\"))) {\n    throw new IllegalArgumentException(\"Set both dwrf_encryption_algorithm and dwrf_encryption_provider\");\n}","typeGuard":"boolean encryptionPropsComplete(Map<String, String> props) {\n    return !(props.containsKey(\"encrypt_table\") || props.containsKey(\"encrypt_columns\"))\n        || (props.containsKey(\"dwrf_encryption_algorithm\") && props.containsKey(\"dwrf_encryption_provider\"));\n}","tryCatchPattern":"try {\n    createTable(withEncryption(props));\n} catch (PrestoException e) {\n    if (\"HIVE_INVALID_ENCRYPTION_METADATA\".equals(e.getErrorCode().getName())) {\n        // surface which of the two keys is missing to the user\n    }\n    throw e;\n}","preventionTips":["Always set algorithm and provider together with encrypt_table/encrypt_columns","Template DDL with the full encryption property set","Validate table properties before CREATE/ALTER"],"tags":["hive","dwrf","encryption","table-properties"],"backgroundTag":"missing-encryption-properties","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}