{"record":{"id":"622d8f9224d8c96e","repo":"kubernetes/kubernetes","slug":"size-of-data-is-less-than-the-nonce","errorCode":null,"errorMessage":"size of data is less than the nonce","messagePattern":"size of data is less than the nonce","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kubeadm/app/util/crypto/crypto.go","lineNumber":67,"sourceCode":"\t\treturn nil, err\n\t}\n\treturn gcm.Seal(nonce, nonce, data, nil), nil\n}\n\n// DecryptBytes takes a byte slice of encrypted data and an encryption key and returns a decrypted byte slice of data.\n// The key must be an AES key, either 16, 24, or 32 bytes to select AES-128, AES-192, or AES-256\nfunc DecryptBytes(data, key []byte) ([]byte, error) {\n\tblock, err := aes.NewCipher(key)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tgcm, err := cipher.NewGCM(block)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tnonceSize := gcm.NonceSize()\n\tif len(data) < nonceSize {\n\t\treturn nil, errors.New(\"size of data is less than the nonce\")\n\t}\n\n\tnonce, out := data[:nonceSize], data[nonceSize:]\n\tout, err = gcm.Open(nil, nonce, out, nil)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\treturn out, nil\n}\n","sourceCodeStart":49,"sourceCodeEnd":77,"githubUrl":"https://github.com/kubernetes/kubernetes/blob/b882c60b4023bdf09264c2d5d30a2cadebc240fb/cmd/kubeadm/app/util/crypto/crypto.go#L49-L77","documentation":"Returned by DecryptBytes when len(data) < gcm.NonceSize(). The AES-GCM ciphertext produced by EncryptBytes is structured as nonce||ciphertext; if the input is shorter than the nonce prefix it cannot contain a valid nonce and is rejected before any decryption attempt.","triggerScenarios":"Calling crypto.DecryptBytes with truncated, empty, or corrupt ciphertext, or passing data that was not produced by EncryptBytes. Also reached if the wrong AES key size leads to a larger nonce expectation than the data provides.","commonSituations":"Corrupted/shortened encrypted secret blob (e.g. a copied key/cert fragment). Reading from a truncated file. Passing plaintext or a base64-decoded value that is too short. Mismatched key (16/24/32 bytes) yielding unexpected GCM nonce sizing.","solutions":["Ensure the data passed is the complete output of EncryptBytes (nonce + ciphertext), unmodified.","Verify the source file/blob is not truncated; re-copy or regenerate the encrypted payload.","Confirm the AES key length is 16, 24, or 32 bytes matching the encryption key used.","If the payload was base64-encoded, decode fully before calling DecryptBytes."],"exampleFix":"// before\nplain, err := crypto.DecryptBytes(partialBytes, key) // len < nonceSize\n\n// after\nfull, err := os.ReadFile(fullEncryptedPath)\nif err != nil { return err }\nplain, err := crypto.DecryptBytes(full, key)","handlingStrategy":"validation","validationCode":"// AES-GCM nonce is 12 bytes; ciphertext must exceed that.\nif len(data) < 12 {\n    return nil, fmt.Errorf(\"ciphertext too short (%d bytes); expected nonce||ciphertext from EncryptBytes\", len(data))\n}","typeGuard":null,"tryCatchPattern":"plain, err := crypto.DecryptBytes(data, key)\nif err != nil {\n    return fmt.Errorf(\"decryption failed (verify key length 16/24/32 and payload integrity): %w\", err)\n}","preventionTips":["Persist the full EncryptBytes output untouched (nonce prefix included).","Verify key length is 16/24/32 bytes matching encryption.","Base64-decode fully and confirm byte length before DecryptBytes."],"tags":["kubeadm","crypto","aes-gcm","decryption"],"analyzedSha":"b882c60b4023bdf09264c2d5d30a2cadebc240fb","analyzedAt":"2026-08-07T04:07:48.144Z","schemaVersion":2},"datasetVersion":"2026-08-07T07:17:06.508Z"}