{"record":{"id":"7d3cfd09713e88ef","repo":"ory/kratos","slug":"you-must-provide-secrets-cipher-for-fips-complia","errorCode":null,"errorMessage":"you must provide `secrets.cipher` for FIPS compliance","messagePattern":"you must provide `secrets\\.cipher` for FIPS compliance","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"driver/config/config.go","lineNumber":438,"sourceCode":"\tp, err := configx.New(ctx, embedx.ConfigSchema, opts...)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tl.UseConfig(p)\n\n\tc = NewCustom(l, p, stdOutOrErr, ctxer)\n\n\tif !p.SkipValidation() {\n\t\tif err := c.validateIdentitySchemas(ctx); err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tif fips140.Enabled() {\n\t\t\tif len(p.Strings(ViperKeySecretsPagination)) == 0 {\n\t\t\t\treturn nil, errors.New(\"you must provide `secrets.pagination` for FIPS compliance\")\n\t\t\t}\n\t\t\tif len(p.Strings(ViperKeySecretsCipher)) == 0 {\n\t\t\t\treturn nil, errors.New(\"you must provide `secrets.cipher` for FIPS compliance\")\n\t\t\t}\n\t\t\tif len(p.Strings(ViperKeySecretsCookie)) == 0 {\n\t\t\t\treturn nil, errors.New(\"you must provide `secrets.cookie` for FIPS compliance\")\n\t\t\t}\n\t\t\tif len(p.Strings(ViperKeySecretsDefault)) == 0 {\n\t\t\t\treturn nil, errors.New(\"you must provide `secrets.default` for FIPS compliance\")\n\t\t\t}\n\t\t}\n\t}\n\n\treturn c, nil\n}\n\nfunc NewCustom(l *logrusx.Logger, p *configx.Provider, stdOutOrErr io.Writer, ctxt contextx.Contextualizer) *Config {\n\tl.UseConfig(p)\n\treturn &Config{l: l, p: p, c: ctxt, stdOutOrErr: stdOutOrErr}\n}\n","sourceCodeStart":420,"sourceCodeEnd":456,"githubUrl":"https://github.com/ory/kratos/blob/b86338da04a040247a07f46100a86dcfb3875909/driver/config/config.go#L420-L456","documentation":"In FIPS 140 mode, the config validator requires an explicit `secrets.cipher` value, used for encrypting sensitive data at rest. FIPS mode forbids silently generating/falling back to non-FIPS-derived cipher secrets, so an empty `secrets.cipher` fails validation.","triggerScenarios":"Server startup config validation with fips140.Enabled() true and no values under the `secrets.cipher` config key (env or file).","commonSituations":"Deploying to FIPS-required environments (government, regulated industries) without updating config; upgrading the Ory stack to a version that enforces FIPS secret requirements.","solutions":["Set `secrets.cipher` in config (typically a 32-byte/long random string) or its env equivalent","Generate with a FIPS-approved random source and store in your secret manager","Also set secrets.pagination, secrets.cookie, secrets.default which are checked in the same block","Confirm FIPS mode is intentional; if not, disable fips140 to restore default secret generation"],"exampleFix":"// before\nsecrets:\n  pagination: [\"...\"]\n// after\nsecrets:\n  pagination: [\"...\"]\n  cipher: [\"0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef\"]","handlingStrategy":"validation","validationCode":"if fipsEnabled && len(cfg.Secrets.Cipher) == 0 {\n  return errors.New(\"secrets.cipher is required in FIPS mode\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep pagination/cipher/cookie/default secrets defined together as one versioned secret bundle","Use a FIPS-approved RNG when generating secrets","Lint configs for required keys when fips140 is enabled"],"tags":["config","fips","security","encryption"],"backgroundTag":"missing-required-config-field","analyzedSha":"b86338da04a040247a07f46100a86dcfb3875909","analyzedAt":"2026-09-07T15:58:15.934Z","contentChangedAt":"2026-09-07T15:58:15.934Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}