{"record":{"id":"8618778c6f4a130a","repo":"duplicati/duplicati","slug":"refusing-to-encrypt-with-blacklisted-key","errorCode":null,"errorMessage":"Refusing to encrypt with blacklisted key","messagePattern":"Refusing to encrypt with blacklisted key","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"Duplicati/Library/Encryption/EncryptedFieldHelper.cs","lineNumber":163,"sourceCode":"        // if the hashes don't match, the lenght criteria can be ignored,\n        // and it will be returned as is.\n        return value;\n\n    }\n\n    /// <summary>\n    /// Encrypts a value to be stored in the database.\n    /// </summary>\n    /// <param name=\"value\"></param>\n    /// <param name=\"key\">The key to use for encryption</param>\n    /// <returns>The encrypted string</returns>\n    public static string Encrypt(string value, KeyInstance? key)\n    {\n        if (key == null)\n            throw new SettingsEncryptionKeyMissingException();\n\n        if (key.IsBlacklisted)\n            throw new InvalidOperationException(Strings.EncryptedFieldHelper.KeyBlacklistedError);\n\n        using var hasher = HashFactory.CreateHasher(HashFactory.SHA256);\n        var encrypted = AESStringEncryption.EncryptToHex(key.Key, value);\n\n        var sb = new StringBuilder();\n        sb.Append(HEADER_PREFIX);\n        sb.Append(encrypted.ComputeHashToHex(hasher));\n        sb.Append(key.Hash);\n        sb.Append(encrypted);\n\n        return sb.ToString();\n    }\n\n}","sourceCodeStart":145,"sourceCodeEnd":177,"githubUrl":"https://github.com/duplicati/duplicati/blob/3f348be3e33f5d72d414e3ad55839c2ba34dda67/Duplicati/Library/Encryption/EncryptedFieldHelper.cs#L145-L177","documentation":"Thrown by EncryptedFieldHelper.Encrypt when the supplied KeyInstance has IsBlacklisted == true. KeyInstance.CreateKey computes IsBlacklisted via IsKeyBlacklisted(key) at creation time, so this guards against re-encrypting data with a key known to be compromised or weak. The exception is InvalidOperationException with Strings.EncryptedFieldHelper.KeyBlacklistedError.","triggerScenarios":"Calling Encrypt(value, key) where key.IsBlacklisted is true (the key string matched the blacklist checked at CreateKey time).","commonSituations":"A previously-used key was added to the blacklist after a security incident; default/well-known weak keys are blacklisted by the application; attempting to write settings while still holding a reference to an old key instance.","solutions":["Rotate to a new, non-blacklisted key and obtain a fresh KeyInstance via CreateKey.","Re-encrypt existing data with the new key during a migration pass.","Remove the old key reference from any live objects after rotation so Encrypt is never called with it."],"exampleFix":"// before\nvar cipher = EncryptedFieldHelper.Encrypt(value, oldKey); // oldKey.IsBlacklisted == true\n\n// after\nvar newKey = EncryptedFieldHelper.KeyInstance.CreateKey(GenerateStrongKey());\nvar cipher = EncryptedFieldHelper.Encrypt(value, newKey);","handlingStrategy":"validation","validationCode":"if (key == null || key.IsBlacklisted)\n    key = EncryptedFieldHelper.KeyInstance.CreateKey(GenerateStrongKey()); // rotate\nvar cipher = EncryptedFieldHelper.Encrypt(value, key);","typeGuard":"bool IsUsableKey(EncryptedFieldHelper.KeyInstance k) => !k.IsBlacklisted;","tryCatchPattern":"try { cipher = EncryptedFieldHelper.Encrypt(value, key); }\ncatch (InvalidOperationException ex) when (ex.Message.Contains(\"blacklisted\"))\n{\n    logger.LogError(\"Refusing to use blacklisted key; rotate to a new key.\");\n    throw;\n}","preventionTips":["Drop references to blacklisted keys immediately after rotation.","Re-encrypt existing data with the replacement key during migration.","Treat a blacklisted key as write-disabled everywhere, not just in Encrypt."],"tags":["encryption","key","blacklist","key-rotation","security"],"backgroundTag":null,"analyzedSha":"3f348be3e33f5d72d414e3ad55839c2ba34dda67","analyzedAt":"2026-08-13T16:48:27.008Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}