{"record":{"id":"8a9d15ee817ed830","repo":"apache/cassandra","slug":"no-initialization-vector-iv-found-in-this-contex","errorCode":null,"errorMessage":"no initialization vector (IV) found in this context","messagePattern":"no initialization vector \\(IV\\) found in this context","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/security/EncryptionContext.java","lineNumber":103,"sourceCode":"        }\n\n        cipherFactory = factory;\n    }\n\n    public ICompressor getCompressor()\n    {\n        return compressor;\n    }\n\n    public Cipher getEncryptor() throws IOException\n    {\n        return cipherFactory.getEncryptor(tdeOptions.cipher, tdeOptions.key_alias);\n    }\n\n    public Cipher getDecryptor() throws IOException\n    {\n        if (iv == null || iv.length == 0)\n            throw new IllegalStateException(\"no initialization vector (IV) found in this context\");\n        return cipherFactory.getDecryptor(tdeOptions.cipher, tdeOptions.key_alias, iv);\n    }\n\n    public boolean isEnabled()\n    {\n        return tdeOptions.enabled;\n    }\n\n    public int getChunkLength()\n    {\n        return chunkLength;\n    }\n\n    public byte[] getIV()\n    {\n        return iv;\n    }\n","sourceCodeStart":85,"sourceCodeEnd":121,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/security/EncryptionContext.java#L85-L121","documentation":"EncryptionContext.getDecryptor() requires the random IV stored with the encrypted data. If the context has no IV (null or empty array) decryption cannot start, so it throws IllegalStateException. This is an internal-state check, not a config error.","triggerScenarios":"Calling getDecryptor() on an EncryptionContext constructed without IV bytes — e.g. context read from data that lacks the IV header, or programmatically built with iv == null/EMPTY.","commonSituations":"Corrupt or truncated encrypted commit log segment where the IV was never written/read, or misuse of the API by building a context only for encryption but attempting decryption with it.","solutions":["Ensure the EncryptionContext is created with IV bytes read from the segment header (EncryptionUtils/EncryptionContextSerializer).","Check for corruption/truncation of the encrypted segment's header; restore from backup if the file is damaged.","Only call getDecryptor() on contexts that came from deserializing a valid encrypted header."],"exampleFix":"// before\nEncryptionContext ctx = new EncryptionContext(options); // no IV\nCipher c = ctx.getDecryptor();\n// after\ntry (FileInputStream in = ...) {\n    EncryptionContext ctx = EncryptionContextSerializer.deserialize(options, DataInputBuffer, true);\n    Cipher c = ctx.getDecryptor();\n}","handlingStrategy":"type-guard","validationCode":"if (ctx.getIV() == null || ctx.getIV().length == 0)\n    throw new IllegalStateException(\"context has no IV; cannot decrypt\");","typeGuard":"boolean hasIv(EncryptionContext ctx) { byte[] iv = ctx.getIV(); return iv != null && iv.length > 0; }","tryCatchPattern":"if (!hasIv(ctx)) return null; // skip; only decrypt contexts deserialized from valid headers\ntry { Cipher c = ctx.getDecryptor(); } catch (IllegalStateException e) { /* missing IV: corrupt header */ }","preventionTips":["Only build decryptors from contexts deserialized via EncryptionContextSerializer","Validate segment headers before decrypting","Check file integrity when copying encrypted segments"],"tags":["encryption","iv","state"],"backgroundTag":"internal-invariant-violation","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}