{"record":{"id":"9ef0235d68a366c5","repo":"kopia/kopia","slug":"decrypt","errorCode":null,"errorMessage":"decrypt","messagePattern":"decrypt","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"repo/content/committed_read_manager.go","lineNumber":350,"sourceCode":"\t}\n\n\tt0 := timetrack.StartTimer()\n\n\tif err := c.Decompress(output, tmp.Bytes().Reader(), true); err != nil {\n\t\treturn errors.Wrap(err, \"error decompressing\")\n\t}\n\n\tsm.decompressedBytes.Observe(int64(tmp.Length()), t0.Elapsed())\n\n\treturn nil\n}\n\nfunc (sm *SharedManager) decryptAndVerify(encrypted gather.Bytes, iv []byte, output *gather.WriteBuffer) error {\n\tt0 := timetrack.StartTimer()\n\n\tif err := sm.format.Encryptor().Decrypt(encrypted, iv, output); err != nil {\n\t\tsm.Stats.foundInvalidContent()\n\t\treturn errors.Wrap(err, \"decrypt\")\n\t}\n\n\tsm.decryptedBytes.Observe(int64(encrypted.Length()), t0.Elapsed())\n\tsm.Stats.foundValidContent()\n\tsm.Stats.decrypted(output.Length())\n\n\t// already verified\n\treturn nil\n}\n\n// IndexBlobs returns the list of active index blobs.\nfunc (sm *SharedManager) IndexBlobs(ctx context.Context, includeInactive bool) ([]indexblob.Metadata, error) {\n\tif includeInactive {\n\t\tvar result []indexblob.Metadata\n\n\t\tfor _, prefix := range allIndexBlobPrefixes {\n\t\t\tblobs, err := blob.ListAllBlobs(ctx, sm.st, prefix)\n\t\t\tif err != nil {","sourceCodeStart":332,"sourceCodeEnd":368,"githubUrl":"https://github.com/kopia/kopia/blob/82495e54b584c1ef6073c9e1be048f57f8aef078/repo/content/committed_read_manager.go#L332-L368","documentation":"decryptAndVerify calls the format's Encryptor().Decrypt; any failure is wrapped as \"decrypt\" and counted as invalid content. Because Kopia uses authenticated encryption, a decrypt error almost always means the payload failed the integrity check (wrong bytes for that IV/content ID) rather than a key mismatch — genuine key mismatches surface earlier when connecting to the repository.","triggerScenarios":"attemptReadPackFileLocalIndex or decryptContentAndVerify reading a pack payload that is corrupted, belongs to a different offset, or was written with a different repository format/key.","commonSituations":"Bit rot on disk or object store; mixing blobs from different repositories; reading a pack blob that was overwritten or truncated; restored files missing their counterparts.","solutions":["Run kopia content verify --all to map out corrupted contents","Check and repair storage (S3 versioning, ZFS/Btrfs scrub, RAID rebuild)","Restore the damaged pack blobs from backups or cloud snapshots","Rebuild the index if entries point at wrong offsets"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := r.GetContent(ctx, contentID, out); err != nil {\n    if strings.Contains(err.Error(), \"decrypt: \") {\n        // AEAD verification failed: data corrupt or wrong index entry\n        reportCorruptContent(contentID, err)\n    }\n    return err\n}","preventionTips":["Protect storage against bit rot (ECC RAM, ZFS/btrfs, cloud checksums)","Rebuild the index if offsets are suspected wrong","Never merge blobs from different repositories","Verify restores with kopia restore --verify"],"tags":["kopia","encryption","data-corruption","integrity"],"backgroundTag":"checksum-mismatch","analyzedSha":"82495e54b584c1ef6073c9e1be048f57f8aef078","analyzedAt":"2026-09-07T20:35:21.689Z","contentChangedAt":"2026-09-07T20:35:21.689Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}