{"record":{"id":"a3a4310fa5d55757","repo":"juicedata/juicefs","slug":"unsupport-cipher-s","errorCode":null,"errorMessage":"unsupport cipher: %s","messagePattern":"unsupport cipher: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/object/encrypt.go","lineNumber":204,"sourceCode":"\t\t\t}\n\t\t\treturn cipher.NewGCM(block)\n\t\t}\n\t\treturn &dataEncryptor{keyEncryptor, 32, aead}, nil\n\tcase CHACHA20_RSA:\n\t\treturn &dataEncryptor{keyEncryptor, chacha20poly1305.KeySize, chacha20poly1305.New}, nil\n\tcase SM4GCM:\n\t\t// TODO: support other modes?\n\t\t// GCM not in [GB/T 17964-2021](http://c.gb688.cn/bzgk/gb/showGb?type=online&hcno=4F89D833626340B1F71068D25EAC737D)\n\t\taead := func(key []byte) (cipher.AEAD, error) {\n\t\t\tblock, err := sm4.NewCipher(key)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, err\n\t\t\t}\n\t\t\treturn cipher.NewGCM(block)\n\t\t}\n\t\treturn &dataEncryptor{keyEncryptor, 16, aead}, nil\n\t}\n\treturn nil, fmt.Errorf(\"unsupport cipher: %s\", algo)\n}\n\nfunc asn1TLVLen(contentLen int) int {\n\treturn asn1HeaderLen(contentLen) + contentLen\n}\n\nfunc asn1HeaderLen(contentLen int) int {\n\treturn 1 + asn1LenLen(contentLen)\n}\n\nfunc asn1LenLen(contentLen int) int {\n\tn := 1\n\tfor v := contentLen; v > 255; v >>= 8 {\n\t\tn++\n\t}\n\tif contentLen < 128 {\n\t\treturn 1\n\t}","sourceCodeStart":186,"sourceCodeEnd":222,"githubUrl":"https://github.com/juicedata/juicefs/blob/c9a67b23e8e08ec23ec331aa6f1675e2319e921c/pkg/object/encrypt.go#L186-L222","documentation":"NewDataEncryptor selects the AEAD cipher for at-rest encryption by algorithm name. Only '', 'aes256gcm-rsa', 'chacha20-rsa' and 'sm4gcm' are supported; any other string is rejected with 'unsupport cipher: %s'.","triggerScenarios":"Setting the object storage encrypt algorithm (--encrypt-algo in format/mount, or the algo passed to NewDataEncryptor via createStorage/open/wrapSyncEncryptedStore) to a value outside the supported enum.","commonSituations":"Typo in the algorithm name (e.g. 'aes256-gcm-rsa', 'chacha20poly1305', 'AES256GCM_RSA'); copying config from another product; using a cipher added in a newer JuiceFS release with an older client.","solutions":["Set the algorithm to one of: aes256gcm-rsa (default), chacha20-rsa, or sm4gcm","Check the option name/value for typos and case (values are lowercase)","Upgrade JuiceFS if the cipher you want (e.g. sm4gcm) is newer than your client build","Omit the option entirely to use the default aes256gcm-rsa"],"exampleFix":"// before\nNewDataEncryptor(keyEnc, \"aes256-gcm-rsa\") // unsupport cipher: aes256-gcm-rsa\n// after\nNewDataEncryptor(keyEnc, \"aes256gcm-rsa\")","handlingStrategy":"validation","validationCode":"var supportedAlgos = map[string]bool{\"\": true, \"aes256gcm-rsa\": true, \"chacha20-rsa\": true, \"sm4gcm\": true}\nif !supportedAlgos[algo] { return fmt.Errorf(\"algo %q not in {aes256gcm-rsa, chacha20-rsa, sm4gcm}\", algo) }","typeGuard":null,"tryCatchPattern":"enc, err := NewDataEncryptor(keyEnc, algo)\nif err != nil { return fmt.Errorf(\"bad --encrypt-algo %q: %w\", algo, err) }","preventionTips":["Keep algorithm values lowercase and copy them verbatim from docs, never by memory","Validate the algo string in config-loading code before reaching storage setup","Pin client versions so all nodes support the same algorithm set","Prefer omitting the option to get the default aes256gcm-rsa"],"tags":["crypto","config","invalid-enum-value","encryption"],"backgroundTag":"invalid-enum-value","analyzedSha":"c9a67b23e8e08ec23ec331aa6f1675e2319e921c","analyzedAt":"2026-09-06T17:55:48.476Z","contentChangedAt":"2026-09-06T17:55:48.476Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}