{"record":{"id":"a3ddf1df4d9f6574","repo":"cilium/cilium","slug":"failed-to-generate-symmetric-encryption-key-w","errorCode":null,"errorMessage":"failed to generate symmetric encryption key: %w","messagePattern":"failed to generate symmetric encryption key: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cilium-cli/encrypt/ipsec_rotate_key.go","lineNumber":142,"sourceCode":"\t\tcipherMode: parts[4],\n\t\tcipherKey:  parts[5],\n\t}\n\treturn key, nil\n}\n\nconst maxIPsecSPI = 16\n\nfunc (k ipsecKey) rotate() (ipsecKey, error) {\n\tkey, err := generateRandomHex(len(k.key))\n\tif err != nil {\n\t\treturn ipsecKey{}, fmt.Errorf(\"failed to generate authentication key: %w\", err)\n\t}\n\n\tcipherKey := \"\"\n\tif k.cipherMode != \"\" {\n\t\tcipherKey, err = generateRandomHex(len(k.cipherKey))\n\t\tif err != nil {\n\t\t\treturn ipsecKey{}, fmt.Errorf(\"failed to generate symmetric encryption key: %w\", err)\n\t\t}\n\t}\n\n\tnewKey := ipsecKey{\n\t\tspi:        k.nextSPI(),\n\t\talgo:       k.algo,\n\t\tkey:        key,\n\t\tsize:       k.size,\n\t\tcipherMode: k.cipherMode,\n\t\tcipherKey:  cipherKey,\n\t}\n\treturn newKey, nil\n}\n\nfunc (k ipsecKey) nextSPI() int {\n\tspi := k.spi + 1\n\tif spi >= maxIPsecSPI {\n\t\tspi = 1","sourceCodeStart":124,"sourceCodeEnd":160,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/cilium-cli/encrypt/ipsec_rotate_key.go#L124-L160","documentation":"When rotating a cipher-mode IPsec key (cipherMode != \"\"), rotate() also generates a fresh random hex cipher (symmetric encryption) key. This error wraps a generateRandomHex failure for that cipher key material.","triggerScenarios":"Same crypto/rand failure path as the auth key, but on the second call — generating the cipher key for keys using rfc4106(gcm(aes)) mode; also triggered if the parsed cipher key length is 0 due to a malformed source key.","commonSituations":"Entropy/rand source issues in the CLI's execution environment; cipher key field empty or truncated in the cilium-ipsec-keys secret so the rotation generates a zero-length key.","solutions":["Retry the rotation after confirming the environment's randomness source works.","Inspect the cipher key field of the current key; regenerate the key entry if the cipher key material is empty or malformed.","Re-create the cilium-ipsec-keys secret with valid 6-field cipher keys and re-run rotation."],"exampleFix":null,"handlingStrategy":"retry","validationCode":"if k.cipherMode != \"\" && len(k.cipherKey) == 0 {\n    return fmt.Errorf(\"cipherMode set but cipher key empty; fix key entry before rotating\")\n}","typeGuard":null,"tryCatchPattern":"newKey, err := k.rotate()\nif err != nil {\n    if strings.Contains(err.Error(), \"failed to generate symmetric encryption key\") {\n        time.Sleep(time.Second)\n        newKey, err = k.rotate()\n    }\n    if err != nil { return err }\n}","preventionTips":["Keep cipherMode and cipherKey fields consistent — both present for cipher keys","Retry on transient rand failures","Regenerate the secret if cipher key material is empty or truncated"],"tags":["cilium","ipsec","key-rotation","crypto"],"backgroundTag":"crypto-random-generation-failed","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}