{"record":{"id":"ad5c46e0601bed18","repo":"juicedata/juicefs","slug":"new-sm4-cipher-s","errorCode":null,"errorMessage":"new sm4 cipher: %s","messagePattern":"new sm4 cipher: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/meta/config.go","lineNumber":212,"sourceCode":"\tif f.MaxClientVersion != \"\" {\n\t\tmaxClientVer := version.Parse(f.MaxClientVersion)\n\t\tr, err := version.CompareVersions(ver, maxClientVer)\n\t\tif err == nil && r > 0 {\n\t\t\terr = fmt.Errorf(\"allowed maximum version: %s; please use an older client\", f.MaxClientVersion)\n\t\t}\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\treturn nil\n}\n\nfunc newCipher(algo string, key string) (cipher.AEAD, error) {\n\tswitch algo {\n\tcase object.SM4GCM:\n\t\tblock, err := sm4.NewCipher(sm3.Kdf([]byte(key), 16))\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"new sm4 cipher: %s\", err)\n\t\t}\n\t\taead, err := cipher.NewGCM(block)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"new sm4 GCM: %s\", err)\n\t\t}\n\t\treturn aead, nil\n\tdefault:\n\t\thashKey := md5.Sum([]byte(key))\n\t\tblock, err := aes.NewCipher(hashKey[:])\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"new cipher: %s\", err)\n\t\t}\n\t\taead, err := cipher.NewGCM(block)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"new GCM: %s\", err)\n\t\t}\n\t\treturn aead, nil\n\t}","sourceCodeStart":194,"sourceCodeEnd":230,"githubUrl":"https://github.com/juicedata/juicefs/blob/c9a67b23e8e08ec23ec331aa6f1675e2319e921c/pkg/meta/config.go#L194-L230","documentation":"newCipher wraps a failure from sm4.NewCipher when constructing the SM4 block cipher for format secret encryption/decryption. The SM4 key (derived via SM3 KDF from the configured key string) was rejected by the implementation, typically because the derived key length is invalid.","triggerScenarios":"Format.Encrypt()/Decrypt() call newCipher(object.SM4GCM, key) and sm4.NewCipher(sm3.Kdf([]byte(key), 16)) returns an error — malformed key material or an SM4 implementation/build constraint issue.","commonSituations":"Volume configured with cipher SM4-GCM but an empty or exotic-character encrypt key; key file corrupted; building with a toolchain/tags where the SM4 package misbehaves.","solutions":["Check the wrapped error (%s); regenerate the encryption key (e.g. openssl rand -hex 32) and retry","Confirm --cipher is really SM4-GCM and the key file is intact and non-empty","If using SM4 was unintentional, reconfigure with the default AES cipher and a valid key"],"exampleFix":"// before\n--encrypt-key \"\" --cipher sm4\n// after\nopenssl rand -hex 32 > /etc/juicefs.key\n--encrypt-key /etc/juicefs.key --cipher sm4","handlingStrategy":"validation","validationCode":"key, err := os.ReadFile(keyFile)\nif err != nil || len(bytes.TrimSpace(key)) == 0 {\n    return errors.New(\"empty encryption key for SM4\")\n}\n// verify cipher round-trips before use:\naead, err := newCipher(\"sm4-gcm\", string(key))\nif err != nil { return err }","typeGuard":null,"tryCatchPattern":"aead, err := newCipher(algo, key)\nif err != nil {\n    if strings.HasPrefix(err.Error(), \"new sm4 cipher\") {\n        // regenerate key or switch cipher\n    }\n    return err\n}","preventionTips":["Validate the encryption key non-empty and well-formed before configuring SM4","Round-trip encrypt/decrypt a test secret at format time","Keep key files with correct permissions and regular backups"],"tags":["encryption","sm4","cipher","config"],"backgroundTag":"invalid-encryption-key","analyzedSha":"c9a67b23e8e08ec23ec331aa6f1675e2319e921c","analyzedAt":"2026-09-06T17:55:48.476Z","contentChangedAt":"2026-09-06T17:55:48.476Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}