{"record":{"id":"ad6b04940bf846dc","repo":"juicedata/juicefs","slug":"open-cipher-s","errorCode":null,"errorMessage":"open cipher: %s","messagePattern":"open cipher: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/meta/config.go","lineNumber":287,"sourceCode":"\tif err != nil {\n\t\treturn err\n\t}\n\tdecrypt := func(k *string) {\n\t\tif *k == \"\" {\n\t\t\treturn\n\t\t}\n\t\tif *k == \"removed\" {\n\t\t\terr = fmt.Errorf(\"secret was removed; please correct it with `config` command\")\n\t\t\treturn\n\t\t}\n\t\tbuf, e := base64.StdEncoding.DecodeString(*k)\n\t\tif e != nil {\n\t\t\terr = fmt.Errorf(\"decode key: %s\", e)\n\t\t\treturn\n\t\t}\n\t\tplaintext, e := ci.Open(nil, buf[:ci.NonceSize()], buf[ci.NonceSize():], nil)\n\t\tif e != nil {\n\t\t\terr = fmt.Errorf(\"open cipher: %s\", e)\n\t\t\treturn\n\t\t}\n\t\t*k = string(plaintext)\n\t}\n\n\tdecrypt(&f.EncryptKey)\n\tdecrypt(&f.SecretKey)\n\tdecrypt(&f.SessionToken)\n\tf.KeyEncrypted = false\n\treturn err\n}\n","sourceCodeStart":269,"sourceCodeEnd":299,"githubUrl":"https://github.com/juicedata/juicefs/blob/c9a67b23e8e08ec23ec331aa6f1675e2319e921c/pkg/meta/config.go#L269-L299","documentation":"Returned by Format.Decrypt() when AEAD Open fails after successful base64 decoding — i.e. the ciphertext failed authentication. The stored secret was encrypted with a different key (or corrupted), so GCM verification fails.","triggerScenarios":"Decrypting a secret that was encrypted with a different --encrypt-key than the one currently supplied, or a corrupted/truncated ciphertext blob (nonce/ciphertext split by ci.NonceSize() is intact but bytes are wrong).","commonSituations":"Changing the volume encryption key without re-encrypting stored secrets; pointing the client at the wrong metadata URL with the same key file; partial disk/metadata corruption.","solutions":["Supply the original --encrypt-key used when the volume was formatted (check the key file/history)","Re-set the secret with `juicefs config` using the correct key to re-encrypt it","If the ciphertext is corrupted, restore from a metadata backup"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := format.Decrypt(); err != nil { if strings.Contains(err.Error(), \"open cipher\") { /* wrong or changed encryption key: supply the original --encrypt-key */ } }","preventionTips":["Keep the volume's --encrypt-key immutable; rotate only via `juicefs config` re-encryption","Store keys in a managed secret store and mount the same key on every client","Keep metadata backups encrypted with the same key"],"tags":["crypto","gcm","decryption","key-mismatch"],"backgroundTag":"checksum-mismatch","analyzedSha":"c9a67b23e8e08ec23ec331aa6f1675e2319e921c","analyzedAt":"2026-09-06T17:55:48.476Z","contentChangedAt":"2026-09-06T17:55:48.476Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}