{"record":{"id":"aec305ebb0709026","repo":"apereo/cas","slug":"secret-key-for-encryption-defined-under-is-ba","errorCode":null,"errorMessage":"Secret key for encryption defined under [{}] is Base64 encoded but the size does not match the key size [{}].","messagePattern":"Secret key for encryption defined under \\[(.+?)\\] is Base64 encoded but the size does not match the key size \\[(.+?)\\]\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"core/cas-server-core-util-api/src/main/java/org/apereo/cas/util/cipher/BaseBinaryCipherExecutor.java","lineNumber":186,"sourceCode":"                issueWarningToAddKeyToSettings(\"encryption\", encryptionKeySize, key, prop);\n                genEncryptionKey = EncodingUtils.decodeBase64(key);\n            } else {\n                val keyGenerator = FunctionUtils.doUnchecked(() -> KeyGenerator.getInstance(this.secretKeyAlgorithm));\n                keyGenerator.init(encryptionKeySize);\n                val secretKey = keyGenerator.generateKey();\n                genEncryptionKey = secretKey.getEncoded();\n                val encodedKey = EncodingUtils.encodeBase64(genEncryptionKey);\n                val prop = String.format(\"%s=%s\", getEncryptionKeySetting(), encodedKey);\n                issueWarningToAddKeyToSettings(\"encryption\", encryptionKeySize, encodedKey, prop);\n            }\n        } else if (encryptionKeySize <= MINIMUM_ENCRYPTION_KEY_LENGTH) {\n            val base64 = EncodingUtils.isBase64(encryptionSecretKey);\n            val key = base64 ? EncodingUtils.decodeBase64(encryptionSecretKey) : ArrayUtils.EMPTY_BYTE_ARRAY;\n            if (base64 && key.length == encryptionKeySize) {\n                LOGGER.trace(\"Secret key for encryption defined under [{}] is Base64 encoded.\", getEncryptionKeySetting());\n                genEncryptionKey = key;\n            } else if (encryptionSecretKey.length() != encryptionKeySize) {\n                LOGGER.warn(\"Secret key for encryption defined under [{}] is Base64 encoded but the size does not match the key size [{}].\",\n                    getEncryptionKeySetting(), encryptionKeySize);\n                genEncryptionKey = encryptionSecretKey.getBytes(StandardCharsets.UTF_8);\n            } else {\n                LOGGER.warn(\"Secret key for encryption defined under [{}] is not Base64 encoded. Clear the setting to regenerate (Recommended) or replace with\"\n                            + \" [{}].\", getEncryptionKeySetting(), EncodingUtils.encodeBase64(encryptionSecretKey));\n                genEncryptionKey = encryptionSecretKey.getBytes(StandardCharsets.UTF_8);\n            }\n        } else {\n            genEncryptionKey = EncodingUtils.decodeBase64(encryptionSecretKey);\n        }\n        this.encryptionSecretKey = genEncryptionKey;\n    }\n\n    private void ensureSigningKeyExists(final String signingSecretKey, final int signingKeySize) {\n        var signingKeyToUse = signingSecretKey;\n        if (StringUtils.isBlank(signingKeyToUse)) {\n            LOGGER.warn(\"Secret key for signing is not defined under [{}]. CAS will attempt to auto-generate the signing key\",\n                getSigningKeySetting());","sourceCodeStart":168,"sourceCodeEnd":204,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/core/cas-server-core-util-api/src/main/java/org/apereo/cas/util/cipher/BaseBinaryCipherExecutor.java#L168-L204","documentation":"Warning from BaseBinaryCipherExecutor.ensureEncryptionKeyExists when the configured encryption key IS Base64 encoded but its decoded byte length does not equal the required encryptionKeySize (e.g. 16/24/32 bytes for AES). CAS falls back to using the raw UTF-8 bytes of the configured string as the key, which may not match the expected algorithm key size.","triggerScenarios":"Setting a Base64-encoded encryption key whose decoded length differs from the configured key size — e.g. a 128-bit AES cipher executor given a key that decodes to 20 bytes, or key-size settings changed after the key was generated.","commonSituations":"Copying a truncated key into properties; mixing a key generated for 256-bit signing with a 128-bit encryption setting; changing cas.*.crypto.encryption.key-size after deployment without regenerating keys.","solutions":["Regenerate a Base64 key of the exact size required (decoded bytes == encryptionKeySize) and replace the configured value.","Verify with a quick decode: Base64.getDecoder().decode(key).length must equal the configured key size.","Align the encryption.key-size setting with the key you intend to keep, if the longer/shorter key is intentional.","Decode the key yourself and check length before setting it, e.g. with openssl rand -base64 16 for 128-bit."],"exampleFix":"// before\ncas.ticket.crypto.encryption.key=ZXh0cmFsb25na2V5dGhhdGRvZXNub3RtYXRjaA==\n// after: key whose decoded length is exactly 16 bytes for 128-bit\ncas.ticket.crypto.encryption.key=MTIzNDU2Nzg5MGFiY2RlZg==","handlingStrategy":"validation","validationCode":"byte[] decoded = java.util.Base64.getDecoder().decode(configuredKey);\nint required = casProperties.getTicket().getCrypto().getEncryption().getKeySize();\nif (decoded.length != required / 8) {\n    throw new IllegalStateException(\"Key decodes to \" + decoded.length + \" bytes; expected \" + required / 8);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Generate keys with the same tool and size settings you configure at runtime.","Never hand-truncate or edit generated keys.","Re-run keygen whenever you change cas.*.crypto.encryption.key-size.","Document key size in bytes vs bits to avoid confusion."],"tags":["encryption","key-size","base64"],"backgroundTag":"invalid-config-value","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}