{"record":{"id":"b19c09a2fc63ce9a","repo":"phacility/phabricator","slug":"keyring-configuration-is-invalid-it-describes-a-k","errorCode":null,"errorMessage":"Keyring configuration is invalid: it describes a key with type \"%s\", but this type is unknown.","messagePattern":"Keyring configuration is invalid: it describes a key with type \"(.+?)\", but this type is unknown\\.","errorType":"validation","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"src/applications/files/keyring/PhabricatorKeyringConfigOptionType.php","lineNumber":93,"sourceCode":"          if ($material === false) {\n            throw new Exception(\n              pht(\n                'Keyring specifies an invalid key (\"%s\"): key material '.\n                'should be base64 encoded.',\n                $name));\n          }\n\n          if (strlen($material) != 32) {\n            throw new Exception(\n              pht(\n                'Keyring specifies an invalid key (\"%s\"): key material '.\n                'should be 32 bytes (256 bits) but has length %s.',\n                $name,\n                new PhutilNumber(strlen($material))));\n          }\n          break;\n        default:\n          throw new Exception(\n            pht(\n              'Keyring configuration is invalid: it describes a key with '.\n              'type \"%s\", but this type is unknown.',\n              $type));\n      }\n    }\n\n    if (count($defaults) > 1) {\n      throw new Exception(\n        pht(\n          'Keyring configuration is invalid: it describes multiple default '.\n          'encryption keys. No more than one key may be the default key. '.\n          'Keys currently configured as defaults: %s.',\n          implode(', ', $defaults)));\n    }\n  }\n\n}","sourceCodeStart":75,"sourceCodeEnd":111,"githubUrl":"https://github.com/phacility/phabricator/blob/5720a38cfe95b00ca4be5016dd0d2f3195f4fa04/src/applications/files/keyring/PhabricatorKeyringConfigOptionType.php#L75-L111","documentation":"The keyring validator switches on each entry's type field and currently only knows 'aes-256-cbc'; any other string is rejected as unknown. The type selects the validation and crypto implementation for the key, so a typo or an unsupported algorithm cannot be silently accepted.","triggerScenarios":"type set to 'aes-256' (dropped cipher mode), 'AES-256-CBC' (wrong case), 'aes-128-cbc', or a speculative future type; value copied from a different system's key config.","commonSituations":"Hand-writing the type from memory; adapting key config from another product with different algorithm names.","solutions":["Set type exactly to \"aes-256-cbc\" (lowercase, with mode suffix)","Remove entries for algorithms Phabricator does not implement rather than hoping they are ignored"],"exampleFix":"// before\n{\"name\": \"prod\", \"type\": \"aes-256\", \"material.base64\": \"...\"}\n\n// after\n{\"name\": \"prod\", \"type\": \"aes-256-cbc\", \"material.base64\": \"...\"}","handlingStrategy":"validation","validationCode":"$known_types = array('aes-256-cbc');\nif (!in_array($spec['type'], $known_types, true)) {\n  // Type \"{$spec['type']}\" is not supported; use aes-256-cbc.\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Copy the type string exactly: aes-256-cbc, lowercase, with the mode suffix","Do not carry algorithm identifiers over from other systems' key configs"],"tags":["config","keyring","validation","encryption","phabricator"],"backgroundTag":"config-validation-failed","analyzedSha":"5720a38cfe95b00ca4be5016dd0d2f3195f4fa04","analyzedAt":"2026-08-21T05:07:25.672Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}