{"record":{"id":"d508dcf4a9a2c68d","repo":"apache/druid","slug":"encryption-failed-check-service-logs","errorCode":null,"errorMessage":"Encryption failed. Check service logs.","messagePattern":"Encryption failed\\. Check service logs\\.","errorType":"http","errorClass":"InternalServerError","httpStatus":500,"severity":"error","filePath":"processing/src/main/java/org/apache/druid/crypto/CryptoService.java","lineNumber":129,"sourceCode":"\n      SecretKey tmp = getKeyFromPassword(passPhrase, salt);\n      SecretKey secret = new SecretKeySpec(tmp.getEncoded(), cipherAlgName);\n\n      // error-prone warns if the transformation is not a compile-time constant\n      // since it cannot check it for insecure combinations.\n      @SuppressWarnings(\"InsecureCryptoUsage\")\n      Cipher ecipher = Cipher.getInstance(transformation);\n      ecipher.init(Cipher.ENCRYPT_MODE, secret);\n      return new EncryptedData(\n          salt,\n          ecipher.getParameters().getParameterSpec(IvParameterSpec.class).getIV(),\n          ecipher.doFinal(plain)\n      ).toByteAray();\n    }\n    catch (Exception ex) {\n      log.noStackTrace().warn(ex, \"Encryption failed\");\n      throw InternalServerError.exception(\"Encryption failed. Check service logs.\");\n    }\n  }\n\n  public byte[] decrypt(byte[] data)\n  {\n    try {\n      EncryptedData encryptedData = EncryptedData.fromByteArray(data);\n\n      SecretKey tmp = getKeyFromPassword(passPhrase, encryptedData.getSalt());\n      SecretKey secret = new SecretKeySpec(tmp.getEncoded(), cipherAlgName);\n\n      // error-prone warns if the transformation is not a compile-time constant\n      // since it cannot check it for insecure combinations.\n      @SuppressWarnings(\"InsecureCryptoUsage\")\n      Cipher dcipher = Cipher.getInstance(transformation);\n      dcipher.init(Cipher.DECRYPT_MODE, secret, new IvParameterSpec(encryptedData.getIv()));\n      return dcipher.doFinal(encryptedData.getCipher());\n    }\n    catch (Exception ex) {","sourceCodeStart":111,"sourceCodeEnd":147,"githubUrl":"https://github.com/apache/druid/blob/9b90983fd291f26935af934383ce360473179e4d/processing/src/main/java/org/apache/druid/crypto/CryptoService.java#L111-L147","documentation":"CryptoService.encrypt wraps all exceptions from the cipher operation (ecipher.doFinal etc.) and rethrows an InternalServerError with a generic message; the underlying exception is only logged server-side. This hides key/cipher problems behind a blanket 500-style error.","triggerScenarios":"Calling CryptoService.encrypt when the cipher is misconfigured (bad algorithm/mode/padding), the SecretKey is invalid or uninitialized, or doFinal fails (bad key size, JCE provider restrictions, corrupted input state).","commonSituations":"Wrong password/secretKeyFactoryAlg config, missing JCE unlimited strength policy on old JDKs, algorithm name typos like 'PBKDF2WithHmacSHA256' misspellings, FIPS providers rejecting the configured transformation.","solutions":["Check service logs for the wrapped exception (logged at warn with details) to find the real cipher error","Verify crypto config: password/salt, keyFactory algorithm, cipher transformation and key size are valid and consistent with the JDK/provider","Test key derivation separately (getKeyFromPassword) to confirm the algorithm is available in the JVM","Ensure the same JCE provider/policies are installed on all nodes"],"exampleFix":"// before\nnew CryptoService(\"bad-alg\", ...) // throws at encrypt\n// after\nnew CryptoService(\"PBKDF2WithHmacSHA256\", \"AES/CBC/PKCS5Padding\", ...)","handlingStrategy":"try-catch","validationCode":"// verify cipher availability before encrypting\nCipher.getInstance(transformation); SecretKeyFactory.getInstance(keyFactoryAlg);","typeGuard":null,"tryCatchPattern":"try { byte[] ct = cryptoService.encrypt(plain); } catch (InternalServerError ise) { logger.error(\"encrypt failed; check CryptoService logs\", ise); throw new RetryableCryptoException(ise); }","preventionTips":["Pin and test the cipher/keyFactory algorithms on the target JVM at startup","Keep crypto config identical across all nodes and versioned","Watch logs for the wrapped warn-level cipher exceptions","Upgrade JDK/provider policies before enabling stronger algorithms"],"tags":["crypto","encryption","server"],"backgroundTag":"http-error-response","analyzedSha":"9b90983fd291f26935af934383ce360473179e4d","analyzedAt":"2026-09-07T13:32:30.957Z","contentChangedAt":"2026-09-07T13:32:30.957Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}