{"record":{"id":"d82b87276633784c","repo":"micro/go-micro","slug":"sender-s-public-key-bust-be-provided","errorCode":null,"errorMessage":"sender's public key bust be provided","messagePattern":"sender's public key bust be provided","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"config/secrets/box/box.go","lineNumber":77,"sourceCode":"\t\treturn []byte{}, errors.New(\"recepient's public key must be provided\")\n\t}\n\tvar recipientPublicKey [keyLength]byte\n\tcopy(recipientPublicKey[:], options.RecipientPublicKey)\n\tvar nonce [24]byte\n\tif _, err := rand.Reader.Read(nonce[:]); err != nil {\n\t\treturn []byte{}, errors.Wrap(err, \"couldn't obtain a random nonce from crypto/rand\")\n\t}\n\treturn naclbox.Seal(nonce[:], in, &nonce, &recipientPublicKey, &b.privateKey), nil\n}\n\n// Decrypt Decrypts a message with the receiver's private key and the sender's public key.\nfunc (b *box) Decrypt(in []byte, opts ...secrets.DecryptOption) ([]byte, error) {\n\tvar options secrets.DecryptOptions\n\tfor _, o := range opts {\n\t\to(&options)\n\t}\n\tif len(options.SenderPublicKey) != keyLength {\n\t\treturn []byte{}, errors.New(\"sender's public key bust be provided\")\n\t}\n\tvar nonce [24]byte\n\tvar senderPublicKey [32]byte\n\tcopy(nonce[:], in[:24])\n\tcopy(senderPublicKey[:], options.SenderPublicKey)\n\tdecrypted, ok := naclbox.Open(nil, in[24:], &nonce, &senderPublicKey, &b.privateKey)\n\tif !ok {\n\t\treturn []byte{}, errors.New(\"incoming message couldn't be verified / decrypted\")\n\t}\n\treturn decrypted, nil\n}\n","sourceCodeStart":59,"sourceCodeEnd":89,"githubUrl":"https://github.com/micro/go-micro/blob/24529f140421a11a33b6999ab7944f2021cfd69c/config/secrets/box/box.go#L59-L89","documentation":"This error comes from the NaCl box crypto secret backend during Decrypt. NaCl box decryption requires the sender's public key (to derive the shared secret against the recipient's private key), and it must be exactly 32 bytes (keyLength). The library throws this when no sender public key was supplied via DecryptOption, or the supplied key has the wrong length.","triggerScenarios":"Calling box.Decrypt(data) without passing a secrets.DecryptOption that sets SenderPublicKey, or passing a SenderPublicKey slice that is empty or not exactly 32 bytes long.","commonSituations":"Forgetting to configure the sender's public key when sharing encrypted config values between services; encoding the sender key from a hex/base64 string and trimming it incorrectly; using a key from a different crypto scheme (e.g. a 44-byte or 65-byte key) that doesn't match NaCl box's 32-byte requirement.","solutions":["Pass a DecryptOption that sets SenderPublicKey to the peer's 32-byte public key, e.g. secrets.WithSenderPublicKey(pub) (use the exact option name from the secrets package).","Verify the key is exactly 32 bytes: len(pub) == 32; decode from hex/base64 with the correct function and check for errors before use.","Confirm you are using the same key pair that the sender encrypted with; box decryption fails even with keys of the right length if the pair is mismatched.","Ensure your DecryptOptions are actually applied — the variadic opts must be passed through to Decrypt, not dropped by an intermediate wrapper."],"exampleFix":"// before\ndecrypted, err := b.Decrypt(data)\n// after\npub, _ := hex.DecodeString(senderPubHex) // must yield 32 bytes\ndecrypted, err := b.Decrypt(data, secrets.WithSenderPublicKey(pub))","handlingStrategy":"validation","validationCode":"if len(senderPub) != 32 {\n    return fmt.Errorf(\"sender public key must be 32 bytes, got %d\", len(senderPub))\n}","typeGuard":"func validSenderKey(pub []byte) bool { return len(pub) == 32 }","tryCatchPattern":null,"preventionTips":["Store sender public keys as fixed [32]byte or validate length right after decoding","Always pass the DecryptOption explicitly in a small wrapper around box.Decrypt","Test encryption/decryption round-trips in CI with the real key pair"],"tags":["crypto","nacl-box","decryption","config"],"backgroundTag":"missing-decryption-key","analyzedSha":"24529f140421a11a33b6999ab7944f2021cfd69c","analyzedAt":"2026-09-01T02:52:24.923Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}