{"record":{"id":"e06abef19b653f27","repo":"phacility/phabricator","slug":"no-aes256-key-is-specified-in-the-keyring-as-a-def","errorCode":null,"errorMessage":"No AES256 key is specified in the keyring as a default encryption key, and no encryption key has been explicitly selected.","messagePattern":"No AES256 key is specified in the keyring as a default encryption key, and no encryption key has been explicitly selected\\.","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"src/applications/files/format/PhabricatorFileAES256StorageFormat.php","lineNumber":205,"sourceCode":"  public function selectMasterKey($key_name) {\n    // Require that the key exist on the key ring.\n    $this->getMasterKeyMaterial($key_name);\n\n    $this->keyName = $key_name;\n    return $this;\n  }\n\n  private function getMasterKeyName() {\n    if ($this->keyName !== null) {\n      return $this->keyName;\n    }\n\n    $default = PhabricatorKeyring::getDefaultKeyName(self::FORMATKEY);\n    if ($default !== null) {\n      return $default;\n    }\n\n    throw new Exception(\n      pht(\n        'No AES256 key is specified in the keyring as a default encryption '.\n        'key, and no encryption key has been explicitly selected.'));\n  }\n\n  private function getMasterKeyMaterial($key_name) {\n    return PhabricatorKeyring::getKey($key_name, self::FORMATKEY);\n  }\n\n}\n","sourceCodeStart":187,"sourceCodeEnd":216,"githubUrl":"https://github.com/phacility/phabricator/blob/5720a38cfe95b00ca4be5016dd0d2f3195f4fa04/src/applications/files/format/PhabricatorFileAES256StorageFormat.php#L187-L216","documentation":"Thrown by PhabricatorFileAES256StorageFormat::getMasterKeyName() when the format needs an encryption key but none was explicitly selected (selectMasterKey() was never called on this instance) and PhabricatorKeyring::getDefaultKeyName() found no entry with \"default\": true. Phabricator refuses to guess which key to use for a write. In practice it means the 'keyring' config option is empty or lacks a default key at the moment an encrypted write or key-dependent operation happens.","triggerScenarios":"Setting files.default-format (or otherwise selecting the aes-256-cbc format for new writes) while the keyring config has no \"default\": true entry; running `./bin/files encode --as aes-256-cbc` without --key when no default key exists; the 'keyring' config option not being set at all on that instance.","commonSituations":"Enabling at-rest encryption but configuring the format before adding any key; editing keyring JSON and dropping the default flag; staging/CI environments that share config except the keyring option.","solutions":["Add a default key to the keyring: `./bin/config set keyring '[{\"name\":\"prod-2024\",\"type\":\"aes-256-cbc\",\"material.base64\":\"<BASE64>\",\"default\":true}]'`","Or pass an explicit key for one-off operations: `./bin/files encode --as aes-256-cbc --key prod-2024 F123`","Generate correct material with: php -r 'echo base64_encode(random_bytes(32)), PHP_EOL;'","If encryption was not intended, switch files.default-format back to a plain format such as 'raw'"],"exampleFix":"# before\n./bin/config set files.default-format aes-256-cbc   # no keyring configured -> writes throw\n\n# after\n./bin/config set keyring '[{\"name\":\"prod-2024\",\"type\":\"aes-256-cbc\",\"material.base64\":\"$(php -r 'echo base64_encode(random_bytes(32));')\",\"default\":true}]'","handlingStrategy":"validation","validationCode":"// Before enabling the aes-256-cbc format for writes, confirm a default key exists:\n$has_default = false;\nforeach (PhabricatorEnv::getEnvConfig('keyring') as $spec) {\n  if (idx($spec, 'default')) {\n    $has_default = true;\n    break;\n  }\n}\nif (!$has_default) {\n  // Do not switch files.default-format to aes-256-cbc yet; configure the keyring first.\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Configure the keyring (with a \"default\": true key) before setting files.default-format to aes-256-cbc","Automate keyring provisioning in setup scripts so new environments cannot enable encryption without keys","Review keyring config changes with the same care as database credentials"],"tags":["encryption","keyring","config","files","phabricator"],"backgroundTag":"missing-encryption-key","analyzedSha":"5720a38cfe95b00ca4be5016dd0d2f3195f4fa04","analyzedAt":"2026-08-21T05:07:25.672Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}