{"record":{"id":"e8421abfa534f8f8","repo":"rustfs/rustfs","slug":"encryption-context-mismatch-message","errorCode":null,"errorMessage":"Encryption context mismatch: {message}","messagePattern":"Encryption context mismatch: (.+?)","errorType":"exception","errorClass":"KmsError::ContextMismatch","httpStatus":null,"severity":"error","filePath":"crates/kms/src/error.rs","lineNumber":91,"sourceCode":"\n    /// Cache error\n    #[error(\"Cache error: {message}\")]\n    CacheError { message: String },\n\n    /// Validation error\n    #[error(\"Validation error: {message}\")]\n    ValidationError { message: String },\n\n    /// Unsupported algorithm\n    #[error(\"Unsupported algorithm: {algorithm}\")]\n    UnsupportedAlgorithm { algorithm: String },\n\n    /// Invalid key size\n    #[error(\"Invalid key size: expected {expected}, got {actual}\")]\n    InvalidKeySize { expected: usize, actual: usize },\n\n    /// Encryption context mismatch\n    #[error(\"Encryption context mismatch: {message}\")]\n    ContextMismatch { message: String },\n\n    /// Backend operation exceeded its per-attempt timeout or total deadline\n    #[error(\"Operation timed out: {message}\")]\n    OperationTimedOut { message: String },\n\n    /// Backend operation aborted by cancellation or shutdown\n    #[error(\"Operation cancelled: {message}\")]\n    OperationCancelled { message: String },\n\n    // New variants must be appended below (never inserted above) so that\n    // concurrent additions rebase without conflicts.\n    /// Persisted key material is absent from an otherwise readable key record\n    #[error(\n        \"Key material missing for key {key_id}: the stored record has no key material; restore it from backup or repair the key explicitly\"\n    )]\n    MaterialMissing { key_id: String },\n","sourceCodeStart":73,"sourceCodeEnd":109,"githubUrl":"https://github.com/rustfs/rustfs/blob/35af688cd9d41b4346fbe27dcf7250ba72046c1f/crates/kms/src/error.rs#L73-L109","documentation":"The encryption context (AAD) supplied to a decrypt/unwrap operation does not match the context used at encrypt time. The AEAD association check or an explicit context comparison failed, meaning the ciphertext is being used with different metadata than it was created with.","triggerScenarios":"Thrown at crates/kms/src/error.rs:91 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Supply the exact same encryption context (key/value pairs) used when the data was encrypted","If object metadata changed, restore the original context before decrypting","Audit for tampering if the context was expected to match"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"35af688cd9d41b4346fbe27dcf7250ba72046c1f","analyzedAt":"2026-08-20T21:57:04.799Z","contentChangedAt":"2026-08-20T21:57:04.799Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}