{"record":{"id":"e9fd1190a3d370c5","repo":"micro/go-micro","slug":"recepient-s-public-key-must-be-provided","errorCode":null,"errorMessage":"recepient's public key must be provided","messagePattern":"recepient's public key must be provided","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"config/secrets/box/box.go","lineNumber":59,"sourceCode":"\n// Options returns options.\nfunc (b *box) Options() secrets.Options {\n\treturn b.options\n}\n\n// String returns nacl-box.\nfunc (*box) String() string {\n\treturn \"nacl-box\"\n}\n\n// Encrypt encrypts a message with the sender's private key and the receipient's public key.\nfunc (b *box) Encrypt(in []byte, opts ...secrets.EncryptOption) ([]byte, error) {\n\tvar options secrets.EncryptOptions\n\tfor _, o := range opts {\n\t\to(&options)\n\t}\n\tif len(options.RecipientPublicKey) != keyLength {\n\t\treturn []byte{}, errors.New(\"recepient's public key must be provided\")\n\t}\n\tvar recipientPublicKey [keyLength]byte\n\tcopy(recipientPublicKey[:], options.RecipientPublicKey)\n\tvar nonce [24]byte\n\tif _, err := rand.Reader.Read(nonce[:]); err != nil {\n\t\treturn []byte{}, errors.Wrap(err, \"couldn't obtain a random nonce from crypto/rand\")\n\t}\n\treturn naclbox.Seal(nonce[:], in, &nonce, &recipientPublicKey, &b.privateKey), nil\n}\n\n// Decrypt Decrypts a message with the receiver's private key and the sender's public key.\nfunc (b *box) Decrypt(in []byte, opts ...secrets.DecryptOption) ([]byte, error) {\n\tvar options secrets.DecryptOptions\n\tfor _, o := range opts {\n\t\to(&options)\n\t}\n\tif len(options.SenderPublicKey) != keyLength {\n\t\treturn []byte{}, errors.New(\"sender's public key bust be provided\")","sourceCodeStart":41,"sourceCodeEnd":77,"githubUrl":"https://github.com/micro/go-micro/blob/24529f140421a11a33b6999ab7944f2021cfd69c/config/secrets/box/box.go#L41-L77","documentation":"The nacl/box secrets provider performs asymmetric encryption using the sender's private key (set at Init) and a recipient public key that must be supplied per-call via secrets.EncryptOption (WithRecipientPublicKey). Encrypt requires that key to be exactly 32 bytes (keyLength); if it is missing, empty, or the wrong length, it returns \"recepient's public key must be provided\" and no encryption happens.","triggerScenarios":"Calling secrets.Encrypt(data) without any EncryptOption, or with secrets.WithRecipientPublicKey(key) where len(key) != 32 — e.g. an empty slice, a base64 string's raw bytes of different length, or a truncated/hex-decoded-incorrectly key.","commonSituations":"Forgetting the recipient option in a code path that only configured the box's own keypair at Init; storing keys as hex/base64 strings and passing the wrong representation (wrong byte length); rotating keys and passing a peer's old or mis-copied key; mixing up Encrypt's recipient key with Init's public key.","solutions":["Pass secrets.WithRecipientPublicKey(peerKey) to Encrypt with the peer's raw 32-byte curve25519 public key.","Verify the key length before calling: len(key) == 32; decode base64/hex fully and check for truncation.","Make sure you're not confusing the Init-time keypair options with the per-call EncryptOption — Init's keys alone are not enough for Encrypt.","Share keys in a fixed encoding (e.g. base64) and decode with strict length validation at load time."],"exampleFix":"// before\nciphertext, err := boxSecrets.Encrypt(data) // missing recipient key\n// after\nif len(peerKey) != 32 {\n    return nil, fmt.Errorf(\"recipient key must be 32 bytes, got %d\", len(peerKey))\n}\nciphertext, err := boxSecrets.Encrypt(data, secrets.WithRecipientPublicKey(peerKey))","handlingStrategy":"validation","validationCode":"if len(peerPublicKey) != 32 {\n    return nil, fmt.Errorf(\"recipient public key must be 32 bytes, got %d\", len(peerPublicKey))\n}\nciphertext, err := secrets.Encrypt(data, secrets.WithRecipientPublicKey(peerPublicKey))","typeGuard":"func validRecipientKey(k []byte) bool { return len(k) == 32 }","tryCatchPattern":"ct, err := s.Encrypt(data, secrets.WithRecipientPublicKey(peerKey))\nif err != nil {\n    if strings.Contains(err.Error(), \"public key must be provided\") {\n        return nil, fmt.Errorf(\"encryption misconfigured: recipient key missing or wrong size\")\n    }\n    return nil, err\n}","preventionTips":["Always pass secrets.WithRecipientPublicKey with the peer's raw 32-byte key to Encrypt.","Decode keys from base64/hex once at startup and assert length 32.","Don't confuse Init-time keypair options with Encrypt's per-call recipient option.","Keep a key-encoding test that round-trips Encrypt/Decrypt between two peers."],"tags":["secrets","encryption","nacl-box","crypto","go","missing-key"],"backgroundTag":"missing-encryption-key","analyzedSha":"24529f140421a11a33b6999ab7944f2021cfd69c","analyzedAt":"2026-09-01T02:52:24.923Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}