{"record":{"id":"eebfc90a43804e98","repo":"apache/druid","slug":"decryption-failed-check-service-logs","errorCode":null,"errorMessage":"Decryption failed. Check service logs.","messagePattern":"Decryption failed\\. Check service logs\\.","errorType":"http","errorClass":"InternalServerError","httpStatus":500,"severity":"error","filePath":"processing/src/main/java/org/apache/druid/crypto/CryptoService.java","lineNumber":150,"sourceCode":"  public byte[] decrypt(byte[] data)\n  {\n    try {\n      EncryptedData encryptedData = EncryptedData.fromByteArray(data);\n\n      SecretKey tmp = getKeyFromPassword(passPhrase, encryptedData.getSalt());\n      SecretKey secret = new SecretKeySpec(tmp.getEncoded(), cipherAlgName);\n\n      // error-prone warns if the transformation is not a compile-time constant\n      // since it cannot check it for insecure combinations.\n      @SuppressWarnings(\"InsecureCryptoUsage\")\n      Cipher dcipher = Cipher.getInstance(transformation);\n      dcipher.init(Cipher.DECRYPT_MODE, secret, new IvParameterSpec(encryptedData.getIv()));\n      return dcipher.doFinal(encryptedData.getCipher());\n    }\n    catch (Exception ex) {\n      log.noStackTrace().warn(ex, \"Decryption failed\");\n      throw InternalServerError.exception(\"Decryption failed. Check service logs.\");\n    }\n  }\n\n  private SecretKey getKeyFromPassword(char[] passPhrase, byte[] salt)\n      throws NoSuchAlgorithmException, InvalidKeySpecException\n  {\n    SecretKeyFactory factory = SecretKeyFactory.getInstance(secretKeyFactoryAlg);\n    KeySpec spec = new PBEKeySpec(passPhrase, salt, iterationCount, keyLength);\n    return factory.generateSecret(spec);\n  }\n\n  private static class EncryptedData\n  {\n    private final byte[] salt;\n    private final byte[] iv;\n    private final byte[] cipher;\n\n    public EncryptedData(byte[] salt, byte[] iv, byte[] cipher)\n    {","sourceCodeStart":132,"sourceCodeEnd":168,"githubUrl":"https://github.com/apache/druid/blob/9b90983fd291f26935af934383ce360473179e4d/processing/src/main/java/org/apache/druid/crypto/CryptoService.java#L132-L168","documentation":"CryptoService.decrypt wraps any cipher failure (bad IV, wrong key, corrupted ciphertext, doFinal failure) and rethrows InternalServerError with a generic message; the root cause is only in server logs. Typically indicates the data cannot be decrypted with the configured key.","triggerScenarios":"Calling CryptoService.decrypt on bytes that were not produced by this CryptoService's encrypt (different password/salt/config), truncated or corrupted EncryptedData payloads, or mismatched cipher parameters.","commonSituations":"Changing the encryption password/config after data was written at rest, copying encrypted segments between clusters with different crypto settings, hand-crafted or truncated byte arrays.","solutions":["Check service logs for the underlying BadPaddingException/AEADBadTagException etc.","Confirm the decrypt config (password, salt, algorithms) exactly matches the config used to encrypt the data","Re-encrypt the affected data with the current key or restore from a backup made under the same key config","Validate the input bytes are a well-formed EncryptedData payload before decrypting"],"exampleFix":"// before\nbyte[] plain = cryptoService.decrypt(storedBytes); // config changed since encryption\n// after\nif (!cryptoConfigMatches(encryptTimeConfig)) { reloadOldKeyConfig(); }\nbyte[] plain = cryptoService.decrypt(storedBytes);","handlingStrategy":"try-catch","validationCode":"// sanity-check payload is EncryptedData before decrypt\nif (data == null || data.length < 12) throw new IllegalArgumentException(\"not encrypted data\");","typeGuard":"boolean looksEncrypted(byte[] b) { return b != null && b.length > 16; }","tryCatchPattern":"try { return cryptoService.decrypt(data); } catch (InternalServerError ise) { logger.error(\"decrypt failed; key/config mismatch?\", ise); throw new CorruptDataException(ise); }","preventionTips":["Never change the encryption password/salt without re-encrypting data at rest","Version the crypto config alongside encrypted data","Detect BadPadding/AEAD tag failures early with a known-plaintext round-trip health check","Back up encrypted data together with the key configuration used"],"tags":["crypto","decryption","server"],"backgroundTag":"http-error-response","analyzedSha":"9b90983fd291f26935af934383ce360473179e4d","analyzedAt":"2026-09-07T13:32:30.957Z","contentChangedAt":"2026-09-07T13:32:30.957Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}