cakephp/cakephp · error · InvalidArgumentException

Invalid key for , key must be at least 256 bits (32 bytes)…

Error message

Invalid key for %s, key must be at least 256 bits (32 bytes) long.

What it means

Security::_checkKey() enforces that encryption keys are at least 32 bytes (256 bits), throwing InvalidArgumentException naming the method (encrypt()/decrypt()). Short keys cannot provide the required AES-256 key material.

Solutions

1. Generate a 32+ byte key, e.g. bin2hex(Security::randomBytes(32)) and use it
2. Ensure Security::getSalt() / configured application salt is at least 32 characters before calling encrypt/decrypt
3. Pass a raw binary key of >= 32 bytes rather than a passphrase
4. Update local/dev config placeholders to real long secrets

Example fix

// before
$cipher = Security::encrypt($data, 'secret');
// after
$key = bin2hex(Security::randomBytes(32)); // 64 chars = 256 bits
$cipher = Security::encrypt($data, $key);

if (mb_strlen($key, '8bit') < 32) {
    throw new InvalidArgumentException('Encryption key must be at least 32 bytes');
}

try {
    $cipher = Security::encrypt($data, $key);
} catch (\InvalidArgumentException $e) {
    // rotate/extend key or abort; never proceed with short keys
    throw new RuntimeException('Configured encryption key is too short', 0, $e);
}

When it happens

Trigger: Calling Security::encrypt($data, 'shortkey') or decrypt with a key string under 32 bytes; a Security.salt/secret value too short; key truncated by env var length or misconfigured constant.

Common situations: Developers passing a human-memorable password as key; migration from older CakePHP where shorter salts were tolerated; secrets placeholders like 'changeme' in local config; key read from config that was never generated properly.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• Cannot load/dump configuration files with .. in them.
• Length must be `int<1, max>`
• No compatible crypto engine available. Load the openssl…
• Salt not set. Use Security::setSalt() to set one, ideally…
• The data to decrypt cannot be empty.

AI-assisted analysis of cakephp/cakephp@1128eba9b0 (2026-09-12). Data as JSON: /api/errors/31cba6c8269b0bed. Report an issue: GitHub.

Appendix: source

Thrown at src/Utility/Security.php:228

        $crypto = static::engine();
        $ciphertext = $crypto->encrypt($plain, $encryptionKey);
        $hmac = hash_hmac('sha256', $ciphertext, $hmacKey);

        return $hmac . $ciphertext;
    }

    /**
     * Check the encryption key for proper length.
     *
     * @param string $key Key to check.
     * @param string $method The method the key is being checked for.
     * @return void
     * @throws \InvalidArgumentException When key length is not 256 bit/32 bytes
     */
    protected static function _checkKey(#[SensitiveParameter] string $key, string $method): void
    {
        if (mb_strlen($key, '8bit') < 32) {
            throw new InvalidArgumentException(
                sprintf('Invalid key for %s, key must be at least 256 bits (32 bytes) long.', $method),
            );
        }
    }

    /**
     * Generate a key pair of encryption and authentication tokens.
     *
     * Encapsulates the two key generation implementations we support.
     * The previous implementation has a keyspace reduction weakness.
     *
     * It is recommended to enable `Security.encryptWithRawKey` in new applications,
     * to take advantage of longer keys that are longer and have derived encryption
     * and authentication keys.
     *
     * @param string $key The bare key to use.
     * @param string $hmacSalt The hmac salt to use.
     * @return array{string, string} A list of $encryption, $authentication keys intended for encrypt() and decrypt().

View on GitHub (pinned to 1128eba9b0)