cilium/cilium · error

failed to generate symmetric encryption key: %w

Error message

failed to generate symmetric encryption key: %w

What it means

When rotating a cipher-mode IPsec key (cipherMode != ""), rotate() also generates a fresh random hex cipher (symmetric encryption) key. This error wraps a generateRandomHex failure for that cipher key material.

Source

Thrown at cilium-cli/encrypt/ipsec_rotate_key.go:142

		cipherMode: parts[4],
		cipherKey:  parts[5],
	}
	return key, nil
}

const maxIPsecSPI = 16

func (k ipsecKey) rotate() (ipsecKey, error) {
	key, err := generateRandomHex(len(k.key))
	if err != nil {
		return ipsecKey{}, fmt.Errorf("failed to generate authentication key: %w", err)
	}

	cipherKey := ""
	if k.cipherMode != "" {
		cipherKey, err = generateRandomHex(len(k.cipherKey))
		if err != nil {
			return ipsecKey{}, fmt.Errorf("failed to generate symmetric encryption key: %w", err)
		}
	}

	newKey := ipsecKey{
		spi:        k.nextSPI(),
		algo:       k.algo,
		key:        key,
		size:       k.size,
		cipherMode: k.cipherMode,
		cipherKey:  cipherKey,
	}
	return newKey, nil
}

func (k ipsecKey) nextSPI() int {
	spi := k.spi + 1
	if spi >= maxIPsecSPI {
		spi = 1

View on GitHub (pinned to ac7b90affa)

Solutions

1. Retry the rotation after confirming the environment's randomness source works.
2. Inspect the cipher key field of the current key; regenerate the key entry if the cipher key material is empty or malformed.
3. Re-create the cilium-ipsec-keys secret with valid 6-field cipher keys and re-run rotation.

if k.cipherMode != "" && len(k.cipherKey) == 0 {
    return fmt.Errorf("cipherMode set but cipher key empty; fix key entry before rotating")
}

newKey, err := k.rotate()
if err != nil {
    if strings.Contains(err.Error(), "failed to generate symmetric encryption key") {
        time.Sleep(time.Second)
        newKey, err = k.rotate()
    }
    if err != nil { return err }
}

When it happens

Trigger: Same crypto/rand failure path as the auth key, but on the second call — generating the cipher key for keys using rfc4106(gcm(aes)) mode; also triggered if the parsed cipher key length is 0 due to a malformed source key.

Common situations: Entropy/rand source issues in the CLI's execution environment; cipher key field empty or truncated in the cilium-ipsec-keys secret so the rotation generates a zero-length key.

Related errors

• failed to generate authentication key: %w
• failed to rotate IPsec key: %w
• invalid IPsec key SPI: %s
• invalid IPsec key size: %s
• IPsec key invalid [expected parts: 6, actual parts: %d]

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/a3ddf1df4d9f6574. Report an issue: GitHub.