dapr/dapr · error

error generating nonce: %w

Error message

error generating nonce: %w

What it means

Sentry could not generate the random JWT ID (jti) claim. generateJwtID reads 16 bytes from crypto/rand.Reader and hex-encodes them; failure means the OS randomness source errored — the same entropy/RNG failure class as errors 702/705, but hit per-token instead of at startup.

Source

Thrown at pkg/sentry/server/ca/jwt/jwt.go:139

	}
	if i.signKey == nil {
		return "", errors.New("JWT signing key is not available")
	}

	// Create SPIFFE ID format string for the subject claim
	subject, err := spiffeid.FromSegments(req.TrustDomain, "ns", req.Namespace, req.AppID)
	if err != nil {
		return "", fmt.Errorf("error creating SPIFFE ID: %w", err)
	}

	now := time.Now()
	notBefore := now.Add(-i.allowedClockSkew) // Account for clock skew
	notAfter := now.Add(req.TTL)

	jti, err := generateJwtID()
	if err != nil {
		log.Errorf("Error generating nonce: %v", err)
		return "", fmt.Errorf("error generating nonce: %w", err)
	}

	// Create JWT token with claims builder
	builder := jwt.NewBuilder().
		JwtID(jti).
		Subject(subject.String()).
		IssuedAt(now).
		Audience(req.Audiences).
		NotBefore(notBefore).
		Claim("use", "sig"). // Needed for Azure
		Expiration(notAfter)

	// Set issuer only if configured
	if i.iss != nil {
		builder = builder.Issuer(*i.iss)
	}

	// Build the token

View on GitHub (pinned to 74ad417027)

Solutions

1. Treat as node health: move/reschedule the workload and check kernel RNG status
2. Verify container seccomp permits getrandom(2)
3. Retry the token request once — transient pool exhaustion can clear
4. Escalate to kernel/host diagnostics if failures cluster (dmesg, /proc/sys/kernel/random/entropy_avail)

token, err := issuer.Generate(ctx, req)
if err != nil && strings.Contains(err.Error(), "nonce") {
	time.Sleep(100 * time.Millisecond)
	token, err = issuer.Generate(ctx, req) // single retry
}

When it happens

Trigger: Every Generate call performs one rand.Read of 16 bytes; intermittent RNG failures on the host surface sporadically during token issuance rather than at boot.

Common situations: Entropy-starved nodes under load, sandboxed runtimes restricting getrandom, kernel RNG hardware faults; recurring in bursts if the node's CRNG is unhealthy.

Related errors

• error generating serial number: %w
• failed to generate Ed25519 key for X.509 certificates: %w
• failed to generate RSA key for JWT signing: %w
• failed to generate JWK thumbprint: %w
• failed to generate JWT bundle: %w

AI-assisted analysis of dapr/dapr@74ad417027 (2026-08-16). Data as JSON: /api/errors/1563030dd3a7e6b9. Report an issue: GitHub.