dgraph-io/badger · error

ErrInvalidDataKeyID

ErrInvalidDataKeyID

Error message

Invalid datakey id

What it means

ErrInvalidDataKeyID is returned by KeyRegistry.DataKey when the requested data key ID is not present in the registry. It indicates the caller is asking for a key that was never stored or has been rotated out.

Source

Thrown at errors.go:104

	// ErrTruncateNeeded is returned when the value log gets corrupt, and requires truncation of
	// corrupt data to allow Badger to run properly.
	ErrTruncateNeeded = stderrors.New(
		"Log truncate required to run DB. This might result in data loss")

	// ErrBlockedWrites is returned if the user called DropAll. During the process of dropping all
	// data from Badger, we stop accepting new writes, by returning this error.
	ErrBlockedWrites = stderrors.New("Writes are blocked, possibly due to DropAll or Close")

	// ErrNilCallback is returned when subscriber's callback is nil.
	ErrNilCallback = stderrors.New("Callback cannot be nil")

	// ErrEncryptionKeyMismatch is returned when the storage key is not
	// matched with the key previously given.
	ErrEncryptionKeyMismatch = stderrors.New("Encryption key mismatch")

	// ErrInvalidDataKeyID is returned if the datakey id is invalid.
	ErrInvalidDataKeyID = stderrors.New("Invalid datakey id")

	// ErrInvalidEncryptionKey is returned if length of encryption keys is invalid.
	ErrInvalidEncryptionKey = stderrors.New("Encryption key's length should be" +
		"either 16, 24, or 32 bytes")
	// ErrGCInMemoryMode is returned when db.RunValueLogGC is called in in-memory mode.
	ErrGCInMemoryMode = stderrors.New("Cannot run value log GC when DB is opened in InMemory mode")

	// ErrGCInReadOnlyMode is returned when db.RunValueLogGC is called in read-only mode.
	ErrGCInReadOnlyMode = stderrors.New("Cannot run value log GC when DB is opened in ReadOnly mode")

	// ErrDBClosed is returned when a get operation is performed after closing the DB.
	ErrDBClosed = stderrors.New("DB Closed")
)

View on GitHub (pinned to 2a001d466f)

Solutions

1. Use the key ID stored alongside the ciphertext and verify the registry actually contains it
2. Retain old data keys in the registry as long as data encrypted with them exists
3. Regenerate the registry with the correct key set or restore the registry file from backup
4. If data is unreadable without the missing key, restore from encrypted backups made before rotation

Example fix

// before
dk, err := registry.DataKey(staleID) // ErrInvalidDataKeyID
// after
id := keyIDFromData(header)
dk, err := registry.DataKey(id)
if err != nil {
    return fmt.Errorf("missing data key %d: %w", id, err)
}

func hasDataKey(kr *keyregistry.KeyRegistry, id uint64) bool {
    _, err := kr.DataKey(id)
    return err == nil
}

dk, err := kr.DataKey(id)
if errors.Is(err, badger.ErrInvalidDataKeyID) {
    return fmt.Errorf("data key %d missing from registry; key was rotated out or wrong registry: %w", id, err)
}

When it happens

Trigger: Calling kr.DataKey(id) with an id that has no entry in kr.dataKeys; reading encrypted data whose stored key ID refers to a key removed by rotation or absent from the registry file.

Common situations: Decrypting old data after aggressive key rotation that pruned old keys; pointing a DB at a key registry file from a different database; corrupted or truncated registry storage.

Related errors

• ErrEncryptionKeyMismatch
• ErrInvalidEncryptionKey
• ErrValueLogSize
• ErrKeyNotFound
• ErrTxnTooBig

AI-assisted analysis of dgraph-io/badger@2a001d466f (2026-09-05). Data as JSON: /api/errors/aa74304fad532653. Report an issue: GitHub.