getsops/sops · critical

Could not create GCM: %s

Error message

Could not create GCM: %s

What it means

After obtaining the IV, Encrypt constructs a GCM AEAD instance with cipher.NewGCMWithNonceSize using the 32-byte nonce size SOPS uses. If the AEAD cannot be constructed (key/cipher state invalid), this error wraps the stdlib message. Since the AES cipher was already validated, this failure is rare and typically indicates an incompatibility between the cipher object and GCM mode.

Source

Thrown at aes/cipher.go:161

		return "", nil
	}
	aescipher, err := cryptoaes.NewCipher(key)
	if err != nil {
		return "", fmt.Errorf("Could not initialize AES GCM encryption cipher: %s", err)
	}
	var iv []byte
	if stash, ok := c.stash[stashKey{plaintext: plaintext, additionalData: additionalData}]; !ok {
		iv = make([]byte, nonceSize)
		_, err = rand.Read(iv)
		if err != nil {
			return "", fmt.Errorf("Could not generate random bytes for IV: %s", err)
		}
	} else {
		iv = stash
	}
	gcm, err := cipher.NewGCMWithNonceSize(aescipher, nonceSize)
	if err != nil {
		return "", fmt.Errorf("Could not create GCM: %s", err)
	}
	var plainBytes []byte
	var encryptedType string
	switch value := plaintext.(type) {
	case string:
		encryptedType = "str"
		plainBytes = []byte(value)
	case int:
		encryptedType = "int"
		plainBytes = []byte(strconv.Itoa(value))
	case float64:
		encryptedType = "float"
		// The Python version encodes floats without padding 0s after the decimal point.
		plainBytes = []byte(strconv.FormatFloat(value, 'f', -1, 64))
	case bool:
		encryptedType = "bool"
		// The Python version encodes booleans with Titlecase
		if value {

View on GitHub (pinned to 13442bb981)

Solutions

1. Confirm the Go crypto/aes package supports GCM in your build (no FIPS GCM restriction).
2. Rebuild the binary against a standard Go toolchain without crypto overrides.
3. If it persists, log the underlying error and file an issue — this indicates a crypto library problem, not bad input.

ciphertext, err := cipher.Encrypt(v, key, ad)
if err != nil && strings.Contains(err.Error(), "Could not create GCM") {
    // crypto environment problem: fail fast, report to platform team
}

When it happens

Trigger: Calling Cipher.Encrypt when cipher.NewGCMWithNonceSize(aescipher, 32) fails — essentially only when the aescipher built from the key is invalid or the linked crypto library lacks GCM support (e.g. FIPS builds with GCM disabled).

Common situations: Go builds with GCMForbidden/FIPS restrictions; unusual crypto providers substituted via build tags; corrupted binary or mismatched stdlib version.

Related errors

• Could not initialize AES GCM encryption cipher: %s
• Could not generate random bytes for IV: %s
• Error marshaling timestamp %q: %w
• Value to encrypt has unsupported type %T
• Unknown datatype: %s

AI-assisted analysis of getsops/sops@13442bb981 (2026-09-01). Data as JSON: /api/errors/cbe53204467e0e28. Report an issue: GitHub.