hashicorp/nomad · error

could not configure cipher: %w

Error message

could not configure cipher: %w

What it means

The aead KMS wrapper's SetConfig (via options aead.WithAeadType/WithHashType/WithKey/WithKeyId) failed while configuring AES-GCM for the cipher set, wrapped as "could not configure cipher". This indicates the wrapper rejected the key material or options.

Source

Thrown at nomad/encrypter.go:672

func (e *Encrypter) generateCipher(rootKey *structs.UnwrappedRootKey) (*cipherSet, error) {

	if rootKey == nil || rootKey.Meta == nil {
		return nil, fmt.Errorf("missing metadata")
	}
	var wrapper kms.Wrapper

	switch rootKey.Meta.Algorithm {
	case structs.EncryptionAlgorithmAES256GCM:
		wrapper = aead.NewWrapper()
		_, err := wrapper.SetConfig(context.Background(),
			aead.WithAeadType(kms.AeadTypeAesGcm),
			aead.WithHashType(kms.HashTypeSha256),
			aead.WithKey(rootKey.Key),
			kms.WithKeyId(rootKey.Meta.KeyID),
		)
		if err != nil {
			return nil, fmt.Errorf("could not configure cipher: %w", err)
		}
	default:
		return nil, fmt.Errorf("invalid algorithm %s", rootKey.Meta.Algorithm)
	}

	ed25519Key := ed25519.NewKeyFromSeed(rootKey.Key)

	cs := cipherSet{
		rootKey:         rootKey,
		wrapper:         wrapper,
		eddsaPrivateKey: ed25519Key,
	}

	// Unmarshal RSAKey for Workload Identity JWT signing if one exists. Prior to
	// 1.7 only the ed25519 key was used.
	if len(rootKey.RSAKey) > 0 {
		rsaKey, err := x509.ParsePKCS1PrivateKey(rootKey.RSAKey)
		if err != nil {

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Check the wrapped SetConfig error for the exact option that failed (usually key length or key ID)
2. Ensure rootKey.Key is exactly 32 bytes for AES256GCM; rotate the key if it is malformed
3. Regenerate the key via nomad keyring API rather than hand-importing key bytes
4. Verify key records weren't truncated during snapshot export/import

Example fix

// before: manually imported 16-byte key into an AES256GCM root key record
// after: rotate to a properly generated key
nomad keygen / 'nomad operator keyring rotate'  # generates correct 32-byte AES-256 key

if len(rootKey.Key) != 32 { return fmt.Errorf("AES256GCM requires 32-byte key, got %d", len(rootKey.Key)) }
if rootKey.Meta.KeyID == "" { return errors.New("empty key ID") }

func aes256KeyValid(key []byte) bool { return len(key) == 32 }

if err != nil && strings.Contains(err.Error(), "could not configure cipher") { /* check key length/key ID, rotate key */ }

When it happens

Trigger: aead.NewWrapper().SetConfig(...) errors — most commonly because rootKey.Key is the wrong length for AES-256-GCM (must be 32 bytes) or KeyID is empty.

Common situations: Root key records with truncated/zeroed key bytes after a bad restore; hand-crafted keys in dev/test clusters; keys generated by an incompatible Nomad version.

Related errors

• unable to decrypt wrapped key
• could not encrypt: %w
• %w (root key): %w
• %w (rsa key): %w
• failed to encrypt root key: %w

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/162a10eec76173d9. Report an issue: GitHub.