hashicorp/nomad · error

invalid algorithm %s

Error message

invalid algorithm %s

What it means

generateCipher only supports root keys whose Meta.Algorithm is a known value (e.g. EncryptionAlgorithmAES256GCM). An unrecognized algorithm string falls through the switch's default case and returns "invalid algorithm %s".

Source

Thrown at nomad/encrypter.go:675

	if rootKey == nil || rootKey.Meta == nil {
		return nil, fmt.Errorf("missing metadata")
	}
	var wrapper kms.Wrapper

	switch rootKey.Meta.Algorithm {
	case structs.EncryptionAlgorithmAES256GCM:
		wrapper = aead.NewWrapper()
		_, err := wrapper.SetConfig(context.Background(),
			aead.WithAeadType(kms.AeadTypeAesGcm),
			aead.WithHashType(kms.HashTypeSha256),
			aead.WithKey(rootKey.Key),
			kms.WithKeyId(rootKey.Meta.KeyID),
		)
		if err != nil {
			return nil, fmt.Errorf("could not configure cipher: %w", err)
		}
	default:
		return nil, fmt.Errorf("invalid algorithm %s", rootKey.Meta.Algorithm)
	}

	ed25519Key := ed25519.NewKeyFromSeed(rootKey.Key)

	cs := cipherSet{
		rootKey:         rootKey,
		wrapper:         wrapper,
		eddsaPrivateKey: ed25519Key,
	}

	// Unmarshal RSAKey for Workload Identity JWT signing if one exists. Prior to
	// 1.7 only the ed25519 key was used.
	if len(rootKey.RSAKey) > 0 {
		rsaKey, err := x509.ParsePKCS1PrivateKey(rootKey.RSAKey)
		if err != nil {
			return nil, fmt.Errorf("error parsing rsa key: %w", err)
		}

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Read the %s in the message and compare against supported structs.EncryptionAlgorithm* constants for your Nomad version
2. Upgrade all agents to a version that supports the algorithm in the key record
3. Rotate the key to one using a supported algorithm (e.g. aes256-gcm)
4. Never hand-edit Meta.Algorithm in state; use the keyring API

Example fix

// before
Meta: &structs.RootKeyMeta{Algorithm: "aes128-gcm"}  // unsupported
// after
Meta: &structs.RootKeyMeta{Algorithm: structs.EncryptionAlgorithmAES256GCM}

switch rootKey.Meta.Algorithm {
case structs.EncryptionAlgorithmAES256GCM:
    // ok
default:
    return fmt.Errorf("unsupported algorithm %q for this Nomad version", rootKey.Meta.Algorithm)
}

func supportedAlgorithm(a structs.EncryptionAlgorithm) bool { return a == structs.EncryptionAlgorithmAES256GCM }

if err != nil && strings.HasPrefix(err.Error(), "invalid algorithm") { /* upgrade agents or rotate key to aes256-gcm */ }

When it happens

Trigger: A root key record carries an Algorithm value not in the switch — e.g. data written by a newer Nomad version introducing a new algorithm, or a hand-edited/corrupted Meta.Algorithm.

Common situations: Cluster state restored from a newer Nomad into an older agent; manual edits to keyring records; typo'd algorithm when constructing keys programmatically.

Related errors

• unable to decrypt wrapped key
• failed to configure keyring: %v
• failed to get active nomad key: %w
• rotated key does not exist in keyring: %w
• %w (root key): %w

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/062cbd7ee29079f8. Report an issue: GitHub.