juicedata/juicefs · error

new cipher: %s

Error message

new cipher: %s

What it means

Returned by newCipher in pkg/meta/config.go when aes.NewCipher fails on the MD5-hashed key in the default encryption branch. Since the key is always a fixed 16-byte MD5 sum, aes.NewCipher can essentially never fail; this wraps an unexpected crypto-internal error. It surfaces via Format.Encrypt/Decrypt during volume format load/save.

Source

Thrown at pkg/meta/config.go:223

}

func newCipher(algo string, key string) (cipher.AEAD, error) {
	switch algo {
	case object.SM4GCM:
		block, err := sm4.NewCipher(sm3.Kdf([]byte(key), 16))
		if err != nil {
			return nil, fmt.Errorf("new sm4 cipher: %s", err)
		}
		aead, err := cipher.NewGCM(block)
		if err != nil {
			return nil, fmt.Errorf("new sm4 GCM: %s", err)
		}
		return aead, nil
	default:
		hashKey := md5.Sum([]byte(key))
		block, err := aes.NewCipher(hashKey[:])
		if err != nil {
			return nil, fmt.Errorf("new cipher: %s", err)
		}
		aead, err := cipher.NewGCM(block)
		if err != nil {
			return nil, fmt.Errorf("new GCM: %s", err)
		}
		return aead, nil
	}
}

func (f *Format) Encrypt() error {
	if f.KeyEncrypted || f.SecretKey == "" && f.EncryptKey == "" && f.SessionToken == "" {
		return nil
	}
	ci, err := newCipher(f.EncryptAlgo, f.UUID)
	if err != nil {
		return err
	}
	encrypt := func(k *string) {

View on GitHub (pinned to c9a67b23e8)

Solutions

  1. Inspect the wrapped error text and verify the Go crypto/aes package is intact (rebuild with a stock toolchain)
  2. If key handling was customized, ensure the key passed to Encrypt/Decrypt is non-nil string input to md5.Sum
  3. Switch to a different EncryptAlgorithm via `juicefs config` to isolate the failure
Defensive patterns

Strategy: try-catch

Validate before calling

if f.EncryptAlgorithm == "" || f.EncryptAlgorithm == "aes256" { /* stock toolchain guarantees AES support */ }

Try / catch

if err := format.Decrypt(); err != nil { if strings.Contains(err.Error(), "new cipher") { /* rebuild with stock Go toolchain */ } }

Prevention

When it happens

Trigger: Format.Encrypt() or Format.Decrypt() on the default algorithm path where aes.NewCipher(md5hash) returns an error (only possible with a broken crypto backend).

Common situations: Practically unreachable; encountered only with non-standard Go crypto builds or heavily patched environments.

Related errors

AI-assisted analysis of juicedata/juicefs@c9a67b23e8 (2026-09-06). Data as JSON: /api/errors/4414348445e4885b. Report an issue: GitHub.