What causes "new sm4 cipher: %s" in juicedata/juicefs?

Check the wrapped error (%s); regenerate the encryption key (e.g. openssl rand -hex 32) and retry

new sm4 cipher: %s

Error message

new sm4 cipher: %s

What it means

newCipher wraps a failure from sm4.NewCipher when constructing the SM4 block cipher for format secret encryption/decryption. The SM4 key (derived via SM3 KDF from the configured key string) was rejected by the implementation, typically because the derived key length is invalid.

Source

Thrown at pkg/meta/config.go:212

	if f.MaxClientVersion != "" {
		maxClientVer := version.Parse(f.MaxClientVersion)
		r, err := version.CompareVersions(ver, maxClientVer)
		if err == nil && r > 0 {
			err = fmt.Errorf("allowed maximum version: %s; please use an older client", f.MaxClientVersion)
		}
		if err != nil {
			return err
		}
	}
	return nil
}

func newCipher(algo string, key string) (cipher.AEAD, error) {
	switch algo {
	case object.SM4GCM:
		block, err := sm4.NewCipher(sm3.Kdf([]byte(key), 16))
		if err != nil {
			return nil, fmt.Errorf("new sm4 cipher: %s", err)
		}
		aead, err := cipher.NewGCM(block)
		if err != nil {
			return nil, fmt.Errorf("new sm4 GCM: %s", err)
		}
		return aead, nil
	default:
		hashKey := md5.Sum([]byte(key))
		block, err := aes.NewCipher(hashKey[:])
		if err != nil {
			return nil, fmt.Errorf("new cipher: %s", err)
		}
		aead, err := cipher.NewGCM(block)
		if err != nil {
			return nil, fmt.Errorf("new GCM: %s", err)
		}
		return aead, nil
	}

View on GitHub (pinned to c9a67b23e8)

Solutions

Check the wrapped error (%s); regenerate the encryption key (e.g. openssl rand -hex 32) and retry
Confirm --cipher is really SM4-GCM and the key file is intact and non-empty
If using SM4 was unintentional, reconfigure with the default AES cipher and a valid key

Example fix

// before
--encrypt-key "" --cipher sm4
// after
openssl rand -hex 32 > /etc/juicefs.key
--encrypt-key /etc/juicefs.key --cipher sm4

Defensive patterns

Strategy: validation

Validate before calling

key, err := os.ReadFile(keyFile)
if err != nil || len(bytes.TrimSpace(key)) == 0 {
    return errors.New("empty encryption key for SM4")
}
// verify cipher round-trips before use:
aead, err := newCipher("sm4-gcm", string(key))
if err != nil { return err }

Try / catch

aead, err := newCipher(algo, key)
if err != nil {
    if strings.HasPrefix(err.Error(), "new sm4 cipher") {
        // regenerate key or switch cipher
    }
    return err
}

Prevention

Validate the encryption key non-empty and well-formed before configuring SM4
Round-trip encrypt/decrypt a test secret at format time
Keep key files with correct permissions and regular backups

When it happens

Trigger: Format.Encrypt()/Decrypt() call newCipher(object.SM4GCM, key) and sm4.NewCipher(sm3.Kdf([]byte(key), 16)) returns an error — malformed key material or an SM4 implementation/build constraint issue.

Common situations: Volume configured with cipher SM4-GCM but an empty or exotic-character encrypt key; key file corrupted; building with a toolchain/tags where the SM4 package misbehaves.

Related errors

AI-assisted analysis of juicedata/juicefs@c9a67b23e8 (2026-09-06). Data as JSON: /api/errors/ad5c46e0601bed18. Report an issue: GitHub.