juicedata/juicefs · error

new sm4 GCM: %s

Error message

new sm4 GCM: %s

What it means

Returned by newCipher in pkg/meta/config.go when cipher.NewGCM fails for an SM4 block cipher while initializing the volume encryption AEAD. In practice NewGCM on a valid SM4 block never fails, so this is effectively an internal invariant error wrapping the underlying crypto error. It surfaces through Format.Encrypt/Decrypt when loading or saving an encrypted volume format.

Source

Thrown at pkg/meta/config.go:216

			err = fmt.Errorf("allowed maximum version: %s; please use an older client", f.MaxClientVersion)
		}
		if err != nil {
			return err
		}
	}
	return nil
}

func newCipher(algo string, key string) (cipher.AEAD, error) {
	switch algo {
	case object.SM4GCM:
		block, err := sm4.NewCipher(sm3.Kdf([]byte(key), 16))
		if err != nil {
			return nil, fmt.Errorf("new sm4 cipher: %s", err)
		}
		aead, err := cipher.NewGCM(block)
		if err != nil {
			return nil, fmt.Errorf("new sm4 GCM: %s", err)
		}
		return aead, nil
	default:
		hashKey := md5.Sum([]byte(key))
		block, err := aes.NewCipher(hashKey[:])
		if err != nil {
			return nil, fmt.Errorf("new cipher: %s", err)
		}
		aead, err := cipher.NewGCM(block)
		if err != nil {
			return nil, fmt.Errorf("new GCM: %s", err)
		}
		return aead, nil
	}
}

func (f *Format) Encrypt() error {
	if f.KeyEncrypted || f.SecretKey == "" && f.EncryptKey == "" && f.SessionToken == "" {

View on GitHub (pinned to c9a67b23e8)

Solutions

1. Verify the build includes a working SM4 provider (github.com/emmansun/gsm) and the binary was rebuilt, not a stale artifact
2. Switch EncryptAlgorithm to aes256 in the format via `juicefs config` if SM4 support is not required
3. Check the wrapped error message (%s) for the underlying crypto failure and fix accordingly

if f.EncryptAlgorithm == "sm4" { /* ensure build supports SM4; otherwise switch to aes256 */ }

if err := format.Encrypt(); err != nil { if strings.Contains(err.Error(), "new sm4 GCM") { /* rebuild with SM4 support or switch algorithm */ } }

When it happens

Trigger: Calling Format.Encrypt() or Format.Decrypt() with EncryptAlgorithm set to 'sm4' and cipher.NewGCM(block) returning a non-nil error (e.g. crypto build without SM4 support in a forked/sha3 provider).

Common situations: Using the sm4 encryption algorithm on a build/toolchain where the SM4 implementation is unavailable or broken; practically never seen with stock Go toolchains.

Related errors

• new sm4 cipher: %s
• new cipher: %s
• unsupport cipher: %s
• format decrypt: %s
• %w: please set the 'JFS_RSA_PASSPHRASE' environment variable

AI-assisted analysis of juicedata/juicefs@c9a67b23e8 (2026-09-06). Data as JSON: /api/errors/fd3ccb1696d466e5. Report an issue: GitHub.