juicedata/juicefs · error

open cipher: %s

Error message

open cipher: %s

What it means

Returned by Format.Decrypt() when AEAD Open fails after successful base64 decoding — i.e. the ciphertext failed authentication. The stored secret was encrypted with a different key (or corrupted), so GCM verification fails.

Source

Thrown at pkg/meta/config.go:287

	if err != nil {
		return err
	}
	decrypt := func(k *string) {
		if *k == "" {
			return
		}
		if *k == "removed" {
			err = fmt.Errorf("secret was removed; please correct it with `config` command")
			return
		}
		buf, e := base64.StdEncoding.DecodeString(*k)
		if e != nil {
			err = fmt.Errorf("decode key: %s", e)
			return
		}
		plaintext, e := ci.Open(nil, buf[:ci.NonceSize()], buf[ci.NonceSize():], nil)
		if e != nil {
			err = fmt.Errorf("open cipher: %s", e)
			return
		}
		*k = string(plaintext)
	}

	decrypt(&f.EncryptKey)
	decrypt(&f.SecretKey)
	decrypt(&f.SessionToken)
	f.KeyEncrypted = false
	return err
}

View on GitHub (pinned to c9a67b23e8)

Solutions

  1. Supply the original --encrypt-key used when the volume was formatted (check the key file/history)
  2. Re-set the secret with `juicefs config` using the correct key to re-encrypt it
  3. If the ciphertext is corrupted, restore from a metadata backup
Defensive patterns

Strategy: try-catch

Try / catch

if err := format.Decrypt(); err != nil { if strings.Contains(err.Error(), "open cipher") { /* wrong or changed encryption key: supply the original --encrypt-key */ } }

Prevention

When it happens

Trigger: Decrypting a secret that was encrypted with a different --encrypt-key than the one currently supplied, or a corrupted/truncated ciphertext blob (nonce/ciphertext split by ci.NonceSize() is intact but bytes are wrong).

Common situations: Changing the volume encryption key without re-encrypting stored secrets; pointing the client at the wrong metadata URL with the same key file; partial disk/metadata corruption.

Understand the failure class

Background: Checksum mismatch errors: "checksum verification failed", "digest mismatch", "expected vs actual checksum" — what they mean and how to fix them — this error's family across 41 libraries.

Related errors

AI-assisted analysis of juicedata/juicefs@c9a67b23e8 (2026-09-06). Data as JSON: /api/errors/ad6b04940bf846dc. Report an issue: GitHub.