juicedata/juicefs · error

unsupport cipher: %s

Error message

unsupport cipher: %s

What it means

NewDataEncryptor selects the AEAD cipher for at-rest encryption by algorithm name. Only '', 'aes256gcm-rsa', 'chacha20-rsa' and 'sm4gcm' are supported; any other string is rejected with 'unsupport cipher: %s'.

Source

Thrown at pkg/object/encrypt.go:204

			}
			return cipher.NewGCM(block)
		}
		return &dataEncryptor{keyEncryptor, 32, aead}, nil
	case CHACHA20_RSA:
		return &dataEncryptor{keyEncryptor, chacha20poly1305.KeySize, chacha20poly1305.New}, nil
	case SM4GCM:
		// TODO: support other modes?
		// GCM not in [GB/T 17964-2021](http://c.gb688.cn/bzgk/gb/showGb?type=online&hcno=4F89D833626340B1F71068D25EAC737D)
		aead := func(key []byte) (cipher.AEAD, error) {
			block, err := sm4.NewCipher(key)
			if err != nil {
				return nil, err
			}
			return cipher.NewGCM(block)
		}
		return &dataEncryptor{keyEncryptor, 16, aead}, nil
	}
	return nil, fmt.Errorf("unsupport cipher: %s", algo)
}

func asn1TLVLen(contentLen int) int {
	return asn1HeaderLen(contentLen) + contentLen
}

func asn1HeaderLen(contentLen int) int {
	return 1 + asn1LenLen(contentLen)
}

func asn1LenLen(contentLen int) int {
	n := 1
	for v := contentLen; v > 255; v >>= 8 {
		n++
	}
	if contentLen < 128 {
		return 1
	}

View on GitHub (pinned to c9a67b23e8)

Solutions

1. Set the algorithm to one of: aes256gcm-rsa (default), chacha20-rsa, or sm4gcm
2. Check the option name/value for typos and case (values are lowercase)
3. Upgrade JuiceFS if the cipher you want (e.g. sm4gcm) is newer than your client build
4. Omit the option entirely to use the default aes256gcm-rsa

Example fix

// before
NewDataEncryptor(keyEnc, "aes256-gcm-rsa") // unsupport cipher: aes256-gcm-rsa
// after
NewDataEncryptor(keyEnc, "aes256gcm-rsa")

var supportedAlgos = map[string]bool{"": true, "aes256gcm-rsa": true, "chacha20-rsa": true, "sm4gcm": true}
if !supportedAlgos[algo] { return fmt.Errorf("algo %q not in {aes256gcm-rsa, chacha20-rsa, sm4gcm}", algo) }

enc, err := NewDataEncryptor(keyEnc, algo)
if err != nil { return fmt.Errorf("bad --encrypt-algo %q: %w", algo, err) }

When it happens

Trigger: Setting the object storage encrypt algorithm (--encrypt-algo in format/mount, or the algo passed to NewDataEncryptor via createStorage/open/wrapSyncEncryptedStore) to a value outside the supported enum.

Common situations: Typo in the algorithm name (e.g. 'aes256-gcm-rsa', 'chacha20poly1305', 'AES256GCM_RSA'); copying config from another product; using a cipher added in a newer JuiceFS release with an older client.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• new sm4 GCM: %s
• new cipher: %s
• format decrypt: %s
• %w: please set the 'JFS_RSA_PASSPHRASE' environment variable
• create %sor: %w

AI-assisted analysis of juicedata/juicefs@c9a67b23e8 (2026-09-06). Data as JSON: /api/errors/a3a4310fa5d55757. Report an issue: GitHub.