What causes "failed to seal message" in nikivdev/code?

Retry the seal operation; the failure is not key-dependent (any valid keypair pair works).

failed to seal message

Error message

failed to seal message

What it means

seal performs an authenticated XSalsa20Poly1305 encryption of the message using a shared secret derived from the sender's private key and the recipient's public key (via x25519 Diffie-Hellman). The aead::encrypt call returning Err causes this error; with valid inputs encryption essentially never fails, so this usually indicates a cipher/state problem rather than a user-input issue.

Source

Thrown at src/sealer_crypto.rs:56

    ))
}

pub fn seal(
    message: &[u8],
    sender_secret: &str,
    recipient_id: &str,
    nonce_material: &[u8],
) -> Result<Vec<u8>> {
    let sender_secret = decode_secret(sender_secret)?;
    let recipient_public = decode_id(recipient_id)?;
    let sender_key = StaticSecret::from(sender_secret);
    let recipient_key = PublicKey::from(recipient_public);
    let shared_secret = sender_key.diffie_hellman(&recipient_key).to_bytes();
    let nonce = derive_nonce(nonce_material);
    let cipher = XSalsa20Poly1305::new(&shared_secret.into());
    let ciphertext = cipher
        .encrypt(&nonce.into(), message)
        .map_err(|_| anyhow::anyhow!("failed to seal message"))?;
    Ok(ciphertext)
}

pub fn unseal(
    sealed_message: &[u8],
    recipient_secret: &str,
    sender_id: &str,
    nonce_material: &[u8],
) -> Result<Vec<u8>> {
    let recipient_secret = decode_secret(recipient_secret)?;
    let sender_public = decode_id(sender_id)?;
    let recipient_key = StaticSecret::from(recipient_secret);
    let sender_key = PublicKey::from(sender_public);
    let shared_secret = recipient_key.diffie_hellman(&sender_key).to_bytes();
    let nonce = derive_nonce(nonce_material);
    let cipher = XSalsa20Poly1305::new(&shared_secret.into());
    let plaintext = cipher
        .decrypt(&nonce.into(), sealed_message)

View on GitHub (pinned to a747e741ae)

Solutions

Retry the seal operation; the failure is not key-dependent (any valid keypair pair works).
Check payload size and split or compress unusually large values before sealing.
Verify crypto dependency versions (crypto_secretbox, x25519_dalek) are consistent and rebuild.
Inspect the sender secret / recipient public key decode path — if keys fail to decode you would see earlier errors; if this fires alone, suspect the library environment.

Defensive patterns

Strategy: try-catch

Try / catch

match seal(sender_secret, recipient_id, nonce_material, &message) {
    Ok(ct) => ct,
    Err(e) if e.to_string().contains("failed to seal message") => {
        // non-input failure: retry once, then surface
        seal(sender_secret, recipient_id, nonce_material, &message)
            .context("sealing failed repeatedly; check payload size and crypto stack")?
    }
    Err(e) => return Err(e),
}

Prevention

Keep sealed payloads within reasonable size limits; compress or chunk very large values.
Pin and audit crypto crate versions (crypto_secretbox, x25519_dalek).
Validate secrets/ids with decode-side checks first so seal failures are never key-related.
Log payload metadata (not contents) on seal failure to aid diagnosis.

When it happens

Trigger: Calling seal (via seal_project_env_value or seal_private_key) where the XSalsa20Poly1305 encrypt operation fails — practically only when internal AEAD invariants break (e.g. oversized input per implementation limits or a corrupt key state).

Common situations: Rare in practice; may appear when sealing extremely large payloads beyond library limits, or as a symptom of a build/dependency mismatch in the crypto stack.

Related errors

AI-assisted analysis of nikivdev/code@a747e741ae (2026-09-01). Data as JSON: /api/errors/43166bc649ebd35e. Report an issue: GitHub.