phacility/phabricator · error · Exception

No AES256 key is specified in the keyring as a default encry

Error message

No AES256 key is specified in the keyring as a default encryption key, and no encryption key has been explicitly selected.

What it means

Thrown by PhabricatorFileAES256StorageFormat::getMasterKeyName() when the format needs an encryption key but none was explicitly selected (selectMasterKey() was never called on this instance) and PhabricatorKeyring::getDefaultKeyName() found no entry with "default": true. Phabricator refuses to guess which key to use for a write. In practice it means the 'keyring' config option is empty or lacks a default key at the moment an encrypted write or key-dependent operation happens.

Source

Thrown at src/applications/files/format/PhabricatorFileAES256StorageFormat.php:205

  public function selectMasterKey($key_name) {
    // Require that the key exist on the key ring.
    $this->getMasterKeyMaterial($key_name);

    $this->keyName = $key_name;
    return $this;
  }

  private function getMasterKeyName() {
    if ($this->keyName !== null) {
      return $this->keyName;
    }

    $default = PhabricatorKeyring::getDefaultKeyName(self::FORMATKEY);
    if ($default !== null) {
      return $default;
    }

    throw new Exception(
      pht(
        'No AES256 key is specified in the keyring as a default encryption '.
        'key, and no encryption key has been explicitly selected.'));
  }

  private function getMasterKeyMaterial($key_name) {
    return PhabricatorKeyring::getKey($key_name, self::FORMATKEY);
  }

}

View on GitHub (pinned to 5720a38cfe)

Solutions

1. Add a default key to the keyring: `./bin/config set keyring '[{"name":"prod-2024","type":"aes-256-cbc","material.base64":"<BASE64>","default":true}]'`
2. Or pass an explicit key for one-off operations: `./bin/files encode --as aes-256-cbc --key prod-2024 F123`
3. Generate correct material with: php -r 'echo base64_encode(random_bytes(32)), PHP_EOL;'
4. If encryption was not intended, switch files.default-format back to a plain format such as 'raw'

Example fix

# before
./bin/config set files.default-format aes-256-cbc   # no keyring configured -> writes throw

# after
./bin/config set keyring '[{"name":"prod-2024","type":"aes-256-cbc","material.base64":"$(php -r 'echo base64_encode(random_bytes(32));')","default":true}]'

// Before enabling the aes-256-cbc format for writes, confirm a default key exists:
$has_default = false;
foreach (PhabricatorEnv::getEnvConfig('keyring') as $spec) {
  if (idx($spec, 'default')) {
    $has_default = true;
    break;
  }
}
if (!$has_default) {
  // Do not switch files.default-format to aes-256-cbc yet; configure the keyring first.
}

When it happens

Trigger: Setting files.default-format (or otherwise selecting the aes-256-cbc format for new writes) while the keyring config has no "default": true entry; running `./bin/files encode --as aes-256-cbc` without --key when no default key exists; the 'keyring' config option not being set at all on that instance.

Common situations: Enabling at-rest encryption but configuring the format before adding any key; editing keyring JSON and dropping the default flag; staging/CI environments that share config except the keyring option.

Related errors

• No key "%s" exists in keyring.
• Keyring specifies an invalid key ("%s"): key material should
• Keyring configuration is invalid: it describes a key with ty
• Failed to openssl_decrypt() data: %s
• Keyring configuration is not valid: value must be a list of

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/e06abef19b653f27. Report an issue: GitHub.