prestodb/presto · error · PrestoException

HIVE_INVALID_ENCRYPTION_METADATA

HIVE_INVALID_ENCRYPTION_METADATA

Error message

Both %s and %s need to be set for DWRF encryption

What it means

DwrfTableEncryptionProperties.fromHiveTableProperties parses DWRF encryption settings from Hive table properties. If either ENCRYPT_TABLE or ENCRYPT_COLUMNS is present, both the encryption algorithm and encryption provider keys must also be set; otherwise it throws HIVE_INVALID_ENCRYPTION_METADATA, because encryption cannot be applied without knowing the algorithm and provider.

Source

Thrown at presto-hive/src/main/java/com/facebook/presto/hive/DwrfTableEncryptionProperties.java:93

    public static DwrfTableEncryptionProperties forTable(String encryptTable, String encryptionAlgorithm, String encryptionProvider)
    {
        return new DwrfTableEncryptionProperties(Optional.of(encryptTable), Optional.empty(), encryptionAlgorithm, encryptionProvider);
    }

    public static DwrfTableEncryptionProperties forPerColumn(ColumnEncryptionInformation columnEncryptionInformation, String encryptionAlgorithm, String encryptionProvider)
    {
        return new DwrfTableEncryptionProperties(Optional.empty(), Optional.of(columnEncryptionInformation), encryptionAlgorithm, encryptionProvider);
    }

    public static Optional<DwrfTableEncryptionProperties> fromHiveTableProperties(Map<String, String> properties)
    {
        String encryptTable = properties.get(ENCRYPT_TABLE_KEY);
        String encryptColumns = properties.get(ENCRYPT_COLUMNS_KEY);

        if (encryptTable != null || encryptColumns != null) {
            if (!properties.containsKey(DWRF_ENCRYPTION_ALGORITHM_KEY) || !properties.containsKey(DWRF_ENCRYPTION_PROVIDER_KEY)) {
                throw new PrestoException(HIVE_INVALID_ENCRYPTION_METADATA, format("Both %s and %s need to be set for DWRF encryption", DWRF_ENCRYPTION_ALGORITHM_KEY, DWRF_ENCRYPTION_PROVIDER_KEY));
            }

            if (encryptTable != null) {
                return Optional.of(forTable(encryptTable, properties.get(DWRF_ENCRYPTION_ALGORITHM_KEY), properties.get(DWRF_ENCRYPTION_PROVIDER_KEY)));
            }

            return Optional.of(forPerColumn(
                    fromHiveProperty(encryptColumns),
                    properties.get(DWRF_ENCRYPTION_ALGORITHM_KEY),
                    properties.get(DWRF_ENCRYPTION_PROVIDER_KEY)));
        }

        return Optional.empty();
    }
}

View on GitHub (pinned to 55bb57d202)

Solutions

1. Add both missing properties to the table (e.g. dwrf.encryption.algorithm and dwrf.encryption.provider) via ALTER TABLE SET TBLPROPERTIES/SERDEPROPERTIES
2. Or remove the ENCRYPT_TABLE/ENCRYPT_COLUMNS properties if encryption was not intended
3. Recreate the table with complete encryption properties
4. Audit create-table DDL so encryption algorithm and provider are always supplied together with encrypt flags

Example fix

-- before
CREATE TABLE t (...) WITH (encrypt_table='true');
-- after
CREATE TABLE t (...) WITH (
  encrypt_table='true',
  dwrf_encryption_algorithm='AES_GCM_CTR_V1',
  dwrf_encryption_provider='HIVE');

Map<String, String> props = tableProperties;
boolean encrypting = props.containsKey("encrypt_table") || props.containsKey("encrypt_columns");
if (encrypting && (!props.containsKey("dwrf_encryption_algorithm") || !props.containsKey("dwrf_encryption_provider"))) {
    throw new IllegalArgumentException("Set both dwrf_encryption_algorithm and dwrf_encryption_provider");
}

boolean encryptionPropsComplete(Map<String, String> props) {
    return !(props.containsKey("encrypt_table") || props.containsKey("encrypt_columns"))
        || (props.containsKey("dwrf_encryption_algorithm") && props.containsKey("dwrf_encryption_provider"));
}

try {
    createTable(withEncryption(props));
} catch (PrestoException e) {
    if ("HIVE_INVALID_ENCRYPTION_METADATA".equals(e.getErrorCode().getName())) {
        // surface which of the two keys is missing to the user
    }
    throw e;
}

When it happens

Trigger: Table properties contain ENCRYPT_TABLE_KEY or ENCRYPT_COLUMNS_KEY but are missing DWRF_ENCRYPTION_ALGORITHM_KEY and/or DWRF_ENCRYPTION_PROVIDER_KEY — typically from a table created/altered with incomplete encryption properties or manual metastore edits.

Common situations: Hand-editing Hive serde/table properties, partial migration from another engine, or a create-table script that sets encrypt columns but forgets the algorithm/provider properties.

Related errors

• GENERIC_INTERNAL_ERROR
• HIVE_INVALID_ENCRYPTION_METADATA
• HIVE_INVALID_ENCRYPTION_METADATA
• HIVE_INVALID_METADATA
• HIVE_UNSUPPORTED_ENCRYPTION_OPERATION

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/5e656fcb9e55947a. Report an issue: GitHub.