prestodb/presto · critical · OrcCorruptionException

Stripe encryption keys are missing, but file is encrypted

Error message

Stripe encryption keys are missing, but file is encrypted

What it means

validateEncryption checks DWRF per-stripe key metadata. If the file declares encryption groups but stripes exist whose key metadata is empty, the encrypted file is missing the keys needed for decryption, so OrcCorruptionException is thrown.

Source

Thrown at presto-orc/src/main/java/com/facebook/presto/orc/OrcReader.java:295

            DwrfStripeCache cache = dwrfStripeCacheData.buildDwrfStripeCache(footer.getStripes(), footer.getDwrfStripeCacheOffsets().get());
            dwrfStripeCache = Optional.of(cache);
        }

        requireNonNull(stripeMetadataSourceFactory, "stripeMetadataSourceFactory is null");
        this.stripeMetadataSource = requireNonNull(stripeMetadataSourceFactory.create(dwrfStripeCache), "stripeMetadataSource is null");
    }

    @VisibleForTesting
    public static void validateEncryption(Footer footer, OrcDataSourceId dataSourceId)
    {
        if (!footer.getEncryption().isPresent()) {
            return;
        }
        DwrfEncryption dwrfEncryption = footer.getEncryption().get();
        int encryptionGroupSize = dwrfEncryption.getEncryptionGroups().size();
        List<StripeInformation> stripes = footer.getStripes();
        if (!stripes.isEmpty() && encryptionGroupSize > 0 && stripes.get(0).getKeyMetadata().isEmpty()) {
            throw new OrcCorruptionException(dataSourceId, "Stripe encryption keys are missing, but file is encrypted");
        }
        for (StripeInformation stripe : stripes) {
            if (!stripe.getKeyMetadata().isEmpty() && stripe.getKeyMetadata().size() != encryptionGroupSize) {
                throw new OrcCorruptionException(
                        dataSourceId,
                        "Number of stripe encryption keys did not match number of encryption groups.  Expected %s, but found %s",
                        encryptionGroupSize,
                        stripe.getKeyMetadata().size());
            }
        }
    }

    public List<String> getColumnNames()
    {
        return footer.getTypes().get(0).getFieldNames();
    }

    public List<OrcType> getTypes()

View on GitHub (pinned to 55bb57d202)

Solutions

1. Obtain an intact copy of the encrypted file from the writer
2. Ensure the writer was configured with the encryption keys/key providers correctly
3. Re-write the file without encryption if key material is unrecoverable
4. Verify the reading library version matches the DWRF encryption feature version that wrote the file

if (footer.getEncryption().isPresent() && !stripes.isEmpty()) {
    check(stripes.get(0).getKeyMetadata().isPresent(), "missing stripe key metadata");
}

try { reader = new OrcReader(...); }
catch (OrcCorruptionException e) {
    if (e.getMessage().contains("encryption keys are missing")) { /* fetch intact copy */ }
}

When it happens

Trigger: OrcReader on a DWRF file with footer.getEncryption() present, non-empty stripes, encryptionGroupSize > 0, and the first stripe's getKeyMetadata() empty.

Common situations: Partially written or corrupted encrypted files, writers that omitted key metadata, files stripped/rewritten by tools that dropped encryption metadata.

Related errors

• Number of stripe encryption keys did not match number of enc
• Encrypted data size %s exceeds limit of 2^23
• Failed to read or decrypt FileStatistics for node %s
• Flat map reader does not support nesting
• GENERIC_INTERNAL_ERROR

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/48a7d3c1cbd171aa. Report an issue: GitHub.