restic/restic · error

unable to create cipher: %v

Error message

unable to create cipher: %v

What it means

decryptUnsigned is a debug/repair helper (loadBlobs path behind 'restic repair pack') that AES-CTR decrypts pack data using k.EncryptionKey. aes.NewCipher fails only for keys not 16/24/32 bytes, and restic uses 32-byte keys exclusively, so this panic means the Key passed into the repair path has a wrong-size encryption key. It signals key corruption or a wrongly constructed crypto.Key rather than damaged repository data.

Source

Thrown at internal/repository/debug.go:278

	if err != nil {
		panic("all go routines can only return nil")
	}

	if !found {
		printer.S("\n        blob could not be repaired")
	}
	return fixed
}

func decryptUnsigned(k *crypto.Key, buf []byte) []byte {
	// strip signature at the end
	l := len(buf)
	nonce, ct := buf[:16], buf[16:l-16]
	out := make([]byte, len(ct))

	c, err := aes.NewCipher(k.EncryptionKey[:])
	if err != nil {
		panic(fmt.Sprintf("unable to create cipher: %v", err))
	}
	e := cipher.NewCTR(c, nonce)
	e.XORKeyStream(out, ct)

	return out
}

func loadBlobs(ctx context.Context, opts ExaminePackOptions, repo *Repository, packID restic.ID, list pack.Blobs, printer restic.Printer) error {
	dec, err := zstd.NewReader(nil)
	if err != nil {
		panic(err)
	}

	packData, err := repo.LoadRaw(ctx, restic.PackFile, packID)
	// allow processing broken pack files
	if packData == nil {
		return err
	}

View on GitHub (pinned to a80be1478a)

Solutions

1. Ensure the Key comes from the repository's key unlocking path (crypto.KDF via restic keys), never constructed by hand
2. Validate k.Valid() before invoking repair commands
3. If spontaneous, test RAM and disk health

if !k.Valid() {
	return errors.New("invalid crypto key for repair path")
}

When it happens

Trigger: Running 'restic repair pack' when the in-memory crypto.Key is malformed; embedding code passing a hand-built Key into the examine/repair helpers; memory corruption altering the key slice length.

Common situations: Custom tooling that reuses restic's internal repair APIs with manually assembled keys; sporadic hardware-induced corruption.

Related errors

• unable to create cipher: %v
• invalid key
• unable to read enough random bytes for new salt
• all go routines can only return nil
• internal error - index must be saved before calling MasterIn

AI-assisted analysis of restic/restic@a80be1478a (2026-08-15). Data as JSON: /api/errors/f7522c241063af22. Report an issue: GitHub.