siyuan-note/siyuan · error

Conf.Language(316)

Error message

Conf.Language(316)

What it means

ImportNotebookCryptoBackup compatibility check surfaced as localized message Conf.Language(316) (key mismatch): the password-derived KEK passes the verifier but cannot decrypt the WrappedDEKs of existing notebooks or deleted-notebook history. The backup belongs to a different key lineage, and importing it would orphan existing encrypted data.

Source

Thrown at kernel/model/crypto.go:357

	if validErr != nil {
		return errors.New(Conf.Language(317))
	}
	kek := util.DeriveKey(password, nc.MasterSalt, params)
	defer zeroAndClear(kek)
	if nc.Checksum != computeBackupChecksum(nc) {
		return errors.New(Conf.Language(317))
	}
	if !verifyKEKMAC(nc, kek) {
		return errors.New(Conf.Language(317))
	}
	decrypted, dErr := util.DecryptWithAAD(kek, nc.KEKVerifier, []byte("siyuan:kek-verifier"))
	if dErr != nil || string(decrypted) != string(kekVerifierMagic) {
		return errors.New(Conf.Language(311)) // 主密码错误
	}

	// 校验 KEK 能解密现存笔记本和已删除笔记本历史中的 WrappedDEK，避免导入不匹配的备份。
	if !verifyKEKAgainstExistingBoxes(kek, nc) || !verifyKEKAgainstEncryptedHistory(kek, nc) {
		return errors.New(Conf.Language(316)) // 密钥不匹配
	}

	nc.KDFParams = params // 确保写回 Conf 的参数已经通过完整校验。
	nc.Enabled = true

	// 先写 backup，再提交 conf；backup 失败时 conf 尚未改变，可重试
	if err := writeNotebookCryptoBackupData(nc, kek); err != nil {
		return fmt.Errorf("failed to persist key backup: %w", err)
	}
	Conf.m.Lock()
	*Conf.NotebookCrypto = *nc
	Conf.m.Unlock()
	Conf.Save()
	IncSync()
	return nil
}

// saveNotebookCryptoBackup 把当前 NotebookCrypto（含 MasterSalt/KEKVerifier/KDFParams）备份到 DataDir。

View on GitHub (pinned to 8641553a1f)

Solutions

1. Import into the workspace whose keys match the backup lineage
2. Use the documented recovery flow instead of forcing the import
3. Preserve the existing envelopes; do not discard keys to proceed

When it happens

Trigger: Thrown at kernel/model/crypto.go:357 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of siyuan-note/siyuan@8641553a1f (2026-09-11). Data as JSON: /api/errors/67d51c67d2af84f7. Report an issue: GitHub.