tursodatabase/turso · error · InvalidOperationException

Unknown encryption cipher: {cipher}

Error message

Unknown encryption cipher: {cipher}

What it means

TursoConnectionStringBuilder.GetEncryptionCipher() maps the 'Encryption Cipher' connection keyword to a cipher enum and throws this InvalidOperationException for any value outside the supported list. Supported values (case-insensitive) are: aes128gcm, aes256gcm, aegis256, aegis256x2, aegis128l, aegis128x2, aegis128x4. These match the SQLCipher-compatible ciphers the embedded engine can use with 'Encryption Key'.

Source

Thrown at bindings/dotnet/src/Turso.Data/TursoConnectionStringBuilder.cs:337

            : null;
    }

    internal TursoEncryptionCipher? GetEncryptionCipher()
    {
        var cipher = GetOption("Encryption Cipher");
        if (string.IsNullOrWhiteSpace(cipher))
            return null;

        return cipher.ToLowerInvariant() switch
        {
            "aes128gcm" => TursoEncryptionCipher.Aes128Gcm,
            "aes256gcm" => TursoEncryptionCipher.Aes256Gcm,
            "aegis256" => TursoEncryptionCipher.Aegis256,
            "aegis256x2" => TursoEncryptionCipher.Aegis256x2,
            "aegis128l" => TursoEncryptionCipher.Aegis128l,
            "aegis128x2" => TursoEncryptionCipher.Aegis128x2,
            "aegis128x4" => TursoEncryptionCipher.Aegis128x4,
            _ => throw new InvalidOperationException($"Unknown encryption cipher: {cipher}")
        };
    }

    private static string NormalizeKeyword(string keyword)
    {
        ArgumentException.ThrowIfNullOrWhiteSpace(keyword);
        if (KeywordMap.TryGetValue(keyword, out var normalizedKeyword))
            return normalizedKeyword;

        throw new ArgumentException($"Unsupported keyword: {keyword}", nameof(keyword));
    }

    private string GetString(string keyword) => GetOption(keyword) ?? string.Empty;

    private void SetString(string keyword, string value)
    {
        ArgumentNullException.ThrowIfNull(value);
        this[keyword] = value;

View on GitHub (pinned to c1e5928725)

Solutions

1. Use one of the exact supported values: aes128gcm, aes256gcm, aegis256, aegis256x2, aegis128l, aegis128x2, aegis128x4 (any letter casing is fine).
2. If you do not need encryption, remove both 'Encryption Cipher' and 'Encryption Key' from the connection string.
3. Check for stray whitespace around the value in the connection string.

Example fix

// before
Data Source=app.db;Encryption Key=secret;Encryption Cipher=aes-256-gcm

// after
Data Source=app.db;Encryption Key=secret;Encryption Cipher=aes256gcm

private static readonly HashSet<string> ValidCiphers = new(StringComparer.OrdinalIgnoreCase)
{ "aes128gcm", "aes256gcm", "aegis256", "aegis256x2", "aegis128l", "aegis128x2", "aegis128x4" };
if (!string.IsNullOrEmpty(cipher) && !ValidCiphers.Contains(cipher))
    throw new ConfigurationException($"Unsupported cipher '{cipher}'. Valid: {string.Join(", ", ValidCiphers)}");

When it happens

Trigger: Setting 'Encryption Cipher' to anything but the seven exact names — e.g. 'aes-256-gcm', 'AES256GCM128', 'chacha20poly1305', 'aes-256' — and then opening the connection or otherwise resolving options (GetEncryptionCipher is consulted when an Encryption Key is configured).

Common situations: Copying cipher names from SQLCipher documentation or crypto libraries that use hyphenated names ('aes-256-gcm'); assuming ChaCha20 is supported; casing or spelling drift after upgrading from another SQLite provider.

Related errors

• Encryption Cipher and Encryption Key are local database opti
• Embedded replica connections are not supported yet by the .N
• Sync Interval requires embedded replica support, which is no
• Auth Token requires a remote Turso URL Data Source.
• Unsupported keyword: {keyword}

AI-assisted analysis of tursodatabase/turso@c1e5928725 (2026-08-20). Data as JSON: /api/errors/b9ec9a9403a0d8d0. Report an issue: GitHub.