tursodatabase/turso · error · InvalidOperationException

Unknown remote encryption cipher: {value}

Error message

Unknown remote encryption cipher: {value}

What it means

ParseCipher maps a cipher name string to a TursoRemoteEncryptionCipher enum value. When configuring remote encryption, an unrecognized cipher string throws this InvalidOperationException listing the unknown value.

Source

Thrown at bindings/dotnet/src/Turso.Data/TursoSyncDatabaseOptions.cs:69

        ArgumentException.ThrowIfNullOrWhiteSpace(Key);
        _ = ReservedBytes;
    }

    internal static TursoRemoteEncryptionCipher ParseCipher(string value)
    {
        ArgumentException.ThrowIfNullOrWhiteSpace(value);
        return value.Trim().ToLowerInvariant() switch
        {
            "aes256gcm" => TursoRemoteEncryptionCipher.Aes256Gcm,
            "aes128gcm" => TursoRemoteEncryptionCipher.Aes128Gcm,
            "chacha20poly1305" => TursoRemoteEncryptionCipher.ChaCha20Poly1305,
            "aegis128l" => TursoRemoteEncryptionCipher.Aegis128L,
            "aegis128x2" => TursoRemoteEncryptionCipher.Aegis128X2,
            "aegis128x4" => TursoRemoteEncryptionCipher.Aegis128X4,
            "aegis256" => TursoRemoteEncryptionCipher.Aegis256,
            "aegis256x2" => TursoRemoteEncryptionCipher.Aegis256X2,
            "aegis256x4" => TursoRemoteEncryptionCipher.Aegis256X4,
            _ => throw new InvalidOperationException($"Unknown remote encryption cipher: {value}"),
        };
    }
}

public sealed class TursoPartialSyncOptions
{
    public int? PrefixLength { get; init; }
    public string? Query { get; init; }
    public long? SegmentSize { get; init; }
    public bool Prefetch { get; init; }

    internal void Validate()
    {
        if (Query is not null)
            ArgumentException.ThrowIfNullOrWhiteSpace(Query);

        var hasPrefix = PrefixLength.HasValue;
        var hasQuery = Query is not null;

View on GitHub (pinned to c1e5928725)

Solutions

1. Use one of the supported names exactly: aegis128l, aegis128x2, aegis128x4, aegis256, aegis256x2, aegis256x4 (lowercase, no hyphens)
2. Pick the cipher supported by the server: aegis256 is the common Turso default — confirm with the server's encryption config
3. Check casing/typos: the value must be lowercase and not hyphenated

Example fix

// before
options.RemoteEncryption = new TursoRemoteEncryptionOptions { Cipher = "aes-256-gcm", Key = key };
// after
options.RemoteEncryption = new TursoRemoteEncryptionOptions { Cipher = "aegis256", Key = key };

private static readonly HashSet<string> SupportedCiphers = new(StringComparer.Ordinal)
{ "aegis128l", "aegis128x2", "aegis128x4", "aegis256", "aegis256x2", "aegis256x4" };
// before constructing options:
// if (!SupportedCiphers.Contains(cipherName)) throw new ArgumentException($"Cipher must be one of: {string.Join(", ", SupportedCiphers)}");

try
{
    var db = new TursoSyncDatabase(options);
}
catch (InvalidOperationException ex) when (ex.Message.StartsWith("Unknown remote encryption cipher"))
{
    logger.LogError(ex, "Configured cipher '{Cipher}' is not supported; use an aegis cipher name.", cipherName);
    throw;
}

When it happens

Trigger: Setting TursoRemoteEncryptionOptions cipher name to a string not in the accepted list: aegis128l, aegis128x2, aegis128x4, aegis256, aegis256x2, aegis256x4 — e.g. "aes-256-gcm", "AES128", or a typo like "aegis-128l".

Common situations: Confusing Turso's AEGIS ciphers with common AES-GCM names; copy-pasted config from another database's encryption settings; case/spacing mismatches or hyphenated variants.

Related errors

• Auth Token requires a remote Turso URL Data Source.
• Encryption is not supported in this build
• Encryption is not supported in this build
• invalid config: url is required
• Unknown encryption cipher: {cipher}

AI-assisted analysis of tursodatabase/turso@c1e5928725 (2026-08-31). Data as JSON: /api/errors/0a44ca4d92e46232. Report an issue: GitHub.