-
Notifications
You must be signed in to change notification settings - Fork 4.1k
Description
Describe the problem
When generating an encryption key using cockroach gen encryption-key --size 256 --version 2, the generated JWK incorrectly contains "alg": "cockroach-aes-192-ctr-v2" instead of the expected "cockroach-aes-256-ctr-v2".
To Reproduce
- Run
cockroach gen encryption-key --size 256 --version 2 out.key - Inspect
out.key:{"keys":[{"alg":"cockroach-aes-192-ctr-v2","k":"...","kid":"...","kty":"oct"}]} - Note that the key
kis 32 bytes (256 bits) after base64 decoding, but thealgfield specifies 192 bits.
Expected behavior
The alg field should match the specified size: "alg": "cockroach-aes-256-ctr-v2".
Root Cause
There is a typo in pkg/storage/enginepb/key_registry.go within the JWKAlgorithm() method:
case EncryptionType_AES_256_CTR_V2:
return "cockroach-aes-192-ctr-v2", nilIt should return "cockroach-aes-256-ctr-v2".
Impact
While the underlying Go aes package will use AES-256 because the key is 32 bytes, internal CockroachDB logic that relies on the EncryptionType enum (derived from the alg string) will incorrectly treat it as a 192-bit key. This might lead to 192-bit data keys being generated even when a 256-bit master key is used.
Jira issue: CRDB-58116