Skip to content

cli: gen encryption-key --size 256 --version 2 produces incorrect "alg" string #160004

@BastienClement

Description

@BastienClement

Describe the problem
When generating an encryption key using cockroach gen encryption-key --size 256 --version 2, the generated JWK incorrectly contains "alg": "cockroach-aes-192-ctr-v2" instead of the expected "cockroach-aes-256-ctr-v2".

To Reproduce

  1. Run cockroach gen encryption-key --size 256 --version 2 out.key
  2. Inspect out.key:
    {"keys":[{"alg":"cockroach-aes-192-ctr-v2","k":"...","kid":"...","kty":"oct"}]}
  3. Note that the key k is 32 bytes (256 bits) after base64 decoding, but the alg field specifies 192 bits.

Expected behavior
The alg field should match the specified size: "alg": "cockroach-aes-256-ctr-v2".

Root Cause
There is a typo in pkg/storage/enginepb/key_registry.go within the JWKAlgorithm() method:

	case EncryptionType_AES_256_CTR_V2:
		return "cockroach-aes-192-ctr-v2", nil

It should return "cockroach-aes-256-ctr-v2".

Impact
While the underlying Go aes package will use AES-256 because the key is 32 bytes, internal CockroachDB logic that relies on the EncryptionType enum (derived from the alg string) will incorrectly treat it as a 192-bit key. This might lead to 192-bit data keys being generated even when a 256-bit master key is used.

Jira issue: CRDB-58116

Metadata

Metadata

Assignees

No one assigned

    Labels

    A-storageRelating to our storage engine (Pebble) on-disk storage.C-bugCode not up to spec/doc, specs & docs deemed correct. Solution expected to change code/behavior.O-communityOriginated from the communityT-storageStorage Team

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions