cryptography.exceptions.InvalidTag

[jsyrjala]

It is possible that key lookup fails with this kind of error.

Maybe related to overwriting existing key with very old vault version.

vault -l keyname
Traceback (most recent call last):
 File “/usr/local/bin/vault”, line 10, in <module>
   sys.exit(main())
 File “/usr/local/lib/python3.7/site-packages/n_vault/cli.py”, line 148, in main
   data = vlt.lookup(args.lookup)
 File “/usr/local/lib/python3.7/site-packages/n_vault/vault.py”, line 590, in lookup
   return AESGCM(self.direct_decrypt(datakey)).decrypt(b64decode(meta[‘nonce’]), ciphertext, meta_add)
 File “/usr/local/lib/python3.7/site-packages/cryptography/hazmat/primitives/ciphers/aead.py”, line 180, in decrypt
   backend, self, nonce, data, associated_data, 16
 File “/usr/local/lib/python3.7/site-packages/cryptography/hazmat/backends/openssl/aead.py”, line 157, in _decrypt
   raise InvalidTag
cryptography.exceptions.InvalidTag

[jsyrjala]

If you are sure there is no funky business going on, you can recrypt the payload like this:

aws s3 rm s3://vault-bucket/key-name.aesgcm.encrypted
vault -c key-name