Repository navigation
[Bug]: hash_hkdf(): Argument #2 ($key) cannot be empty / HMAC does not match #34012
Description
Activity
Do you have a
'secret'value on yourconfig.phpfile?If secret is missing, you will see this error. Once you add it back, it should work again.
Please reopen this issue if it happens again after adding the secret parameter
@CarlSchwan The problem seems to be more complex than I expected at the beginning. I found out that the
secretparameter hasn't been set in the past at all on the server so that an empty value was used for encrypting passwords etc. The system excepted that setting and never complained about an empty value before.
If I set'secret' => '',in the configuration the displayed exception changes as follow - what is understandable somehow.... -","app":"cron","method":"","url":"/cron.php","message":"hash_hkdf(): Argument #2 ($key) cannot be empty",Next I've provided a value to the secret parameter to get rid of the reported messages. As expected this had a bigger impact on the server because all application passwords and mount passwords hd to be changed. I tried to get this done and was able to successfully set new app passwords but I was unable to access my personal external storage anymore. As soon as I access the external storage configuration page I get an exception displayed on the screen with the recommendation to check the server log file.
The server log files shows aHMAC does not match.exception, independently if mounts exists or not. So by setting a value for the secret parameter external storages got unusable. Now I'm sitting between two chairs and can only tell you that the incompatibility seems to have been introduced with NC 24.0.5.Reacted by Denix and paramazo#31499 is working and you can apply the patch. The reason why it is wip is that we wanted to have a migration step in the background adding the secret if it was missing :(
I'll try to revive the branches
@CarlSchwan Unfortunately I've already fixed the problem on my server. After setting the 'secret' parameter in the configuration I truncated the `oc_storages_credentials' table, which allowed me to access the external storage settings again and to enter new credentials. After that I had to set all application passwords again because the previously generated once didn't work anymore. Additionally I had to reconnect the TOTP applications of my users again. Finally I had to drop all mail tables and reinstalled the mail app to get it up-and-running again. For now it seems to work. Nevertheless the provided patch will be the right way to go, because otherwise many systems will most likely left in an insecure state.
Reacted by Jens Ramakers and Антон Сергеевич АлёшкинI merged the related PR
58 remaining items
I hit this bug when I tried to decrypt some e2e encrypted files on my mobile nextcloud client.
The database was migrated, but I didn't copy over the old config.php in its entirety, which made certain things run with a newly generated 'secret' for a while before I finally copied the new one over.
As I did not use external storage, not much else seemed to be affected aside from the inability to decrypt an e2e encrypted folder.
I have also reset the user's e2d keys in hopes that the new keys would be encrypted by the restored 'secret', but this problem still occurs. Could the newly generated 'secret' be cached in the database somewhere and need to be removed in order for the instance to complete the migration?
Because of same problem, I am stucked to version '29.0.4.1'. Cannot upgrade. Previously; I moved from VM installation to Docker. I moved nextcloud data directory out of '/var/www'. These are the Errors I get, during upgrade.
nextcloud | Setting log level to debug nextcloud | Turned on maintenance mode nextcloud | Updating database schema nextcloud | Updated database nextcloud | Updating <oauth2> ... nextcloud | An unhandled exception has been thrown: nextcloud | ValueError: hash_hkdf(): Argument #2 ($key) cannot be empty in /var/www/html/lib/private/Security/Crypto.php:168Reacted by jzborReacted by Melroy van den BergI ended up in the same situation doing a manual migration from Truecharts (v29) to Truenas app (v31). My mistake was to not copy over the old secret.
I tried to fix it a couple fo times, but it seems a few more steps were required. I started all over again to migrate from scratch, i.e. database and user data. I also kept the old "instanceid" in the config. Now it seems to work.
So in the end not a bug but rather not following the process properly.
- added a commit that references this issue
on Mar 6, 2025 I ended up in the same situation, but my secret is present in the config.php file
Message: hash_hkdf(): Argument #2 ($key) must not be empty in file '/customers/f/d/9/DOMAIN/httpd.www/cloud/lib/private/Security/Crypto.php' line 147 File: /customers/f/d/9/DOMAIN/httpd.www/cloud/lib/private/AppFramework/Http/Dispatcher.php Line: 146do not publicly advise to delete data from random tables in Nextcloud, people may break their installation or lose data.
I deleted them
I had this error with Nextcloud All-in-One and there was already a secret in my config.php. This was likely caused by when I migrated from a previous installation that had external storage points to All in one, which gave me a new secret and thus the info abou the old points could not be decrypted.
I didn't need the old mount points so I solved the error with the below which deletes all information regarding the old mount points.
docker exec -it nextcloud-aio-database psql -U oc_nextcloud -d nextcloud_databaseTRUNCATE TABLE oc_storages_credentials;Reacted by Melroy van den BergDue to an error in a migration, I had also ran for a few time with a wrong secret. Though I was not using at all any external drive or encryption.
On my side, the problem generating the
hash_hkdf() armgument #2 cannot be emptywas a password for a user that got generated at this time and never changed.By changing it, I have solved the issue and I never have anymore any issue with it.
I would be highly in favor of a tool in occ to list all inconstistent elements (storages, encrypted files, passwords) for which the secret is missing, which would simplify the manual remediation, and in addition some recommandations on what to do to resolve and the associated cavehats (removing the external storage, changing the password, re-uploading the file, …)
Reacted by oberator and DenixReacted by Melroy van den BergI have this error too, no idea if the secret changed during some previous upgrade. If it did, any backups is gone since then.
So how do I fix it?Do you have a
'secret'value on yourconfig.phpfile?Yes
Running NC32.. error in
html/lib/private/Security/Crypto.php' line 147However, maybe this could be a simple issue like when a user emptied their cookies and local cache in the web browser.. or not??
Reacted by Denix- marked [Bug]: Model loading fails with 500 error in integration_openai when setting OpenAI API key #57040 as a duplicate of this issue
on Dec 12, 2025 I confirm the issue and the solution in #34012 (comment) for version 31.x.x
Reacted by Tyler Hawkins#34012 (comment) worked for me as well.
For those who are skimming the code in the comment and don't see an immediate difference to the file you have (especially since the
Line 132link in that comment goes to a different line of code now after some changes), do a diff. For me, the critical change is now on line 100 of my file:if ($password === '') {
changes to:
if ($password === $secret) {
Reacted by Tom- added a commit that references this issue
on Jul 6, 2026
Bug description
After upgrading my server from Nextcloud v24.0.4 to v24.0.5 and also upgrading to PHP8 (I don't know if this is of importance), the Nextcloud cron job generates the following error output:
Steps to reproduce
I don't know how to reproduce it at the moment but it seems to occur if notification should be send-out.
Expected behavior
Execute background job without running into an error condition.
Installation method
Community Manual installation with Archive
Operating system
No response
PHP engine version
PHP 8.0
Web server
Apache (supported)
Database engine version
MariaDB
Is this bug present after an update or on a fresh install?
Updated from a minor version (ex. 22.2.3 to 22.2.4)
Are you using the Nextcloud Server Encryption module?
Encryption is Disabled
What user-backends are you using?
Configuration report
List of activated Apps
Nextcloud Signing status
Nextcloud Logs
.Additional info
.