Bug 513514 - a vault has stopped working, can no longer mount and unlock it because the encryption file is not working
Summary: a vault has stopped working, can no longer mount and unlock it because the en...
Status: RESOLVED UPSTREAM
Alias: None
Product: plasmashell
Classification: Plasma
Component: Vaults widget (other bugs)
Version First Reported In: master
Platform: Ubuntu Linux
: NOR critical
Target Milestone: 1.0
Assignee: Plasma Bugs List
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2025-12-17 21:52 UTC by recurre
Modified: 2025-12-18 20:31 UTC (History)
2 users (show)

See Also:
Latest Commit:
Version Fixed/Implemented In:
Sentry Crash Report:


Attachments
Corrupted cryfs.config file (116 bytes, JSON-only, missing salt/kdfParameters) from the broken "libellula" vault. (1.11 KB, application/octet-stream)
2025-12-17 21:52 UTC, recurre
Details

Note You need to log in before you can comment on or make changes to this bug.
Description recurre 2025-12-17 21:52:08 UTC
Created attachment 187759 [details]
Corrupted cryfs.config file (116 bytes, JSON-only, missing salt/kdfParameters) from the broken "libellula" vault.

SUMMARY
I don't really understand any of this, but I have a number of vaults created through the vault widget and they all work except one. The one that doesn't work has worked for 2 years until a couple of days ago, when it stopped working (I cannot unlock it, the password is correct). The files inside seem to be all there, but the problem is with the encryption file, which I think got damaged during closing perhaps because of Dolphin was still open. This is just my guess.   
How do I recuperate the full version of the encryption?

STEPS TO REPRODUCE
1. 
2. 
3. 

OBSERVED RESULT


EXPECTED RESULT


SOFTWARE/OS VERSIONS
Linux Distribution: Ubuntu 22.04
KDE Plasma Version:   plasmashell 5.24.7
KDE Frameworks: 5.92.0
kf5-config: 1.0
Qt: 5.15.3
CryFS Version 0.10.2

ADDITIONAL INFORMATION
I don't know if the description of the attached file is correct, I asked AI to look at it, but on konsole it shows
-rw-rw-r-- 1 mielas mielas 1134 Dec 14  2023 /home/mielas/.local/share/plasma-vault/libellula.enc/cryfs.config
Comment 1 recurre 2025-12-17 21:56:05 UTC
I am not sure where all my comments are, but one of my vaults (the other work fine) has stopped working after 2 years of use. I think it might be because dolphin was open to the vault folder. I don't understand anything of this. But it seems the files are intact and I cannot mount and unlock the vault like before. I think there is a problem with the encryption file. Again I have no idea what is going on. Can you help me unlock the vault?
Comment 2 recurre 2025-12-17 22:10:48 UTC
(I inputed the following commands: in konsole)
fusermount -u "/home/mielas/Vaults/libellula" 2>/dev/null
cryfs ~/.local/share/plasma-vault/libellula.enc "/home/mielas/Vaults/libellula"

(and got:)
CryFS Version 0.10.2

Password: 
Deriving encryption key (this can take some time)...done
[2025-12-17 16:47:29.476] [Log] [error] Crashed: Deserialization failed - size overflow
Comment 3 Ivan Čukić 2025-12-18 06:24:07 UTC
Hi, the issue is cryfs. Did its get updated recently?

You can try copying the data to another computer and calling the same command to see if it works there (maybe with a different cryfs version)

If the config file is really corrupted due to the underlying filesystem error, I don't think there's much that can be done unless you have backups of the encrypted data somewhere. Or at least, of the config file.

You can try to submit the crash report to the cryfs developer on github.
Comment 4 Nate Graham 2025-12-18 20:31:39 UTC
So sorry this happened!

Unfortunately the version of Ubuntu you're using  is very old at this point. Since it seems like the issue is with the 3rd-party Cryfs tool shipped by Ubuntu, the only real option here id for you to turn to them for support. That's the idea behind "Long Term Support" distros, after all.

FWIW more recent versions of Plasma Vaults will only support Cryfs for older vaults; the only supported backend now for new vaults is Gocryptfs. If you do have access to the files, I would strongly recommend moving them into a new vault made with the Gocryptfs backend.

Best of luck!