From f3396b63f60bfc7f25bdfb1a557c2a8d37a9069e Mon Sep 17 00:00:00 2001
From: Daniel Hougaard <daniel@infisical.com>
Date: Wed, 22 Oct 2025 14:47:59 +0400
Subject: [PATCH] fix: only validate encryption key if HSM not active

---
 backend/src/lib/crypto/cryptography/crypto.ts | 53 ++++++++++---------
 1 file changed, 27 insertions(+), 26 deletions(-)

diff --git a/backend/src/lib/crypto/cryptography/crypto.ts b/backend/src/lib/crypto/cryptography/crypto.ts
index 49ee9c01f..6e2a15740 100644
--- a/backend/src/lib/crypto/cryptography/crypto.ts
+++ b/backend/src/lib/crypto/cryptography/crypto.ts
@@ -122,36 +122,37 @@ const cryptographyFactory = () => {
 
       const appCfg = envCfg || getConfig();
 
-      if (appCfg.ENCRYPTION_KEY) {
-        // we need to validate that the ENCRYPTION_KEY is a base64 encoded 256-bit key
+      const hsmStatus = await isHsmActiveAndEnabled({
+        hsmService,
+        kmsRootConfigDAL
+      });
 
-        // note(daniel): for some reason this resolves as true for some hex-encoded strings.
-        if (!isBase64(appCfg.ENCRYPTION_KEY)) {
-          throw new CryptographyError({
-            message:
-              "FIPS mode is enabled, but the ENCRYPTION_KEY environment variable is not a base64 encoded 256-bit key.\nYou can generate a 256-bit key using the following command: `openssl rand -base64 32`"
-          });
-        }
+      // if the encryption strategy is software - user needs to provide an encryption key
+      // if the encryption strategy is null AND the hsm is not configured - user needs to provide an encryption key
+      const needsEncryptionKey =
+        hsmStatus.rootKmsConfigEncryptionStrategy === RootKeyEncryptionStrategy.Software ||
+        (hsmStatus.rootKmsConfigEncryptionStrategy === null && !hsmStatus.isHsmConfigured);
 
-        if (bytesToBits(Buffer.from(appCfg.ENCRYPTION_KEY, "base64").length) !== 256) {
-          throw new CryptographyError({
-            message:
-              "FIPS mode is enabled, but the ENCRYPTION_KEY environment variable is not a 256-bit key.\nYou can generate a 256-bit key using the following command: `openssl rand -base64 32`"
-          });
-        }
-      } else {
-        const hsmStatus = await isHsmActiveAndEnabled({
-          hsmService,
-          kmsRootConfigDAL
-        });
+      // only perform encryption key validation if it's actually required.
+      if (needsEncryptionKey) {
+        if (appCfg.ENCRYPTION_KEY) {
+          // we need to validate that the ENCRYPTION_KEY is a base64 encoded 256-bit key
 
-        // if the encryption strategy is software - user needs to provide an encryption key
-        // if the encryption strategy is null AND the hsm is not configured - user needs to provide an encryption key
-        const needsEncryptionKey =
-          hsmStatus.rootKmsConfigEncryptionStrategy === RootKeyEncryptionStrategy.Software ||
-          (hsmStatus.rootKmsConfigEncryptionStrategy === null && !hsmStatus.isHsmConfigured);
+          // note(daniel): for some reason this resolves as true for some hex-encoded strings.
+          if (!isBase64(appCfg.ENCRYPTION_KEY)) {
+            throw new CryptographyError({
+              message:
+                "FIPS mode is enabled, but the ENCRYPTION_KEY environment variable is not a base64 encoded 256-bit key.\nYou can generate a 256-bit key using the following command: `openssl rand -base64 32`"
+            });
+          }
 
-        if (needsEncryptionKey) {
+          if (bytesToBits(Buffer.from(appCfg.ENCRYPTION_KEY, "base64").length) !== 256) {
+            throw new CryptographyError({
+              message:
+                "FIPS mode is enabled, but the ENCRYPTION_KEY environment variable is not a 256-bit key.\nYou can generate a 256-bit key using the following command: `openssl rand -base64 32`"
+            });
+          }
+        } else {
           throw new CryptographyError({
             message:
               "FIPS mode is enabled, but the ENCRYPTION_KEY environment variable is not set.\nYou can generate a 256-bit key using the following command: `openssl rand -base64 32`"