How to fix Error 9632 on Windows Server 2025 / Windows 11

by

Troubleshooting Guide: Error 9632 – “The Salt Buffer Size Is Too Small”

Why This Error Happens

This error occurs when SQL Server’s encryption functions (such as those used in ENCRYPTBYPASSPHRASE, ENCRYPTBYKEY, or Always Encrypted operations) receive a salt value that doesn’t meet the minimum byte-length requirement for the specified algorithm. It is frequently triggered after applying cumulative updates to SQL Server 2025, where stricter cryptographic validation was introduced for FIPS-compliance enforcement. Additionally, corrupted or truncated certificate/key metadata in the master database can cause the salt generation routine to pass an undersized buffer during the encryption handshake.

Step-by-Step Resolution Guide

Step 1: Verify the SQL Server Build and Cryptographic Provider

  • Run SELECT @@VERSION; to confirm you are on the latest SQL Server 2025 Cumulative Update (CU2 or later resolves known salt-buffer regressions).
  • Check if FIPS mode is enforced via Local Security Policy: secpol.msc → Local Policies → Security Options → “System cryptography: Use FIPS compliant algorithms.”
  • If FIPS is enabled, temporarily disable it in a test environment to confirm it is the root cause.

Step 2: Rebuild the Affected Encryption Keys

  • Identify the affected key or certificate using:
SELECT * FROM sys.symmetric_keys;
SELECT * FROM sys.certificates;
  • Drop and recreate the symmetric key with an explicit, supported algorithm (AES_256 is recommended over legacy RC4/DES variants):
DROP SYMMETRIC KEY YourKeyName;
CREATE SYMMETRIC KEY YourKeyName 
WITH ALGORITHM = AES_256 
ENCRYPTION BY CERTIFICATE YourCertName;
  • Re-run the encryption function that previously failed (e.g., ENCRYPTBYKEY) to confirm the salt buffer is now correctly sized.

Step 3: Patch or Reinstall the Cryptographic API Components

  • On Windows Server 2025 / Windows 11, ensure the OS is fully patched via Settings > Windows Update, as the underlying issue sometimes originates in the bcrypt.dll / ncrypt.dll libraries used by SQL Server’s CryptoAPI layer.
  • Run sfc /scannow from an elevated Command Prompt to repair any corrupted system cryptographic DLLs.
  • Restart the SQL Server service (services.msc → SQL Server (MSSQLSERVER) → Restart) to reload the updated libraries.

Step 4: Adjust the Salt Length Parameter in Application Code

  • If the error originates from a custom application or stored procedure explicitly passing a salt value, locate the function call and ensure the salt parameter meets the minimum 16-byte (128-bit) requirement for AES-based operations.
  • Update the code:
DECLARE @salt VARBINARY(16) = CRYPT_GEN_RANDOM(16);
  • Redeploy the stored procedure and test the encryption/decryption cycle end-to-end.

Alternative or Verification Steps

  • Verify the fix by executing the previously failing query/procedure and confirming no Error 9632 appears in the SQL Server Error Log (EXEC xp_readerrorlog 0, 1;).
  • If the issue persists, restore the master database from a pre-upgrade backup and reapply only the validated Cumulative Update, as corrupted key metadata may require a clean key regeneration from a healthy backup state.