Data-migration-tool: [Magento\Framework\Exception\LocalizedException] Init vector must be a string of 32 bytes.

[jordanvector]

After a successful migration I see:

[Magento\Framework\Exception\LocalizedException]
Init vector must be a string of 32 bytes.

What's interesting is the key from the magento 1 store is already 32 characters so I am not quite sure what it's expecting.

Magento Version: Magento Commerce 2.2.2 on magento cloud

[toddwolaver]

I have seen the "Init vector must be a string of 32 bytes" error before as a result of a custom module with a config.xml that had an encrypted backend_model set on one of the nodes.

Check that you don't have any modules that have a config.xml containing anything like the line below, backend_model should only be specified in the adminhtml/system.xml.

<password backend_model="Magento\Config\Model\Config\Backend\Encrypted"/>

[jordanvector]

@toddwolaver you are awesome, there was a custom module that was implemented in that way, once updated that was no longer an issue.

[rhoerr]

Follow-up: Removing backend_model from config.xml is not the proper way to solve this. You'll find the same in every core online payment method (see vendor/magento/module-authorizenet/etc/config.xml, etc.).

The problem isn't the encryption key, it's migrated settings. Normally the migration tool reencrypts settings, but it's easy to miss that for custom modules. The data migration tool defines each specific affected setting, like:

settings.xml

<settings xmlns:xs="http://www.w3.org/2001/XMLSchema-instance" xs:noNamespaceSchemaLocation="../settings.xsd">
    <!-- ... -->
    <value>
        <transform>
            <path>payment/authorizenet_directpost/login</path>
            <handler class="\Migration\Handler\Encrypt"/>
        </transform>
        <transform>
            <path>payment/authorizenet_directpost/trans_key</path>
            <handler class="\Migration\Handler\Encrypt"/>
        </transform>

OR, FOR 2.3.0 AND BELOW: (the file was moved, don't ask me why)

<settings xmlns:xs="http://www.w3.org/2001/XMLSchema-instance" xs:noNamespaceSchemaLocation="../settings.xsd">
    <!-- ... -->
    <value>
        <transform>
            <path>payment/authorizenet_directpost/login</path>
            <handler class="\Migration\Handler\Settings\Encrypt"/>
        </transform>
        <transform>
            <path>payment/authorizenet_directpost/trans_key</path>
            <handler class="\Migration\Handler\Settings\Encrypt"/>
        </transform>

If this isn't done, your setting(s) will still have weaker legacy encryption from M1, which M2 rejects when you try to install a new module that references them.

You can either fix your migration tool configuration and remigrate, or remove the legacy encrypted values from core_config_data and re-enter them after installing the module in question.

You can find affected settings after migration with a query like:

SELECT * FROM core_config_data WHERE value LIKE '0:2:%'

Their values will be significantly shorter.

[magefan]

This also helps
https://magento.stackexchange.com/questions/242956/magento-2-2-5-to-2-2-6-upgrade-error
after flush Redis cache, it works for us. command:
redis-cli flushdb

[snoroozi]

@magefan thanks for that reminder! Saved the day