Magento 2.3 has introduced a new encryption method and requires the encryption key to be 32 characters long / 32 bytes in size.
If you run a setup:upgrade with a wrongly sized encryption key you will get the below error:
secret key size should be SODIUM_CRYPTO_AEAD_CHACHA20POLY1305_IETF_KEYBYTES bytes
You can regenerate the encryption key before the upgrade using the admin panel, but it seems to append the new encryption key to the old one. I believe this is an intended feature for archiving purposes / decrypting old data?
The problem I am facing is: I can update my encryption key on Magento 2.2.x and it will append the new (correctly sized) encryption key to the old one in app/etc/env.php. Everything still works.
But when you upgrade to 2.3, you will still get the error message from above when doing a setup:upgrade. It must look at the field in app/etc/env.php as a whole, and figure out it isn't 32 characters long (because the old encryption key is on the line above the new one).
Does anyone know if appending the new encryption key to the old one is intended behaviour? And if it is safe to remove the old encryption key so we can proceed with the 2.3 upgrade?