AlexxIT/go2rtc · error · protocol.TemporaryError

CipherSuite not initialized

Error message

CipherSuite not initialized

What it means

TUTK DTLS cipher sentinel (protocol.TemporaryError): Encrypt/Decrypt was called but c.aead.Load() holds no *ChaCha20Poly1305Cipher — the cipher suite was used before Init stored the AEAD (handshake not finished, or the CCAC suite was never initialized). Every encrypt/decrypt attempt fails until initialization completes.

Solutions

1. Ensure the cipher suite's Init/InstallKeys ran before traffic flows (complete the handshake first)
2. Treat as temporary: queue or drop packets until the AEAD is set
3. Check the negotiated suite actually is CCAC before binding this cipher

When it happens

Trigger: Thrown at pkg/tutk/dtls/cipher.go:29 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of AlexxIT/go2rtc@c245815e75 (2026-09-07). Data as JSON: /api/errors/5cdbd5e1fa89e84d. Report an issue: GitHub.

Appendix: source

Thrown at pkg/tutk/dtls/cipher.go:29

	"github.com/pion/dtls/v3"
	"github.com/pion/dtls/v3/pkg/crypto/clientcertificate"
	"github.com/pion/dtls/v3/pkg/crypto/prf"
	"github.com/pion/dtls/v3/pkg/protocol"
	"github.com/pion/dtls/v3/pkg/protocol/recordlayer"
	"golang.org/x/crypto/chacha20poly1305"
)

const CipherSuiteID_CCAC dtls.CipherSuiteID = 0xCCAC

const (
	chachaTagLength   = 16
	chachaNonceLength = 12
)

var (
	errDecryptPacket      = &protocol.TemporaryError{Err: errors.New("failed to decrypt packet")}
	errCipherSuiteNotInit = &protocol.TemporaryError{Err: errors.New("CipherSuite not initialized")}
)

type ChaCha20Poly1305Cipher struct {
	localCipher, remoteCipher   cipher.AEAD
	localWriteIV, remoteWriteIV []byte
}

func NewChaCha20Poly1305Cipher(localKey, localWriteIV, remoteKey, remoteWriteIV []byte) (*ChaCha20Poly1305Cipher, error) {
	localCipher, err := chacha20poly1305.New(localKey)
	if err != nil {
		return nil, err
	}

	remoteCipher, err := chacha20poly1305.New(remoteKey)
	if err != nil {
		return nil, err
	}

View on GitHub (pinned to c245815e75)