AlexxIT/go2rtc · error · protocol.TemporaryError

failed to decrypt packet

Error message

failed to decrypt packet

What it means

TUTK DTLS cipher sentinel (protocol.TemporaryError): ChaCha20Poly1305Cipher.Decrypt's remoteCipher.Open failed to decrypt/authenticate an incoming record; the underlying crypto error is wrapped with %w. Marked temporary because a stray/corrupt record need not kill the connection — pion's DTLS stack drops and moves on.

Solutions

1. Let the DTLS layer drop the record; treat as transient unless frequent
2. If persistent: keys are out of sync — restart the DTLS handshake/session
3. Check MTU/fragmentation issues corrupting records in transit

When it happens

Trigger: Thrown at pkg/tutk/dtls/cipher.go:28 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of AlexxIT/go2rtc@c245815e75 (2026-09-07). Data as JSON: /api/errors/1a619c20e37f92f6. Report an issue: GitHub.

Appendix: source

Thrown at pkg/tutk/dtls/cipher.go:28

	"sync/atomic"

	"github.com/pion/dtls/v3"
	"github.com/pion/dtls/v3/pkg/crypto/clientcertificate"
	"github.com/pion/dtls/v3/pkg/crypto/prf"
	"github.com/pion/dtls/v3/pkg/protocol"
	"github.com/pion/dtls/v3/pkg/protocol/recordlayer"
	"golang.org/x/crypto/chacha20poly1305"
)

const CipherSuiteID_CCAC dtls.CipherSuiteID = 0xCCAC

const (
	chachaTagLength   = 16
	chachaNonceLength = 12
)

var (
	errDecryptPacket      = &protocol.TemporaryError{Err: errors.New("failed to decrypt packet")}
	errCipherSuiteNotInit = &protocol.TemporaryError{Err: errors.New("CipherSuite not initialized")}
)

type ChaCha20Poly1305Cipher struct {
	localCipher, remoteCipher   cipher.AEAD
	localWriteIV, remoteWriteIV []byte
}

func NewChaCha20Poly1305Cipher(localKey, localWriteIV, remoteKey, remoteWriteIV []byte) (*ChaCha20Poly1305Cipher, error) {
	localCipher, err := chacha20poly1305.New(localKey)
	if err != nil {
		return nil, err
	}

	remoteCipher, err := chacha20poly1305.New(remoteKey)
	if err != nil {
		return nil, err
	}

View on GitHub (pinned to c245815e75)