AlexxIT/go2rtc · error

hap: insecure PIN:

Error message

hap: insecure PIN: 

What it means

HAP SanitizePin security guard: the (well-formed) 8-digit PIN appears in the hardcoded insecurePINs blocklist from the HAP spec 4.2.1.2 — trivial codes like 00000000, 11111111, 12345678, 87654321. Spec-compliant accessories must reject them, so the client refuses them up front.

Solutions

1. Use the real setup code printed on the accessory or its QR tag
2. Re-generate pairing credentials if the accessory itself has a trivial code
3. Reject such PINs in configuration validation before attempting pairing

When it happens

Trigger: Thrown at pkg/hap/helpers.go:85 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of AlexxIT/go2rtc@c245815e75 (2026-09-07). Data as JSON: /api/errors/cb406b89731e04da. Report an issue: GitHub.

Appendix: source

Thrown at pkg/hap/helpers.go:85

type JSONCharacter struct {
	AID    uint8  `json:"aid"`
	IID    uint64 `json:"iid"`
	Status any    `json:"status,omitempty"`
	Value  any    `json:"value,omitempty"`
	Event  any    `json:"ev,omitempty"`
}

// 4.2.1.2 Invalid Setup Codes
const insecurePINs = "00000000 11111111 22222222 33333333 44444444 55555555 66666666 77777777 88888888 99999999 12345678 87654321"

func SanitizePin(pin string) (string, error) {
	s := strings.ReplaceAll(pin, "-", "")
	if len(s) != 8 {
		return "", errors.New("hap: wrong PIN format: " + pin)
	}
	if strings.Contains(insecurePINs, s) {
		return "", errors.New("hap: insecure PIN: " + pin)
	}
	// 123-45-678
	return s[:3] + "-" + s[3:5] + "-" + s[5:], nil
}

func GenerateKey() []byte {
	_, key, _ := ed25519.GenerateKey(nil)
	return key
}

func GenerateUUID() string {
	//12345678-9012-3456-7890-123456789012
	data := make([]byte, 16)
	_, _ = rand.Read(data)
	s := hex.EncodeToString(data)
	return s[:8] + "-" + s[8:12] + "-" + s[12:16] + "-" + s[16:20] + "-" + s[20:]
}

View on GitHub (pinned to c245815e75)