AlexxIT/go2rtc · error

hap: VerifyClientAuthenticator

Error message

hap: VerifyClientAuthenticator

What it means

Raised during HomeKit pair-setup M3 when the accessory fails to verify the client's authenticator: the proof in TLV field 4 of the M3 request does not match the value expected from the SRP-verified shared secret, so the pairing partner is deemed unauthenticated.

Solutions

1. Verify the SRP session state (verifier, salt, shared secret) is consistent across M1/M2/M3 of the same pairing attempt
2. Confirm the client proof was computed over the correct transcript (PublicKey of M3 included) with the same hash and key derivation as the server
3. Discard stale session state and restart pairing from M1 if the session was partially completed or reused

When it happens

Trigger: Thrown at pkg/hap/server.go:113 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of AlexxIT/go2rtc@c245815e75 (2026-09-07). Data as JSON: /api/errors/8472eceb2e78d108. Report an issue: GitHub.

Appendix: source

Thrown at pkg/hap/server.go:113

		PublicKey string `tlv8:"3"`
		Proof     string `tlv8:"4"`
	}
	if err = tlv8.UnmarshalReader(req.Body, req.ContentLength, &plainM3); err != nil {
		return
	}
	if plainM3.State != StateM3 {
		err = newRequestError(plainM3)
		return
	}

	// important to compute key before verify client
	sessionShared, err := session.ComputeKey([]byte(plainM3.PublicKey))
	if err != nil {
		return
	}

	if !session.VerifyClientAuthenticator([]byte(plainM3.Proof)) {
		err = errors.New("hap: VerifyClientAuthenticator")
		return
	}

	proof := session.ComputeAuthenticator([]byte(plainM3.Proof)) // server proof

	// STEP 4. Response to iPhone
	payloadM4 := struct {
		State byte   `tlv8:"6"`
		Proof string `tlv8:"4"`
	}{
		State: StateM4,
		Proof: string(proof),
	}
	if body, err = tlv8.Marshal(payloadM4); err != nil {
		return
	}
	if err = WriteResponse(rw.Writer, http.StatusOK, MimeTLV8, body); err != nil {
		return

View on GitHub (pinned to c245815e75)