AlexxIT/go2rtc · error

wrong timedelta

Error message

wrong timedelta %s

What it means

Returned by webtorrent NewCipher. The ciphertext embeds a timestamp; NewCipher computes the delta between that timestamp and now, and rejects anything whose absolute delta exceeds 12 hours. This replay-protection window tolerates server/client clock skew (including timezone differences) but refuses tokens that are too old or dated in the future.

Solutions

1. Sync the system clock (NTP) and verify the timezone is correct
2. Regenerate the token/input — do not reuse ciphertexts older than 12 hours
3. Check for clock skew between client and the WebTorrent server (compare `date -u` on both)
4. If legitimate long-lived tokens are needed, this library's 12h window is by design; issue fresh tokens instead
5. If skew is systemic in your fleet, deploy NTP/chrony across hosts

Example fix

// before
$ date
Thu Sep 7 03:12:00 UTC 2026  // clock is actually Sep 7 15:00 -> delta > 12h
// after
$ sudo ntpdate pool.ntp.org  # or enable systemd-timesyncd / chronyd
$ date
Mon Sep 7 14:59:58 UTC 2026  // within 12h window, NewCipher succeeds

// Go/shell: check clock sanity before cipher use
if drift := time.Since(lastNtpSync); drift > time.Hour { return errors.New("clock drift too large; sync NTP first") }

c, err := webtorrent.NewCipher(nonce, pwd, data)
if err != nil {
    if strings.Contains(err.Error(), "wrong timedelta") {
        return errors.New("stale token or clock skew — resync NTP and regenerate token")
    }
    return err
}

When it happens

Trigger: Creating a webtorrent Cipher via NewCipher (directly or through NewClient/reader) when the embedded timestamp in the input is more than 12 hours away from the local clock — either genuinely stale input or a badly skewed clock.

Common situations: Client machine clock drifted by hours (dead CMOS battery, wrong timezone/NTP); reusing a cached magnet/infohash token from a previous session; processing recorded/old WebTorrent data long after creation.

Related errors

• ErrInvalidParams
• ciphertext too short
• %w: %v
• : unable to encrypt
• : unable to decrypt

AI-assisted analysis of AlexxIT/go2rtc@c245815e75 (2026-09-07). Data as JSON: /api/errors/443f43b11b452873. Report an issue: GitHub.

Appendix: source

Thrown at pkg/webtorrent/crypto.go:32

	gcm   cipher.AEAD
	iv    []byte
	nonce []byte
}

func NewCipher(share, pwd, nonce string) (*Cipher, error) {
	timestamp, err := strconv.ParseInt(nonce, 36, 64)
	if err != nil {
		return nil, err
	}

	delta := time.Duration(time.Now().UnixNano() - timestamp)
	if delta < 0 {
		delta = -delta
	}

	// protect from replay attack, but respect wrong timezone on server
	if delta > 12*time.Hour {
		return nil, fmt.Errorf("wrong timedelta %s", delta)
	}

	c := &Cipher{}

	hash := sha256.New()
	hash.Write([]byte(nonce + ":" + pwd))
	key := hash.Sum(nil)

	hash.Reset()
	hash.Write([]byte(share + ":" + nonce))
	c.iv = hash.Sum(nil)[:12]

	block, err := aes.NewCipher(key)
	if err != nil {
		return nil, err
	}
	c.gcm, err = cipher.NewGCM(block)
	if err != nil {

View on GitHub (pinned to c245815e75)