OpenNHP/opennhp · error

failed to create chain hash

Error message

failed to create chain hash: %w

What it means

createPacketParserData initializes the Noise chain hash (ChainHash0) via NewHash using the cipher suite's hash type, and this construction failed. Like the init-hash errors, with the stock BLAKE2s/SM3 implementations this indicates the CipherSuite carries an invalid HashType or the crypto backend failed, not a problem with the incoming packet.

Solutions

1. Confirm NewCipherSuite supports the scheme in the packet header; log ppd.Ciphers.HashType when this fires.
2. Pin/rebuild against a known-good version of the crypto dependency providing SM3/BLAKE2s.
3. Add a startup test that instantiates NewHash for every supported scheme so backend regressions surface at boot.
4. If a new scheme was added, implement its HashType in NewHash before accepting packets stamped with it.

Example fix

// before
ciphers := core.NewCipherSchemeUnknown(7) // no hash registered
ppd, err := d.CreatePacketParserData(pd) // failed to create chain hash
// after
ciphers := core.NewCipherSuite(common.CIPHER_SCHEME_CURVE)
ppd, err := d.CreatePacketParserData(pd)

// boot-time self test
for _, scheme := range []int{common.CIPHER_SCHEME_CURVE, common.CIPHER_SCHEME_GMSM} {
	if _, err := core.NewHash(core.NewCipherSuite(scheme).HashType); err != nil {
		log.Fatalf("hash backend broken for scheme %d: %v", scheme, err)
	}
}

ppd.chainHash, err = NewHash(ppd.Ciphers.HashType)
if err != nil {
	log.Error("chain hash init failed hashType=%d scheme=%d: %v", ppd.Ciphers.HashType, ppd.CipherScheme, err)
	return nil, fmt.Errorf("failed to create chain hash: %w", err)
}

When it happens

Trigger: PacketToMsg/parseRKNOnServer processing a packet whose header CipherScheme mapped (via NewCipherSuite) to a HashType the hash factory cannot instantiate; a broken crypto backend after a dependency upgrade.

Common situations: Custom builds with a modified hash registry; CipherSuite corruption; dependency upgrade removing/renaming a hash implementation; effectively unreachable with unmodified opennhp builds.

Related errors

• extractInitiatorStaticPubKey: init hash
• failed to create HMAC hash
• invalid input key
• missing remote peer public key
• extractInitiatorStaticPubKey: aead

AI-assisted analysis of OpenNHP/opennhp@6e04ca5ff0 (2026-09-07). Data as JSON: /api/errors/3e1cecbe27e07d0a. Report an issue: GitHub.

Appendix: source

Thrown at nhp/core/responder.go:301

		ppd.ConnCookieStore = pd.ConnCookieStore
		ppd.LocalInitTime = pd.InitTime
		ppd.ConnLastRemoteSendTime = pd.ConnLastRemoteSendTime
		ppd.ConnPeerPublicKey = pd.ConnPeerPublicKey
		ppd.decryptedMsgCh = pd.DecryptedMsgCh

		// init header and init device ecdh
		ppd.HeaderFlag = ppd.basePacket.Flag()
		ppd.header = ppd.basePacket.Header()
		ppd.CipherScheme = ppd.header.CipherScheme()
		log.Info("start decryption using CIPHER_SCHEME_%d(0: CURVE; 1: GMSM.)", ppd.CipherScheme)
		ppd.Ciphers = NewCipherSuite(ppd.CipherScheme)
		ppd.deviceEcdh = d.GetEcdhByCipherScheme(ppd.CipherScheme)
	}

	// init chain hash -> ChainHash0
	ppd.chainHash, err = NewHash(ppd.Ciphers.HashType)
	if err != nil {
		return nil, fmt.Errorf("failed to create chain hash: %w", err)
	}
	ppd.chainHash.Write([]byte(InitialHashString))

	// init chain key -> ChainKey0
	ppd.noise.HashType = ppd.Ciphers.HashType
	ppd.noise.MixKey(&ppd.chainKey, ppd.chainHash.Sum(nil), []byte(InitialChainKeyString))

	ppd.HeaderType, ppd.BodySize = ppd.header.TypeAndPayloadSize()

	// init hmac hash -> HmacHash0
	ppd.hmacHash, err = NewHash(ppd.Ciphers.HashType)
	if err != nil {
		return nil, fmt.Errorf("failed to create HMAC hash: %w", err)
	}
	ppd.hmacHash.Write([]byte(InitialHashString))

	// evolve hmac hash HmacHash0 -> HmacHash1
	ppd.hmacHash.Write(ppd.deviceEcdh.PublicKey())

View on GitHub (pinned to 6e04ca5ff0)