OpenNHP/opennhp · error

failed to create SM4-GCM

Error message

failed to create SM4-GCM: %w

What it means

AeadFromKey wraps cipher.NewGCM(sm4Block) failure as this message. As with AES, cipher.NewGCM only errors when the underlying block size is not 16 bytes; gmsm's SM4 block cipher always uses a 16-byte block, making this error practically unreachable and purely defensive. It would indicate a non-conforming SM4 implementation in the dependency graph.

Solutions

  1. Run 'go mod verify' and restore the canonical github.com/emmansun/gmsm dependency
  2. Check go.mod replace directives for gmsm forks
  3. Log the wrapped error from the %w chain for the underlying message
  4. Rebuild with a current Go toolchain and rerun the core cipher tests
Defensive patterns

Strategy: try-catch

Validate before calling

block, err := sm4.NewCipher(key[:16])
if err == nil && block.BlockSize() != 16 {
    return fmt.Errorf("unexpected SM4 block size %d", block.BlockSize())
}

Try / catch

aead, err := core.AeadFromKey(core.GCM_SM4, &key)
if err != nil {
    return fmt.Errorf("SM4-GCM init failed: %w", err)
}

Prevention

When it happens

Trigger: cipher.NewGCM receiving an SM4 block cipher whose BlockSize() != 16 — only feasible with a modified/forked emmansun/gmsm package.

Common situations: Forked or vendored gmsm libraries, corrupted modules, or custom builds replacing the SM4 implementation. Not expected in standard OpenNHP deployments.

Understand the failure class

Background: "This is a bug, please report it": internal invariant violations, unreachable panics, and SNH errors explained — this error's family across 47 libraries.

Related errors

AI-assisted analysis of OpenNHP/opennhp@6e04ca5ff0 (2026-09-07). Data as JSON: /api/errors/6c17c637dd445e5d. Report an issue: GitHub.

Appendix: source

Thrown at nhp/core/crypto.go:171

	case GCM_AES256:
		aesBlock, err := aes.NewCipher(key[:])
		if err != nil {
			return nil, fmt.Errorf("failed to create AES cipher: %w", err)
		}
		aead, err := cipher.NewGCM(aesBlock)
		if err != nil {
			return nil, fmt.Errorf("failed to create AES-GCM: %w", err)
		}
		return aead, nil

	case GCM_SM4:
		sm4Block, err := sm4.NewCipher(key[:16])
		if err != nil {
			return nil, fmt.Errorf("failed to create SM4 cipher: %w", err)
		}
		aead, err := cipher.NewGCM(sm4Block)
		if err != nil {
			return nil, fmt.Errorf("failed to create SM4-GCM: %w", err)
		}
		return aead, nil

	case GCM_CHACHA20POLY1305:
		aead, err := chacha20poly1305.New(key[:])
		if err != nil {
			return nil, fmt.Errorf("failed to create ChaCha20-Poly1305: %w", err)
		}
		return aead, nil

	default:
		return nil, fmt.Errorf("unsupported GCM type: %d", t)
	}
}

func CBCEncryption(t GcmTypeEnum, key *[SymmetricKeySize]byte, plaintext []byte, inPlace bool) ([]byte, error) {
	var block cipher.Block
	var iv []byte

View on GitHub (pinned to 6e04ca5ff0)