OpenNHP/opennhp · error

failed to read hsk_cek data

Error message

failed to read hsk_cek data: %v

What it means

After a 200 response, verifyCertChain reads the full hsk_cek certificate blob from the response body with io.ReadAll. This error wraps any failure while consuming the body stream (connection reset mid-transfer, premature EOF, decompression/timeout errors). The cached download of the CEK therefore never completes.

Solutions

1. Retry the download; the failure is typically transient network interruption.
2. Use an http.Client with a sane Timeout and enable retries with backoff around io.ReadAll.
3. Pre-seed the hskCek cache with the CEK blob for known chipIds so attestation never depends on the network.
4. Check proxy/MTU/firewall issues if resets are persistent.

Example fix

// before
hskCekData, err := io.ReadAll(resp.Body)
if err != nil {
    return fmt.Errorf("failed to read hsk_cek data: %v", err)
}
// after
hskCekData, err := io.ReadAll(resp.Body)
if err != nil {
    if retriable(err) && attempts < 3 {
        goto retry // or return a sentinel so the caller retries the whole fetch
    }
    return fmt.Errorf("failed to read hsk_cek data: %v", err)
}

// No meaningful pre-check; instead ensure the download completes before attestation:
cek, err := fetchHskCek(chipId) // run ahead of Verify
if err != nil || len(cek) < 0x680 {
    return fmt.Errorf("prefetch of hsk_cek incomplete for %s", chipId)
}

if err := attestation.Verify(ctx, evidence); err != nil {
    if strings.Contains(err.Error(), "failed to read hsk_cek data") || errors.Is(err, io.ErrUnexpectedEOF) {
        // transient stream failure: retry the whole verification with backoff
    }
}

When it happens

Trigger: Calling Verify on CSV evidence requiring a live fetch when the TLS connection to cert.hygon.cn is interrupted before the body finishes downloading, the server closes the connection early, or a client-side timeout fires mid-body.

Common situations: Flaky mobile/VPN networks; Hygon CA closing idle or long transfers; middleboxes/proxies terminating large responses; extremely slow egress to the China-hosted endpoint causing timeouts.

Related errors

• could not read response body
• failed to download HRK
• failed to read HRK data
• failed to download hsk_cek
• http request failed

AI-assisted analysis of OpenNHP/opennhp@6e04ca5ff0 (2026-09-07). Data as JSON: /api/errors/49ed56242e8b8d10. Report an issue: GitHub.

Appendix: source

Thrown at nhp/core/verifier/csv/csv.go:351

		a.hrk[0xd6:0xd6+hrkIdLen], a.hrk[:0x240],
	); err != nil {
		return err
	}

	if _, ok := a.hskCek[chipId]; !ok {
		resp, err := http.Get(fmt.Sprintf("https://cert.hygon.cn/hsk_cek?snumber=%s", chipId))
		if err != nil {
			return fmt.Errorf("failed to download hsk_cek: %v", err)
		}
		defer resp.Body.Close()

		if resp.StatusCode != http.StatusOK {
			return fmt.Errorf("unexpected status code when download hsk_cek: %d", resp.StatusCode)
		}

		hskCekData, err := io.ReadAll(resp.Body)
		if err != nil {
			return fmt.Errorf("failed to read hsk_cek data: %v", err)
		}

		a.hskCek[chipId] = hskCekData
	}

	hskData := a.hskCek[chipId][:0x340]
	cekData := a.hskCek[chipId][0x340:]

	// verify hsk cert info
	if err := a.verifyHygonCertInfo(hskData, 0x03, 0x13, a.hrk[0x04:0x14]); err != nil {
		return err
	}

	// verify hsk cert signature (self-signed)
	if err := a.verifySm2SignatureWithId(
		a.hrk[0x44:0x64], a.hrk[0x8c:0xac],
		a.hskCek[chipId][0x240:0x260], a.hskCek[chipId][0x288:0x2a8],
		a.hrk[0xd6:0xd6+hrkIdLen], a.hskCek[chipId][:0x240],

View on GitHub (pinned to 6e04ca5ff0)