What causes "unknown symmetric mode name: %s" in OpenNHP/opennhp?

Use an exact supported name, e.g. NewSymmetricCipherMode("AES-256-GCM-128") or NewSymmetricCipherMode("SM4-GCM-128")

unknown symmetric mode name

Error message

unknown symmetric mode name: %s

What it means

NewSymmetricCipherMode converts a cipher-suite name string (e.g. "AES-256-GCM-128", "SM4-GCM-64") into a SymmetricCipherMode tag. Any name not matching a known case hits the default branch and returns this error. It enforces the closed set of Noise symmetric ciphers supported by the ztdo package.

Solutions

Use an exact supported name, e.g. NewSymmetricCipherMode("AES-256-GCM-128") or NewSymmetricCipherMode("SM4-GCM-128")
Check spelling and case: the switch is case-sensitive and expects hyphenated names
Print the supported mode list and align your config/negotiation code with it

Example fix

// before
mode, err := NewSymmetricCipherMode("aes-256-gcm") // unknown name
// after
mode, err := NewSymmetricCipherMode("AES-256-GCM-128")

Defensive patterns

Strategy: validation

Validate before calling

supported := map[string]bool{"AES-256-GCM-64": true, "AES-256-GCM-96": true, "AES-256-GCM-104": true, "AES-256-GCM-112": true, "AES-256-GCM-120": true, "AES-256-GCM-128": true, "SM4-GCM-64": true, "SM4-GCM-128": true}
if !supported[modeName] { return fmt.Errorf("unsupported cipher mode %q", modeName) }

Try / catch

mode, err := NewSymmetricCipherMode(name)
if err != nil {
	// fall back to default suite
	mode, err = NewSymmetricCipherMode("AES-256-GCM-128")
}

Prevention

Use constants, not hand-typed strings, for cipher names
Validate cipher names at config load time
Remember the switch is exact-match and case-sensitive

When it happens

Trigger: Calling NewSymmetricCipherMode with a mode string other than the exact accepted names (AES-256-GCM-64/96/104/112/120/128, SM4-GCM-64, SM4-GCM-128) — typos, wrong case, or unsupported suite names (nhp/core/ztdo/noise.go:103).

Common situations: Config files specifying cipher names like "aes-256-gcm" (wrong case/format) or a newer/older protocol draft name not in this build; hand-written protocol negotiation tables.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

AI-assisted analysis of OpenNHP/opennhp@6e04ca5ff0 (2026-09-07). Data as JSON: /api/errors/e72842db7b82e9c4. Report an issue: GitHub.

Appendix: source

Thrown at nhp/core/ztdo/noise.go:103

	switch mode {
	case "AES-256-GCM-64":
		return AES256GCM64Tag, nil
	case "AES-256-GCM-96":
		return AES256GCM96Tag, nil
	case "AES-256-GCM-104":
		return AES256GCM104Tag, nil
	case "AES-256-GCM-112":
		return AES256GCM112Tag, nil
	case "AES-256-GCM-120":
		return AES256GCM120Tag, nil
	case "AES-256-GCM-128":
		return AES256GCM128Tag, nil
	case "SM4-GCM-64":
		return SM4GCM64Tag, nil
	case "SM4-GCM-128":
		return SM4GCM128Tag, nil
	default:
		return 0, fmt.Errorf("unknown symmetric mode name: %s", mode)
	}
}
func (mode SymmetricCipherMode) newCipherBlock(key []byte) (cipher.Block, error) {
	switch mode {
	case AES256GCM64Tag, AES256GCM96Tag, AES256GCM104Tag,
		AES256GCM112Tag, AES256GCM120Tag, AES256GCM128Tag:
		if len(key) != 32 {
			return nil, fmt.Errorf("invalid key length for AES-256-GCM")
		}
		return aes.NewCipher(key)
	case SM4GCM64Tag, SM4GCM128Tag:
		if len(key) < 16 {
			return nil, fmt.Errorf("invalid key length for SM4-GCM")
		} else {
			key = key[:16]
		}
		return sm4.NewCipher(key)
	default:

View on GitHub (pinned to 6e04ca5ff0)