XTLS/Xray-core · error

derive minecraft rsa key: %w

Error message

derive minecraft rsa key: %w

What it means

XMC.Build calls xmc.DeriveRSAKey(c.Password) to stretch the shared password into an RSA private key; this error wraps any failure inside that derivation routine. It is an internal crypto/strecthing failure, not a config-syntax problem.

Source

Thrown at infra/conf/transport_finalmask.go:772

		Username:          c.Username,
		Uuid:              append([]byte(nil), profileUUID[:]...),
		TexturesValue:     c.TexturesValue,
		TexturesSignature: c.TexturesSignature,
	}, nil
}

func (c *XMC) Build() (proto.Message, error) {
	if len(c.Profiles) == 0 {
		return nil, fmt.Errorf("minecraft profiles are required")
	}

	if c.Password == "" {
		return nil, fmt.Errorf("empty password")
	}

	rsaPrivateKey, err := xmc.DeriveRSAKey(c.Password)
	if err != nil {
		return nil, fmt.Errorf("derive minecraft rsa key: %w", err)
	}

	rsaPublicKey, err := x509.MarshalPKIXPublicKey(&rsaPrivateKey.PublicKey)
	if err != nil {
		return nil, fmt.Errorf("marshal minecraft rsa public key: %w", err)
	}

	profiles := make([]*xmc.Profile, 0, len(c.Profiles))
	for i := range c.Profiles {
		profile, err := c.Profiles[i].Build()
		if err != nil {
			return nil, fmt.Errorf("build minecraft profile %d: %w", i, err)
		}
		profiles = append(profiles, profile)
	}

	return &xmc.Config{
		Password:      c.Password,

View on GitHub (pinned to 7d214f8b09)

Solutions

1. Read the wrapped %w error to see which step of derivation failed
2. Retry with a normal printable-ASCII password of moderate length
3. Align client and server on the same xray-core version so DeriveRSAKey behaves identically
4. If it persists on current versions, report upstream with the (non-secret) password shape

if _, err := xmcConfig.Build(); err != nil {
    if strings.Contains(err.Error(), "derive minecraft rsa key") {
        // internal derivation failure: change password material and retry once, then surface
        return fmt.Errorf("xmc key derivation failed (likely version skew or bad password shape): %w", err)
    }
    return err
}

When it happens

Trigger: A non-empty password that the derivation routine still rejects (e.g. parameters unsuitable for the stretch function). In practice extremely rare; most XMC password problems surface earlier as the empty-password check.

Common situations: Version skew between client and server xray builds where DeriveRSAKey's parameter validation changed; pathological password values (extremely long, or containing only whitespace/NUL) if the routine validates input.

Related errors

• marshal minecraft rsa public key: %w
• invalid minecraft profile username: %q
• invalid minecraft profile UUID: %w
• incomplete minecraft profile textures
• minecraft profiles are required

AI-assisted analysis of XTLS/Xray-core@7d214f8b09 (2026-08-15). Data as JSON: /api/errors/b267f40214ed592e. Report an issue: GitHub.