XTLS/Xray-core · critical

encrypt shared secret: %w

Error message

encrypt shared secret: %w

What it means

rsa.EncryptPKCS1v15 failed when encrypting the 16-byte shared secret with the server's RSA public key. With a 16-byte input this can only overflow for keys smaller than ~360 bits (PKCS#1v15 overhead is 11 bytes plus input length must be <= k-11). The other cause is the random source erroring, which shares the same rarity as error 862.

Source

Thrown at transport/internet/finalmask/xmc/client.go:162

	k, err := x509.ParsePKIXPublicKey(publicKey)
	if err != nil {
		return fmt.Errorf("parse server public key: %w", err)
	}

	rsaPublicKey, ok := k.(*rsa.PublicKey)
	if !ok {
		return fmt.Errorf("parse server public key: not rsa")
	}

	sharedSecret := make([]byte, 16)
	if _, err = rand.Read(sharedSecret); err != nil {
		return fmt.Errorf("generate shared secret: %w", err)
	}

	encryptedSharedSecret, err := rsa.EncryptPKCS1v15(rand.Reader, rsaPublicKey, sharedSecret)
	if err != nil {
		return fmt.Errorf("encrypt shared secret: %w", err)
	}

	verifyToken = append(verifyToken, []byte(c.password)...) // append pre-shared password

	encryptedVerifyToken, err := rsa.EncryptPKCS1v15(rand.Reader, rsaPublicKey, verifyToken)
	if err != nil {
		return fmt.Errorf("encrypt verify token: %w", err)
	}

	// Send Encryption Response
	err = writePacket(
		c.writer,
		0x01,
		(*Bytes)(&encryptedSharedSecret),
		(*Bytes)(&encryptedVerifyToken),
	)
	if err != nil {
		return fmt.Errorf("write encryption response: %w", err)

View on GitHub (pinned to 7d214f8b09)

Solutions

1. Use a standard RSA key size: 2048 or 3072 bits on both ends
2. Confirm the DER blob actually decodes to the intended key (pair with errors 860/861 fixes)
3. Check the environment's CSPRNG availability if the wrapped error mentions the random source

Example fix

// before
priv, _ := rsa.GenerateKey(rand.Reader, 256) // toy key: k-11=21 < 16? no, but verifyToken append later overflows

// after
priv, _ := rsa.GenerateKey(rand.Reader, 2048)

k, _ := x509.ParsePKIXPublicKey(cfg.RsaPublicKey)
rpk, _ := k.(*rsa.PublicKey)
if rpk == nil || rpk.N.BitLen() < 2048 {
    return errors.New("server RSA key must be >= 2048 bits")
}

When it happens

Trigger: The server key in Config.RsaPublicKey is a very small RSA key (e.g. 512-bit gives k=64, still fits 16 bytes; a 128–256-bit toy key does not), or rand.Reader failed mid-handshake during the first Read/Write on the wrapped connection.

Common situations: Test fixtures or examples that used 512/1024-bit keys usually still work; hand-rolled 'quick demo' keys below 360 bits fail. Entropy failures come from sandboxed runtimes blocking getrandom.

Related errors

• encrypt verify token: %w
• parse server public key: %w
• parse server public key: not rsa
• failed to compute mod inverse
• Failed to build REALITY config.

AI-assisted analysis of XTLS/Xray-core@7d214f8b09 (2026-08-15). Data as JSON: /api/errors/51d9b663ee385e97. Report an issue: GitHub.