XTLS/Xray-core · error

new crypto writer: %w

Error message

new crypto writer: %w

What it means

Constructing the AES-CFB crypto writer failed in newCryptoWriter, symmetric to error 866. It initializes the outbound cipher from the same fixed 16-byte sharedSecret, so aes.NewCipher cannot fail and this branch is defensive dead code under current upstream sources.

Source

Thrown at transport/internet/finalmask/xmc/client.go:191

	err = writePacket(
		c.writer,
		0x01,
		(*Bytes)(&encryptedSharedSecret),
		(*Bytes)(&encryptedVerifyToken),
	)
	if err != nil {
		return fmt.Errorf("write encryption response: %w", err)
	}

	// Enable encryption
	c.reader, err = newCryptoReader(c.reader, sharedSecret)
	if err != nil {
		return fmt.Errorf("new crypto reader: %w", err)
	}

	c.writer, err = newCryptoWriter(c.writer, sharedSecret)
	if err != nil {
		return fmt.Errorf("new crypto writer: %w", err)
	}

	pkt, err = readPacket(c.reader)
	if err != nil {
		return fmt.Errorf("read login finished: %w", err)
	}
	if pkt.packetID == 0x00 {
		var reason String
		if readErr := pkt.readFields(&reason); readErr != nil {
			return fmt.Errorf("authentication rejected")
		}
		return fmt.Errorf("authentication rejected: %s", reason)
	}
	if pkt.packetID != 0x02 {
		return fmt.Errorf("bad login finished packet id: %d", pkt.packetID)
	}

	receivedProfile, err := readLoginSuccess(pkt)

View on GitHub (pinned to 7d214f8b09)

Solutions

1. Verify the 16-byte shared secret is untouched in your build
2. Compare your crypto.go with upstream
3. File an upstream issue with a reproducer if it occurs on stock code

if _, err := conn.Write(buf); err != nil && strings.Contains(err.Error(), "new crypto writer") {
    log.Error("unexpected crypto init failure", "err", err)
    return err // no retry: deterministic init failure
}

When it happens

Trigger: First Write after the Encryption Response; only fires if the shared secret length was changed away from 16 bytes or newCryptoWriter's internals were modified in a fork.

Common situations: Not observed in practice; would indicate a customized build.

Related errors

• new crypto reader: %w
• outbound metadata not found
• Failed to build REALITY config.
• parse server public key: %w
• parse server public key: not rsa

AI-assisted analysis of XTLS/Xray-core@7d214f8b09 (2026-08-15). Data as JSON: /api/errors/da6bcfd949ef5f04. Report an issue: GitHub.