XTLS/Xray-core · error

read encryption request: %w

Error message

read encryption request: %w

What it means

Wraps a readPacket failure while waiting for the server's Encryption Request during the login handshake. The %w chains the underlying reader error: EOF (server closed without responding), i/o timeout (handshake deadline expired), or a framing error if the peer's bytes are not Minecraft varint-framed packets.

Source

Thrown at transport/internet/finalmask/xmc/client.go:123

	}

	// Login Start
	randomProfile, err := rand.Int(rand.Reader, big.NewInt(int64(len(c.profiles))))
	if err != nil {
		return fmt.Errorf("select profile: %w", err)
	}
	selectedProfile := c.profiles[randomProfile.Int64()]
	username := String(selectedProfile.Username)

	err = writePacket(c.writer, 0x00, &username, &selectedProfile.UUID)
	if err != nil {
		return fmt.Errorf("write login start: %w", err)
	}

	// Encryption Request
	pkt, err := readPacket(c.reader)
	if err != nil {
		return fmt.Errorf("read encryption request: %w", err)
	}

	if pkt.packetID != 0x01 {
		return fmt.Errorf("bad encrypt request packet id")
	}

	var (
		serverId    String
		publicKey   Bytes
		verifyToken Bytes
	)

	err = pkt.readFields(&serverId, &publicKey, &verifyToken)
	if err != nil {
		return fmt.Errorf("read encryption request fields: %w", err)
	}

	if !bytes.Equal(publicKey, c.rsaPublicKey) {

View on GitHub (pinned to 7d214f8b09)

Solutions

1. Verify the port serves the Minecraft login protocol and that encryption (online-mode style) is expected.
2. Unwrap to check for EOF vs. timeout: EOF means the server hung up, timeout means it stayed silent.
3. Test the same host/port with a real Minecraft client to confirm the server behaves as expected.

if err := cc.Handshake(); err != nil {
	var opErr *net.OpError
	if errors.As(err, &opErr) && errors.Is(opErr.Err, os.ErrDeadlineExceeded) {
		return fmt.Errorf("server silent after Login Start (wrong port or no encryption?): %w", err)
	}
	if errors.Is(err, io.EOF) || errors.Is(err, io.ErrUnexpectedEOF) {
		return fmt.Errorf("server closed during login: %w", err)
	}
	return err
}

When it happens

Trigger: The server accepting TCP but never sending an Encryption Request: wrong service on the port, a vanilla server with online-mode off that skips encryption, or a non-Minecraft target. Also triggered when the read deadline from beginHandshake elapses first.

Common situations: Pointing the transport at a plain HTTP/TLS/proxy port instead of the Minecraft port; server requiring a different login flow; slow servers that exceed the handshake deadline.

Related errors

• write handshake packet: %w
• write login start: %w
• bad encrypt request packet id
• failed to create unexpected ip matcher
• set deadline: %w

AI-assisted analysis of XTLS/Xray-core@7d214f8b09 (2026-08-15). Data as JSON: /api/errors/ed155caa13b50a84. Report an issue: GitHub.