XTLS/Xray-core · error

shadowsocks 2022 (multi-user): only blake3-aes-*-gcm methods

Error message

shadowsocks 2022 (multi-user): only blake3-aes-*-gcm methods are supported

What it means

In Shadowsocks-2022 multi-user mode, the implementation only supports blake3-aes-*-gcm methods because per-user keys are derived with BLAKE3 and the server key must be AES-based. If the server-level cipher string does not contain 'aes', this error is returned.

Source

Thrown at infra/conf/shadowsocks.go:127

	return config, nil
}

func buildShadowsocks2022(v *ShadowsocksServerConfig) (proto.Message, error) {
	if len(v.Users) == 0 {
		config := new(shadowsocks_2022.ServerConfig)
		config.Method = v.Cipher
		config.Key = v.Password
		config.Network = v.NetworkList.Build()
		config.Email = v.Email
		return config, nil
	}

	if v.Cipher == "" {
		return nil, errors.New("shadowsocks 2022 (multi-user): missing server method")
	}
	if !strings.Contains(v.Cipher, "aes") {
		return nil, errors.New("shadowsocks 2022 (multi-user): only blake3-aes-*-gcm methods are supported")
	}

	if v.Users[0].Address == nil {
		config := new(shadowsocks_2022.MultiUserServerConfig)
		config.Method = v.Cipher
		config.Key = v.Password
		config.Network = v.NetworkList.Build()

		config.Users = make([]*protocol.User, len(v.Users))
		processUser := func(idx int) error {
			user := v.Users[idx]
			if user.Cipher != "" {
				return errors.New("shadowsocks 2022 (multi-user): users must have empty method")
			}
			account := &shadowsocks_2022.Account{
				Key: user.Password,
			}
			config.Users[idx] = &protocol.User{

View on GitHub (pinned to 7d214f8b09)

Solutions

1. Use "2022-blake3-aes-128-gcm" or "2022-blake3-aes-256-gcm" as the multi-user server method.
2. Regenerate server and user keys as base64 of the correct length (16 or 32 bytes) for the chosen method.
3. If ChaCha is mandatory, run a classic Shadowsocks inbound instead (not 2022).

Example fix

// before
"method": "2022-blake3-chacha20-poly1305"

// after
"method": "2022-blake3-aes-256-gcm"

func validSS2022Method(m string) bool {
    return strings.Contains(m, "aes")
}

When it happens

Trigger: A 2022 inbound with users and a non-AES method such as "2022-blake3-chacha20-poly1305" at server level, or a classic cipher string like "chacha20-poly1305" in a 2022 config.

Common situations: Wanting ChaCha20-based 2022 (unsupported here); leaving the classic method name when upgrading to 2022 keys; following an external guide that assumes chacha support.

Related errors

• unsupported method ${method}
• unsupported cipher method:
• unknown cipher method:
• shadowsocks 2022 (multi-user): missing server method
• shadowsocks 2022 (multi-user): users must have empty method

AI-assisted analysis of XTLS/Xray-core@7d214f8b09 (2026-08-15). Data as JSON: /api/errors/f1d15e871b1ef1d1. Report an issue: GitHub.