XTLS/Xray-core · error

unknown cipher method:

Error message

unknown cipher method: 

What it means

In the single-user classic Shadowsocks inbound builder, the method string is mapped through cipherFromString; if the result is CipherType_UNKNOWN the method is not a recognized classic cipher. Unlike the users-array variant, this triggers for any unrecognized string, including empty.

Source

Thrown at infra/conf/shadowsocks.go:101

					Level:   uint32(user.Level),
					Account: serial.ToTypedMessage(account),
				}
				return nil
			}
			if err := task.ParallelForN(len(v.Users), processUser); err != nil {
				return nil, err
			}
		}
	} else {
		account := &shadowsocks.Account{
			Password:   v.Password,
			CipherType: cipherFromString(v.Cipher),
		}
		if account.Password == "" {
			return nil, errors.New("Shadowsocks password is not specified.")
		}
		if account.CipherType == shadowsocks.CipherType_UNKNOWN {
			return nil, errors.New("unknown cipher method: ", v.Cipher)
		}
		config.Users = append(config.Users, &protocol.User{
			Email:   v.Email,
			Level:   uint32(v.Level),
			Account: serial.ToTypedMessage(account),
		})
	}

	return config, nil
}

func buildShadowsocks2022(v *ShadowsocksServerConfig) (proto.Message, error) {
	if len(v.Users) == 0 {
		config := new(shadowsocks_2022.ServerConfig)
		config.Method = v.Cipher
		config.Key = v.Password
		config.Network = v.NetworkList.Build()
		config.Email = v.Email

View on GitHub (pinned to 7d214f8b09)

Solutions

1. Set 'method' to a supported AEAD cipher: aes-128-gcm, aes-256-gcm, chacha20-poly1305, or xchacha20-poly1305.
2. For 2022 methods (2022-blake3-*), use the Shadowsocks-2022 configuration shape supported by the server builder instead.
3. Double-check spelling and exact casing of the method string.

Example fix

// before
"settings": {"password": "my-secret", "method": "aes-128-gmc"}

// after
"settings": {"password": "my-secret", "method": "aes-128-gcm"}

func validSSMethod(m string) bool {
    switch m {
    case "aes-128-gcm", "aes-256-gcm", "chacha20-poly1305", "xchacha20-poly1305":
        return true
    }
    return false
}

When it happens

Trigger: A single-user inbound with 'method' missing, empty, misspelled ("aes-128-gmc"), a 2022 method, or a legacy stream cipher — anything that does not map to the supported AEAD set.

Common situations: Omitting method assuming a default exists; pasting a Shadowsocks-2022 method into a classic inbound; case or separator typos in the method name.

Related errors

• Shadowsocks password is not specified.
• unsupported cipher method:
• Unsupported cipher.
• failed to get cipher
• shadowsocks 2022 (multi-user): missing server method

AI-assisted analysis of XTLS/Xray-core@7d214f8b09 (2026-08-15). Data as JSON: /api/errors/abf0bd19128d4712. Report an issue: GitHub.