XTLS/Xray-core · error

unsupported cipher method:

Error message

unsupported cipher method: 

What it means

In the multi-user Shadowsocks inbound builder, each user's cipher string is converted to a CipherType enum and must fall in the supported AEAD range [AES_128_GCM .. XCHACHA20_POLY1305]. If cipherFromString maps to a value outside that range, this error names the offending cipher string.

Source

Thrown at infra/conf/shadowsocks.go:79

	config := new(shadowsocks.ServerConfig)
	config.Network = v.NetworkList.Build()

	if v.Users != nil {
		if len(v.Users) > 0 {
			config.Users = make([]*protocol.User, len(v.Users))
			processUser := func(idx int) error {
				user := v.Users[idx]
				account := &shadowsocks.Account{
					Password:   user.Password,
					CipherType: cipherFromString(user.Cipher),
				}
				if account.Password == "" {
					return errors.New("Shadowsocks password is not specified.")
				}
				if account.CipherType < shadowsocks.CipherType_AES_128_GCM ||
					account.CipherType > shadowsocks.CipherType_XCHACHA20_POLY1305 {
					return errors.New("unsupported cipher method: ", user.Cipher)
				}
				config.Users[idx] = &protocol.User{
					Email:   user.Email,
					Level:   uint32(user.Level),
					Account: serial.ToTypedMessage(account),
				}
				return nil
			}
			if err := task.ParallelForN(len(v.Users), processUser); err != nil {
				return nil, err
			}
		}
	} else {
		account := &shadowsocks.Account{
			Password:   v.Password,
			CipherType: cipherFromString(v.Cipher),
		}
		if account.Password == "" {

View on GitHub (pinned to 7d214f8b09)

Solutions

1. Set each user's 'cipher' to one of: aes-128-gcm, aes-256-gcm, chacha20-poly1305, xchacha20-poly1305.
2. If you intended Shadowsocks-2022, move the whole inbound to the 2022-style config (password at server level, empty per-user method).
3. Regenerate keys/passwords sized for the chosen AEAD cipher if upgrading from legacy ciphers.

Example fix

// before
{"cipher": "aes-256-cfb", "password": "..."}

// after
{"cipher": "aes-256-gcm", "password": "..."}

var ssCiphers = map[string]bool{"aes-128-gcm": true, "aes-256-gcm": true, "chacha20-poly1305": true, "xchacha20-poly1305": true}

func validSSCipher(c string) bool { return ssCiphers[c] }

When it happens

Trigger: A users entry whose 'cipher' is a legacy stream cipher (e.g. "aes-256-cfb", "rc4-md5", "chacha20") or a 2022 method (e.g. "2022-blake3-aes-128-gcm") inside a classic multi-user Shadowsocks inbound.

Common situations: Migrating an old Shadowsocks config that used stream ciphers; putting a Shadowsocks-2022 method string in a non-2022 inbound; typo like "aes-128gcm".

Related errors

• unknown cipher method:
• Unsupported cipher.
• failed to get cipher
• Shadowsocks password is not specified.
• shadowsocks 2022 (multi-user): only blake3-aes-*-gcm methods

AI-assisted analysis of XTLS/Xray-core@7d214f8b09 (2026-08-15). Data as JSON: /api/errors/b5c08a64b3a21e16. Report an issue: GitHub.