{"record":{"id":"05944a18dbb9dd65","repo":"OpenNHP/opennhp","slug":"unsupported-cipher-type-for-cbc-decryption-d","errorCode":null,"errorMessage":"unsupported cipher type for CBC decryption: %d","messagePattern":"unsupported cipher type for CBC decryption: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nhp/core/crypto.go","lineNumber":259,"sourceCode":"\tcase GCM_AES256:\n\t\tblock, err = aes.NewCipher(key[:])\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to create AES cipher for CBC decryption: %w\", err)\n\t\t}\n\t\tiv = key[8:24]\n\n\tcase GCM_SM4:\n\t\tblock, err = sm4.NewCipher(key[:16])\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to create SM4 cipher for CBC decryption: %w\", err)\n\t\t}\n\t\tiv = key[16:]\n\n\tcase GCM_CHACHA20POLY1305:\n\t\treturn nil, ErrNotApplicable\n\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"unsupported cipher type for CBC decryption: %d\", t)\n\t}\n\n\t// Validate ciphertext: must be at least one block and a multiple of block size\n\tif len(ciphertext) < block.BlockSize() {\n\t\treturn nil, fmt.Errorf(\"ciphertext too short: need at least %d bytes\", block.BlockSize())\n\t}\n\tif len(ciphertext)%block.BlockSize() != 0 {\n\t\treturn nil, fmt.Errorf(\"ciphertext length %d is not a multiple of block size %d\", len(ciphertext), block.BlockSize())\n\t}\n\n\tvar plaintext []byte\n\tif inPlace {\n\t\tplaintext = ciphertext\n\t} else {\n\t\tplaintext = make([]byte, len(ciphertext))\n\t}\n\n\tmode := cipher.NewCBCDecrypter(block, iv)","sourceCodeStart":241,"sourceCodeEnd":277,"githubUrl":"https://github.com/OpenNHP/opennhp/blob/6e04ca5ff03222a699c24205cd4bf8fee9af7ffe/nhp/core/crypto.go#L241-L277","documentation":"CBCDecryption's default branch rejects any GcmTypeEnum that is neither GCM_AES256, GCM_SM4, nor GCM_CHACHA20POLY1305 (which is rejected earlier as ErrNotApplicable). CBC is a block-cipher mode, so an unknown/invalid cipher-type integer cannot be mapped to a block cipher and decryption is refused.","triggerScenarios":"Calling CBCDecryption with a numeric cipher type that matches no case: zero-value enum, a type parsed from config or an untrusted packet field, or an enum value from a different/older version of the library.","commonSituations":"Cipher type serialized from a peer packet and deserialized incorrectly; config file with an out-of-range cipher index; version mismatch where the local GcmTypeEnum lacks a newer value sent by a peer.","solutions":["Print the numeric value in the error and map it back to a valid GcmTypeEnum constant before calling.","Whitelist/validate the cipher-type field at config or protocol-parse time to GCM_AES256/GCM_SM4.","Align library versions between peers so enum values agree.","If stream-cipher data, switch to the AEAD API (AeadFromKey) instead of CBC."],"exampleFix":"// before\nt := core.GcmTypeEnum(msg.CipherType) // unvalidated from wire\nplain, err := core.CBCDecryption(t, key, ct, false)\n// after\nif msg.CipherType != int(core.GCM_AES256) && msg.CipherType != int(core.GCM_SM4) {\n    return fmt.Errorf(\"peer sent unsupported cipher type %d\", msg.CipherType)\n}\nplain, err := core.CBCDecryption(core.GcmTypeEnum(msg.CipherType), key, ct, false)","handlingStrategy":"validation","validationCode":"switch core.GcmTypeEnum(wireType) {\ncase core.GCM_AES256, core.GCM_SM4:\n    // ok\ndefault:\n    return fmt.Errorf(\"refusing cipher type %d\", wireType)\n}","typeGuard":"func validCBCType(t core.GcmTypeEnum) bool { return t == core.GCM_AES256 || t == core.GCM_SM4 }","tryCatchPattern":"plain, err := core.CBCDecryption(t, key, ct, false)\nif err != nil {\n    var badType = t\n    return fmt.Errorf(\"unsupported cipher type %d from peer: %w\", badType, err)\n}","preventionTips":["Validate cipher-type integers from config and wire messages against the enum before use.","Keep library versions aligned across peers so enum values agree.","Reject unknown cipher types at protocol-parse time with a clear peer-facing error."],"tags":["go","crypto","cbc","enum"],"backgroundTag":"unsupported-enum-value","analyzedSha":"6e04ca5ff03222a699c24205cd4bf8fee9af7ffe","analyzedAt":"2026-09-07T15:44:59.941Z","contentChangedAt":"2026-09-07T15:44:59.941Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}