{"record":{"id":"116387549b4bf121","repo":"OpenNHP/opennhp","slug":"failed-to-write-hrk-data-to-sm3-v","errorCode":null,"errorMessage":"failed to write HRK data to SM3: %v","messagePattern":"failed to write HRK data to SM3: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"nhp/core/verifier/csv/csv.go","lineNumber":171,"sourceCode":"\t// 转换十六进制字符串为字节\n\tecKeyBytes, _ := hex.DecodeString(ecKeyHex)\n\tpubkeyBytes, _ := hex.DecodeString(pubkeyHex)\n\n\t// 拼接所有字节切片\n\tvar result []byte\n\tresult = append(result, firstByte)\n\tresult = append(result, secondByte)\n\tresult = append(result, id...)\n\tresult = append(result, ecKeyBytes...)\n\tresult = append(result, pubkeyBytes...)\n\n\treturn result\n}\n\nfunc Sm3Digest(hrkData []byte) ([]byte, error) {\n\thash := sm3.New()\n\tif _, err := hash.Write(hrkData); err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to write HRK data to SM3: %v\", err)\n\t}\n\tdigest := hash.Sum(nil)\n\treturn digest, nil\n}\n\nfunc Sm3Hmac(data []byte, key []byte) []byte {\n\t// Block size of SM3 is 64 bytes (as specified in GM/T 0004-2012)\n\tconst blockSize = 64\n\n\t// Ensure key is not longer than block size by hashing if necessary\n\tif len(key) > blockSize {\n\t\thash := sm3.Sum(key)\n\t\tkey = hash[:]\n\t}\n\n\t// Pad key to block size with zeros\n\tpaddedKey := make([]byte, blockSize)\n\tcopy(paddedKey, key)","sourceCodeStart":153,"sourceCodeEnd":189,"githubUrl":"https://github.com/OpenNHP/opennhp/blob/6e04ca5ff03222a699c24205cd4bf8fee9af7ffe/nhp/core/verifier/csv/csv.go#L153-L189","documentation":"Sm3Digest computes an SM3 hash of the input bytes using hash.Write. Per Go's hash.Hash contract, Write never returns an error, but this wrapper defensively propagates any hypothetical write failure as \"failed to write HRK data to SM3\". In practice this error is effectively unreachable; it exists to satisfy error-handling style and would only indicate a corrupted hasher state.","triggerScenarios":"Only if hash.Write on the sm3.New() hasher returns a non-nil error, which cannot happen for the golang.org/x/crypto/sm3 implementation regardless of input (even empty or nil data is fine). Called from verifySm2SignatureWithId and verifyCertChain during CSV attestation verification.","commonSituations":"Developers rarely see this in the field; encountering it would suggest a build with a patched/broken sm3 package or a panic-recovery misattribution. More common confusion: callers assuming empty hrkData triggers it — it does not, empty input hashes successfully.","solutions":["Treat the error as an internal invariant violation: if it occurs, verify the golang.org/x/crypto/sm3 dependency version is unmodified (go mod verify).","Call the exported wrapper normally — no input preprocessing is needed; empty or nil data is valid.","If you control the code, you could switch to sm3.Sum(data) which returns the digest without an error path, eliminating this branch.","Retry the attestation verification once; a transient memory/hash-state issue would clear, while a persistent failure indicates a broken dependency."],"exampleFix":"// before\ndigest, err := Sm3Digest(data)\nif err != nil {\n    return fmt.Errorf(\"attestation failed: %w\", err) // unreachable in practice\n}\n\n// after — bypass the error path entirely\ndigest := sm3.Sum(data)\n// digest is [32]byte; use digest[:] where []byte is needed","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"digest, err := Sm3Digest(data)\nif err != nil {\n    // Practically unreachable: hash.Hash.Write never errors.\n    return fmt.Errorf(\"sm3 digest failed (check golang.org/x/crypto/sm3 integrity): %w\", err)\n}","preventionTips":["No input validation is needed — empty or nil data is a valid SM3 input","Pin and verify golang.org/x/crypto version (go mod verify) so the sm3 package is unmodified","Prefer sm3.Sum(data) in new code to avoid the theoretical error path entirely"],"tags":["go","crypto","sm3","hash","unreachable"],"backgroundTag":"internal-invariant-violation","analyzedSha":"6e04ca5ff03222a699c24205cd4bf8fee9af7ffe","analyzedAt":"2026-09-07T15:44:59.941Z","contentChangedAt":"2026-09-07T15:44:59.941Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}