{"record":{"id":"227c505b1c0e6640","repo":"caddyserver/caddy","slug":"invalid-aead-id-d","errorCode":null,"errorMessage":"invalid AEAD ID: %d","messagePattern":"invalid AEAD ID: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"modules/caddytls/ech.go","lineNumber":1016,"sourceCode":"\n\tvar err error\n\tif echCfg.PublicKey, err = echCfg.KEMID.Scheme().UnmarshalBinaryPublicKey(pk); err != nil {\n\t\treturn fmt.Errorf(\"parsing public_key: %w\", err)\n\t}\n\n\techCfg.CipherSuites = echCfg.CipherSuites[:0]\n\n\tfor !t.Empty() {\n\t\tvar hpkeKDF, hpkeAEAD uint16\n\t\tif !t.ReadUint16(&hpkeKDF) || !t.ReadUint16(&hpkeAEAD) {\n\t\t\t// we have already checked that the length is divisible by 4\n\t\t\tpanic(\"this must not happen\")\n\t\t}\n\t\tif !hpke.KDF(hpkeKDF).IsValid() {\n\t\t\treturn fmt.Errorf(\"invalid KDF ID: %d\", hpkeKDF)\n\t\t}\n\t\tif !hpke.AEAD(hpkeAEAD).IsValid() {\n\t\t\treturn fmt.Errorf(\"invalid AEAD ID: %d\", hpkeAEAD)\n\t\t}\n\t\techCfg.CipherSuites = append(echCfg.CipherSuites, hpkeSymmetricCipherSuite{\n\t\t\tKDFID:  hpke.KDF(hpkeKDF),\n\t\t\tAEADID: hpke.AEAD(hpkeAEAD),\n\t\t})\n\t}\n\n\tvar rawPublicName []byte\n\tif !content.ReadUint8(&echCfg.MaxNameLength) ||\n\t\t!content.ReadUint8LengthPrefixed(&t) ||\n\t\t!t.ReadBytes(&rawPublicName, len(t)) ||\n\t\t!content.ReadUint16LengthPrefixed(&t) ||\n\t\t!t.ReadBytes(&echCfg.RawExtensions, len(t)) ||\n\t\t!content.Empty() {\n\t\treturn errInvalidLen\n\t}\n\techCfg.RawPublicName = string(rawPublicName)\n","sourceCodeStart":998,"sourceCodeEnd":1034,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/modules/caddytls/ech.go#L998-L1034","documentation":"Twin of the KDF check: each AEAD ID in the cipher-suite list is validated with hpke.AEAD(id).IsValid(). Caddy generates AES128GCM (0x0001) and ChaCha20Poly1305 (0x0003); any other value (or garbage) in a stored config fails with the numeric ID in the message.","triggerScenarios":"Decoding an ECH config whose AEAD list contains IDs not registered in the hpke package — corruption or configs authored by other stacks using AES256GCM-only/other AEADs depending on hpke's registry.","commonSituations":"Corrupt ech/configs entries; imported ECH config blobs with unsupported AEAD sets; hpke version differences across Caddy builds.","solutions":["Delete the affected stored ECH configs so Caddy re-creates them with AES128GCM + ChaCha20Poly1305.","Restrict imported configs to those two AEADs.","Update Caddy if the AEAD is legitimately supported in newer hpke."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"invalid AEAD ID\") {\n    // prune stored configs; regenerate with AES128GCM/ChaCha20Poly1305 suites\n}","preventionTips":["Regenerate ECH configs after any cross-version storage reuse.","Validate imported blobs decode cleanly in a scratch environment first."],"tags":["tls","ech","crypto","hpke","serialization"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}