{"record":{"id":"3e1cecbe27e07d0a","repo":"OpenNHP/opennhp","slug":"failed-to-create-chain-hash-w-3e1cec","errorCode":null,"errorMessage":"failed to create chain hash: %w","messagePattern":"failed to create chain hash: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nhp/core/responder.go","lineNumber":301,"sourceCode":"\t\tppd.ConnCookieStore = pd.ConnCookieStore\n\t\tppd.LocalInitTime = pd.InitTime\n\t\tppd.ConnLastRemoteSendTime = pd.ConnLastRemoteSendTime\n\t\tppd.ConnPeerPublicKey = pd.ConnPeerPublicKey\n\t\tppd.decryptedMsgCh = pd.DecryptedMsgCh\n\n\t\t// init header and init device ecdh\n\t\tppd.HeaderFlag = ppd.basePacket.Flag()\n\t\tppd.header = ppd.basePacket.Header()\n\t\tppd.CipherScheme = ppd.header.CipherScheme()\n\t\tlog.Info(\"start decryption using CIPHER_SCHEME_%d(0: CURVE; 1: GMSM.)\", ppd.CipherScheme)\n\t\tppd.Ciphers = NewCipherSuite(ppd.CipherScheme)\n\t\tppd.deviceEcdh = d.GetEcdhByCipherScheme(ppd.CipherScheme)\n\t}\n\n\t// init chain hash -> ChainHash0\n\tppd.chainHash, err = NewHash(ppd.Ciphers.HashType)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to create chain hash: %w\", err)\n\t}\n\tppd.chainHash.Write([]byte(InitialHashString))\n\n\t// init chain key -> ChainKey0\n\tppd.noise.HashType = ppd.Ciphers.HashType\n\tppd.noise.MixKey(&ppd.chainKey, ppd.chainHash.Sum(nil), []byte(InitialChainKeyString))\n\n\tppd.HeaderType, ppd.BodySize = ppd.header.TypeAndPayloadSize()\n\n\t// init hmac hash -> HmacHash0\n\tppd.hmacHash, err = NewHash(ppd.Ciphers.HashType)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to create HMAC hash: %w\", err)\n\t}\n\tppd.hmacHash.Write([]byte(InitialHashString))\n\n\t// evolve hmac hash HmacHash0 -> HmacHash1\n\tppd.hmacHash.Write(ppd.deviceEcdh.PublicKey())","sourceCodeStart":283,"sourceCodeEnd":319,"githubUrl":"https://github.com/OpenNHP/opennhp/blob/6e04ca5ff03222a699c24205cd4bf8fee9af7ffe/nhp/core/responder.go#L283-L319","documentation":"createPacketParserData initializes the Noise chain hash (ChainHash0) via NewHash using the cipher suite's hash type, and this construction failed. Like the init-hash errors, with the stock BLAKE2s/SM3 implementations this indicates the CipherSuite carries an invalid HashType or the crypto backend failed, not a problem with the incoming packet.","triggerScenarios":"PacketToMsg/parseRKNOnServer processing a packet whose header CipherScheme mapped (via NewCipherSuite) to a HashType the hash factory cannot instantiate; a broken crypto backend after a dependency upgrade.","commonSituations":"Custom builds with a modified hash registry; CipherSuite corruption; dependency upgrade removing/renaming a hash implementation; effectively unreachable with unmodified opennhp builds.","solutions":["Confirm NewCipherSuite supports the scheme in the packet header; log ppd.Ciphers.HashType when this fires.","Pin/rebuild against a known-good version of the crypto dependency providing SM3/BLAKE2s.","Add a startup test that instantiates NewHash for every supported scheme so backend regressions surface at boot.","If a new scheme was added, implement its HashType in NewHash before accepting packets stamped with it."],"exampleFix":"// before\nciphers := core.NewCipherSchemeUnknown(7) // no hash registered\nppd, err := d.CreatePacketParserData(pd) // failed to create chain hash\n// after\nciphers := core.NewCipherSuite(common.CIPHER_SCHEME_CURVE)\nppd, err := d.CreatePacketParserData(pd)","handlingStrategy":"try-catch","validationCode":"// boot-time self test\nfor _, scheme := range []int{common.CIPHER_SCHEME_CURVE, common.CIPHER_SCHEME_GMSM} {\n\tif _, err := core.NewHash(core.NewCipherSuite(scheme).HashType); err != nil {\n\t\tlog.Fatalf(\"hash backend broken for scheme %d: %v\", scheme, err)\n\t}\n}","typeGuard":null,"tryCatchPattern":"ppd.chainHash, err = NewHash(ppd.Ciphers.HashType)\nif err != nil {\n\tlog.Error(\"chain hash init failed hashType=%d scheme=%d: %v\", ppd.Ciphers.HashType, ppd.CipherScheme, err)\n\treturn nil, fmt.Errorf(\"failed to create chain hash: %w\", err)\n}","preventionTips":["Only create CipherSuites via NewCipherSuite.","Pin crypto dependencies and run hash smoke tests in CI.","Fail fast at startup if any supported scheme's hash cannot be created.","Log HashType on failure for quick triage."],"tags":["go","cryptography","hash-init","noise-protocol"],"backgroundTag":"module-init-failed","analyzedSha":"6e04ca5ff03222a699c24205cd4bf8fee9af7ffe","analyzedAt":"2026-09-07T15:44:59.941Z","contentChangedAt":"2026-09-07T15:44:59.941Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}