{"record":{"id":"469d725c52e9be3e","repo":"golang/go","slug":"tls-invalid-client-key-share","errorCode":null,"errorMessage":"tls: invalid client key share","messagePattern":"tls: invalid client key share","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/tls/handshake_server_tls13.go","lineNumber":257,"sourceCode":"\t}\n\tif clientKeyShare == nil {\n\t\tks, err := hs.doHelloRetryRequest(selectedGroup)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tclientKeyShare = ks\n\t}\n\tc.curveID = selectedGroup\n\n\tke, err := keyExchangeForCurveID(selectedGroup)\n\tif err != nil {\n\t\tc.sendAlert(alertInternalError)\n\t\treturn errors.New(\"tls: internal error: supportsCurve accepted unimplemented curve\")\n\t}\n\ths.sharedKey, hs.hello.serverShare, err = ke.serverSharedSecret(c.config.rand(), clientKeyShare.data)\n\tif err != nil {\n\t\tc.sendAlert(alertIllegalParameter)\n\t\treturn errors.New(\"tls: invalid client key share\")\n\t}\n\n\tselectedProto, err := negotiateALPN(c.config.NextProtos, hs.clientHello.alpnProtocols, c.quic != nil)\n\tif err != nil {\n\t\tc.sendAlert(alertNoApplicationProtocol)\n\t\treturn err\n\t}\n\tc.clientProtocol = selectedProto\n\n\tif c.quic != nil {\n\t\t// RFC 9001 Section 4.2: Clients MUST NOT offer TLS versions older than 1.3.\n\t\tfor _, v := range hs.clientHello.supportedVersions {\n\t\t\tif v < VersionTLS13 {\n\t\t\t\tc.sendAlert(alertProtocolVersion)\n\t\t\t\treturn errors.New(\"tls: client offered TLS version older than TLS 1.3\")\n\t\t\t}\n\t\t}\n\t\t// RFC 9001 Section 8.2.","sourceCodeStart":239,"sourceCodeEnd":275,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/tls/handshake_server_tls13.go#L239-L275","documentation":"The client sent a key_share for a group the server selected, but computing the shared secret (ke.serverSharedSecret) failed — the share bytes are malformed: wrong length, point not on curve, all-zero X25519, etc. Per RFC 8446 §4.2.8 the server sends illegal_parameter.","triggerScenarios":"clientKeyShare.data is a truncated/zeroed key share, an EC point not on the selected curve, the identity point, or X25519 bytes of the wrong length. Buggy key-share generation, fuzzers, or attackers probing.","commonSituations":"Buggy client key-share generation; memory corruption on the client; fuzzers; a client that sent a key_share whose bytes were corrupted in transit.","solutions":["Regenerate the key share with a correct implementation of the selected group","If you can't predict which group the server selects, send valid key shares for every group you offer","Update the client TLS/crypto library to fix key-share serialization bugs"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := tlsConn.Handshake(); err != nil {\n    if strings.Contains(err.Error(), \"invalid client key share\") {\n        log.Printf(\"malformed key share from %v\", remote)\n    }\n    c.Close()\n    return\n}","preventionTips":["In clients, generate key shares with a vetted crypto library","Send valid key shares for every group you advertise in supported_groups"],"tags":["tls","go","key-share","ecdhe","crypto","handshake"],"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T08:17:17.861Z"}