{"record":{"id":"49def54f77eabcb8","repo":"golang/go","slug":"cipher-message-authentication-failed-49def5","errorCode":null,"errorMessage":"cipher: message authentication failed","messagePattern":"cipher: message authentication failed","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"src/crypto/internal/fips140/aes/gcm/gcm.go","lineNumber":91,"sourceCode":"\t\tpanic(\"crypto/cipher: incorrect GCM nonce size\")\n\t}\n\tif uint64(len(plaintext)) > uint64((1<<32)-2)*gcmBlockSize {\n\t\tpanic(\"crypto/cipher: message too large for GCM\")\n\t}\n\n\tret, out := sliceForAppend(dst, len(plaintext)+g.tagSize)\n\tif alias.InexactOverlap(out, plaintext) {\n\t\tpanic(\"crypto/cipher: invalid buffer overlap of output and input\")\n\t}\n\tif alias.AnyOverlap(out, data) {\n\t\tpanic(\"crypto/cipher: invalid buffer overlap of output and additional data\")\n\t}\n\n\tseal(out, g, nonce, plaintext, data)\n\treturn ret\n}\n\nvar errOpen = errors.New(\"cipher: message authentication failed\")\n\nfunc (g *GCM) Open(dst, nonce, ciphertext, data []byte) ([]byte, error) {\n\tif len(nonce) != g.nonceSize {\n\t\tpanic(\"crypto/cipher: incorrect nonce length given to GCM\")\n\t}\n\t// Sanity check to prevent the authentication from always succeeding if an\n\t// implementation leaves tagSize uninitialized, for example.\n\tif g.tagSize < gcmMinimumTagSize {\n\t\tpanic(\"crypto/cipher: incorrect GCM tag size\")\n\t}\n\n\tif len(ciphertext) < g.tagSize {\n\t\treturn nil, errOpen\n\t}\n\tif uint64(len(ciphertext)) > uint64((1<<32)-2)*gcmBlockSize+uint64(g.tagSize) {\n\t\treturn nil, errOpen\n\t}\n","sourceCodeStart":73,"sourceCodeEnd":109,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/internal/fips140/aes/gcm/gcm.go#L73-L109","documentation":"Returned by GCM.Open (errOpen) when authentication fails: the GCM tag computed over ciphertext+associated-data does not match the appended tag, or when the ciphertext is shorter than tagSize / exceeds the GCM maximum. This is the canonical AEAD authentication failure: either the key, nonce, ciphertext, or associated data differs from what was used to Seal.","triggerScenarios":"Calling aead.Open(dst, nonce, ciphertext, data) with the wrong key, wrong/rotated nonce, tampered ciphertext, reordered/truncated associated data, or ciphertext shorter than g.tagSize.","commonSituations":"Nonce reuse or rotation out of sync; key rotation where the decryptor still holds the old key; network truncation dropping the tag or trailing bytes; associated-data mismatch (e.g. AAD field changed between seal and open); ciphertext from a different AEAD/algorithm fed into GCM.","solutions":["Verify the key, nonce, and additional data byte-for-byte match what Seal used; log nonce and AAD lengths to spot mismatches.","Ensure the ciphertext includes the trailing tag and was not truncated in transit.","If key rotation is the cause, try decryption against recent keys in order.","Treat errOpen as unauthenticated and never disclose which field was wrong (constant-time)."],"exampleFix":"// before\nplaintext, err := aead.Open(nil, nonce, ciphertext, nil)\nif err != nil { panic(err) } // err == errOpen\n// after\nplaintext, err := aead.Open(nil, nonce, ciphertext, aad) // pass the SAME aad used in Seal\nif err != nil {\n    return errors.New(\"decryption failed: authentication tag mismatch\")\n}","handlingStrategy":"try-catch","validationCode":"func looksAuthentic(ciphertext []byte, tagSize int) bool {\n    return len(ciphertext) >= tagSize\n}\n// stronger: verify lengths and AAD before calling Open, but the tag itself\n// can only be verified by Open — there is no pre-check that substitutes for it.","typeGuard":"// n/a","tryCatchPattern":"plaintext, err := aead.Open(nil, nonce, ciphertext, aad)\nif err != nil {\n    // err is errOpen: treat as unauthenticated; do not partially use plaintext\n    return errors.New(\"decryption failed\")\n}","preventionTips":["Never reuse a nonce with the same key.","Log nonce + AAD lengths (not values) to spot mismatches in audits.","Use a key hierarchy (HKDF) and rotate keys.","Treat errOpen as a security event, not a transient retry.","Do not disclose which field failed authentication."],"tags":["crypto","aes","gcm","cipher","authentication","security","fips"],"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T06:17:24.410Z"}