{"record":{"id":"51d9b663ee385e97","repo":"XTLS/Xray-core","slug":"encrypt-shared-secret-w","errorCode":null,"errorMessage":"encrypt shared secret: %w","messagePattern":"encrypt shared secret: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"transport/internet/finalmask/xmc/client.go","lineNumber":162,"sourceCode":"\n\tk, err := x509.ParsePKIXPublicKey(publicKey)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"parse server public key: %w\", err)\n\t}\n\n\trsaPublicKey, ok := k.(*rsa.PublicKey)\n\tif !ok {\n\t\treturn fmt.Errorf(\"parse server public key: not rsa\")\n\t}\n\n\tsharedSecret := make([]byte, 16)\n\tif _, err = rand.Read(sharedSecret); err != nil {\n\t\treturn fmt.Errorf(\"generate shared secret: %w\", err)\n\t}\n\n\tencryptedSharedSecret, err := rsa.EncryptPKCS1v15(rand.Reader, rsaPublicKey, sharedSecret)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"encrypt shared secret: %w\", err)\n\t}\n\n\tverifyToken = append(verifyToken, []byte(c.password)...) // append pre-shared password\n\n\tencryptedVerifyToken, err := rsa.EncryptPKCS1v15(rand.Reader, rsaPublicKey, verifyToken)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"encrypt verify token: %w\", err)\n\t}\n\n\t// Send Encryption Response\n\terr = writePacket(\n\t\tc.writer,\n\t\t0x01,\n\t\t(*Bytes)(&encryptedSharedSecret),\n\t\t(*Bytes)(&encryptedVerifyToken),\n\t)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"write encryption response: %w\", err)","sourceCodeStart":144,"sourceCodeEnd":180,"githubUrl":"https://github.com/XTLS/Xray-core/blob/7d214f8b094f75322fa3990f8aadad1c912f24f5/transport/internet/finalmask/xmc/client.go#L144-L180","documentation":"rsa.EncryptPKCS1v15 failed when encrypting the 16-byte shared secret with the server's RSA public key. With a 16-byte input this can only overflow for keys smaller than ~360 bits (PKCS#1v15 overhead is 11 bytes plus input length must be <= k-11). The other cause is the random source erroring, which shares the same rarity as error 862.","triggerScenarios":"The server key in Config.RsaPublicKey is a very small RSA key (e.g. 512-bit gives k=64, still fits 16 bytes; a 128–256-bit toy key does not), or rand.Reader failed mid-handshake during the first Read/Write on the wrapped connection.","commonSituations":"Test fixtures or examples that used 512/1024-bit keys usually still work; hand-rolled 'quick demo' keys below 360 bits fail. Entropy failures come from sandboxed runtimes blocking getrandom.","solutions":["Use a standard RSA key size: 2048 or 3072 bits on both ends","Confirm the DER blob actually decodes to the intended key (pair with errors 860/861 fixes)","Check the environment's CSPRNG availability if the wrapped error mentions the random source"],"exampleFix":"// before\npriv, _ := rsa.GenerateKey(rand.Reader, 256) // toy key: k-11=21 < 16? no, but verifyToken append later overflows\n\n// after\npriv, _ := rsa.GenerateKey(rand.Reader, 2048)","handlingStrategy":"validation","validationCode":"k, _ := x509.ParsePKIXPublicKey(cfg.RsaPublicKey)\nrpk, _ := k.(*rsa.PublicKey)\nif rpk == nil || rpk.N.BitLen() < 2048 {\n    return errors.New(\"server RSA key must be >= 2048 bits\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Standardize on 2048+ bit RSA keys","Generate keys programmatically with rsa.GenerateKey(rand.Reader, 2048)","Reject undersized keys at config load with an explicit error"],"tags":["crypto","rsa","key-size","go"],"backgroundTag":null,"analyzedSha":"7d214f8b094f75322fa3990f8aadad1c912f24f5","analyzedAt":"2026-08-15T14:26:24.325Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}