{"record":{"id":"6596ba0f40b6e035","repo":"fatedier/frp","slug":"no-supported-crypto-algorithm","errorCode":null,"errorMessage":"no supported crypto algorithm","messagePattern":"no supported crypto algorithm","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/proto/wire/crypto.go","lineNumber":62,"sourceCode":"\tAlgorithm      string\n\tTranscriptHash []byte\n}\n\nfunc NewClientHello(bootstrap BootstrapInfo) (ClientHello, error) {\n\tclientRandom, err := newCryptoRandom()\n\tif err != nil {\n\t\treturn ClientHello{}, err\n\t}\n\treturn clientHelloWithCryptoRandom(bootstrap, clientRandom), nil\n}\n\nfunc NewServerHello(clientHello ClientHello) (ServerHello, error) {\n\tif err := ValidateClientHello(clientHello); err != nil {\n\t\treturn ServerHello{}, err\n\t}\n\talgorithm, ok := SelectAEADAlgorithm(clientHello.Capabilities.Crypto.Algorithms)\n\tif !ok {\n\t\treturn ServerHello{}, fmt.Errorf(\"no supported crypto algorithm\")\n\t}\n\tserverRandom, err := newCryptoRandom()\n\tif err != nil {\n\t\treturn ServerHello{}, err\n\t}\n\treturn ServerHello{\n\t\tSelected: ServerSelection{\n\t\t\tMessage: MessageSelection{\n\t\t\t\tCodec:          MessageCodecJSON,\n\t\t\t\tUDPPacketCodec: selectUDPPacketCodec(clientHello.Capabilities.Message.UDPPacketCodecs),\n\t\t\t},\n\t\t\tCrypto: CryptoSelection{\n\t\t\t\tAlgorithm:    algorithm,\n\t\t\t\tServerRandom: serverRandom,\n\t\t\t},\n\t\t},\n\t}, nil\n}","sourceCodeStart":44,"sourceCodeEnd":80,"githubUrl":"https://github.com/fatedier/frp/blob/6c8a8d0a97d03b44e9528d30b30c70cb9d61b405/pkg/proto/wire/crypto.go#L44-L80","documentation":"During ServerHello construction the server found no AEAD algorithm in common with the client: SelectAEADAlgorithm walked clientHello.Capabilities.Crypto.Algorithms and none matched the server's supported set (aes-256-gcm, xchacha20-poly1305). The wire v2 protocol requires at least one shared AEAD before encryption can be negotiated.","triggerScenarios":"NewServerHello with a ClientHello whose crypto algorithm list is empty or contains only algorithms this build does not support (or HW acceleration unavailable so AES-GCM/XChaCha20 is disabled).","commonSituations":"Cross-version connection where an older/other-party client advertises different algorithm names; a custom/forked client with a trimmed algorithm list; capability list lost/mangled in transit.","solutions":["Run the same (or compatible) frp version on both ends so both advertise aes-256-gcm / xchacha20-poly1305","If on unusual hardware, verify the build supports at least one of the two AEADs (both are pure-Go capable)","For custom clients, include at least one of the supported algorithm strings in the ClientHello capabilities"],"exampleFix":"// before (custom client)\nhello.Capabilities.Crypto.Algorithms = []string{\"my-aead\"}\n\n// after\nhello.Capabilities.Crypto.Algorithms = []string{\n  wire.AEADAlgorithmAES256GCM,\n  wire.AEADAlgorithmXChaCha20Poly1305,\n}","handlingStrategy":"validation","validationCode":"// Offer both supported algorithms before connecting\nhello.Capabilities.Crypto.Algorithms = []string{\n    wire.AEADAlgorithmAES256GCM,\n    wire.AEADAlgorithmXChaCha20Poly1305,\n}","typeGuard":null,"tryCatchPattern":"if _, err := wire.NewServerHello(clientHello); err != nil && strings.Contains(err.Error(), \"no supported crypto algorithm\") {\n    // peer advertises incompatible algorithms: refuse instead of retrying\n    return errors.New(\"incompatible peer crypto capabilities\")\n}","preventionTips":["Always advertise both aes-256-gcm and xchacha20-poly1305 in ClientHello","Gate connections on version/capability handshake before heavy setup","Run matching frp versions on both endpoints"],"tags":["crypto","protocol","handshake","version-mismatch","go"],"backgroundTag":null,"analyzedSha":"6c8a8d0a97d03b44e9528d30b30c70cb9d61b405","analyzedAt":"2026-08-15T06:53:27.215Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}