{"record":{"id":"70f406ead4043ad8","repo":"OpenNHP/opennhp","slug":"failed-to-create-sm4-cipher-w","errorCode":null,"errorMessage":"failed to create SM4 cipher: %w","messagePattern":"failed to create SM4 cipher: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nhp/core/crypto.go","lineNumber":167,"sourceCode":"}\n\nfunc AeadFromKey(t GcmTypeEnum, key *[SymmetricKeySize]byte) (cipher.AEAD, error) {\n\tswitch t {\n\tcase GCM_AES256:\n\t\taesBlock, err := aes.NewCipher(key[:])\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to create AES cipher: %w\", err)\n\t\t}\n\t\taead, err := cipher.NewGCM(aesBlock)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to create AES-GCM: %w\", err)\n\t\t}\n\t\treturn aead, nil\n\n\tcase GCM_SM4:\n\t\tsm4Block, err := sm4.NewCipher(key[:16])\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to create SM4 cipher: %w\", err)\n\t\t}\n\t\taead, err := cipher.NewGCM(sm4Block)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to create SM4-GCM: %w\", err)\n\t\t}\n\t\treturn aead, nil\n\n\tcase GCM_CHACHA20POLY1305:\n\t\taead, err := chacha20poly1305.New(key[:])\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to create ChaCha20-Poly1305: %w\", err)\n\t\t}\n\t\treturn aead, nil\n\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"unsupported GCM type: %d\", t)\n\t}\n}","sourceCodeStart":149,"sourceCodeEnd":185,"githubUrl":"https://github.com/OpenNHP/opennhp/blob/6e04ca5ff03222a699c24205cd4bf8fee9af7ffe/nhp/core/crypto.go#L149-L185","documentation":"AeadFromKey(GCM_SM4, key) wraps sm4.NewCipher(key[:16]) errors as this message. The emmansun/gmsm sm4.NewCipher fails only when the key length is not exactly 16 bytes; OpenNHP hard-slices key[:16] from a 32-byte array, so failure implies the key array is malformed/nil or the gmsm dependency behaves unexpectedly. It indicates the SM4 (Chinese national standard) cipher for the GMSM cipher scheme could not be initialized.","triggerScenarios":"Calling AeadFromKey(GCM_SM4, ...) with a nil *[SymmetricKeySize]byte, an array shorter than 16 bytes (only via unsafe/reflected misuse), or a gmsm library version with different NewCipher semantics.","commonSituations":"Mixed-scheme deployments where code paths for CIPHER_SCHEME_GMSM receive a key buffer that was never filled; refactors that change SymmetricKeySize; pinning an older/newer github.com/emmansun/gmsm with a changed API.","solutions":["Verify the 32-byte key array is fully populated by the SM2 ECDH/KDF step before invoking AeadFromKey","Pin a known-good github.com/emmansun/gmsm version in go.mod and run go mod tidy","Log the wrapped error to see the exact sm4.NewCipher complaint (usually key length)","Confirm the caller passes GCM_SM4 only for scheme CIPHER_SCHEME_GMSM paths","Test with go test ./nhp/core/... including TestGMSharedKey to reproduce with valid keys"],"exampleFix":"// before\nvar key *[32]byte\naead, _ := core.AeadFromKey(core.GCM_SM4, key) // nil/empty key\n// after\nshared := sm2Ecdh.SharedSecret(peerPub)\nvar key [core.SymmetricKeySize]byte\nutils.Memcpy(key[:], kdf(shared))\naead, err := core.AeadFromKey(core.GCM_SM4, &key)\nif err != nil {\n    return fmt.Errorf(\"sm4 aead init: %w\", err)\n}","handlingStrategy":"validation","validationCode":"if key == nil {\n    return errors.New(\"SM4 symmetric key not initialized\")\n}\nzero := true\nfor _, b := range key {\n    if b != 0 { zero = false; break }\n}\nif zero {\n    return errors.New(\"SM4 key is all zeros - key exchange likely failed\")\n}","typeGuard":null,"tryCatchPattern":"aead, err := core.AeadFromKey(core.GCM_SM4, &key)\nif err != nil {\n    return fmt.Errorf(\"SM4-GCM setup failed: %w\", err)\n}","preventionTips":["Run SM2 key exchange and KDF before any SM4 cipher use","Use the GMSM cipher scheme end-to-end (NewCipherSuite(common.CIPHER_SCHEME_GMSM)) — don't mix suites","Pin a tested github.com/emmansun/gmsm version in go.mod","Check derived keys are non-empty and non-zero before encryption"],"tags":["crypto","sm4","gcm","gmsm"],"backgroundTag":"invalid-argument-value","analyzedSha":"6e04ca5ff03222a699c24205cd4bf8fee9af7ffe","analyzedAt":"2026-09-07T15:44:59.941Z","contentChangedAt":"2026-09-07T15:44:59.941Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}