{"record":{"id":"721327b9094d5cd3","repo":"OpenNHP/opennhp","slug":"unsupported-mode-v","errorCode":null,"errorMessage":"unsupported mode: %v","messagePattern":"unsupported mode: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nhp/core/ztdo/noise.go","lineNumber":122,"sourceCode":"\t}\n}\nfunc (mode SymmetricCipherMode) newCipherBlock(key []byte) (cipher.Block, error) {\n\tswitch mode {\n\tcase AES256GCM64Tag, AES256GCM96Tag, AES256GCM104Tag,\n\t\tAES256GCM112Tag, AES256GCM120Tag, AES256GCM128Tag:\n\t\tif len(key) != 32 {\n\t\t\treturn nil, fmt.Errorf(\"invalid key length for AES-256-GCM\")\n\t\t}\n\t\treturn aes.NewCipher(key)\n\tcase SM4GCM64Tag, SM4GCM128Tag:\n\t\tif len(key) < 16 {\n\t\t\treturn nil, fmt.Errorf(\"invalid key length for SM4-GCM\")\n\t\t} else {\n\t\t\tkey = key[:16]\n\t\t}\n\t\treturn sm4.NewCipher(key)\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"unsupported mode: %v\", mode)\n\t}\n}\n\nfunc (mode SymmetricCipherMode) Encrypt(key, nonce, plaintext, ad []byte) ([]byte, error) {\n\ttagSize := mode.TagSize()\n\n\tcipherBlock, err := mode.newCipherBlock(key)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\taead, err := cipher.NewGCMWithTagSize(cipherBlock, tagSize)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tciphertext := aead.Seal(plaintext[:0], nonce, plaintext, ad)\n","sourceCodeStart":104,"sourceCodeEnd":140,"githubUrl":"https://github.com/OpenNHP/opennhp/blob/6e04ca5ff03222a699c24205cd4bf8fee9af7ffe/nhp/core/ztdo/noise.go#L104-L140","documentation":"newCipherBlock's default branch catches any SymmetricCipherMode value outside the known AES and SM4 tags and returns this error. It guards against constructing the mode directly from a raw integer instead of via NewSymmetricCipherMode.","triggerScenarios":"Encrypt/Decrypt called on a SymmetricCipherMode value that is neither an AES256GCM* tag nor SM4GCM* tag (e.g. 0, or a value cast from an int) (nhp/core/ztdo/noise.go:122).","commonSituations":"Zero-value SymmetricCipherMode structs from uninitialized variables; deserialized mode tags from peers using newer suites; casting arbitrary integers to the mode type.","solutions":["Initialize the mode via NewSymmetricCipherMode with a valid name instead of raw values","Ensure the struct/field holding the mode is not left at its zero value","Validate mode tags received from peers against supported suites before use"],"exampleFix":"// before\nvar mode SymmetricCipherMode // zero value -> unsupported mode\n// after\nmode, err := NewSymmetricCipherMode(\"AES-256-GCM-128\")","handlingStrategy":"type-guard","validationCode":"func isKnownMode(m SymmetricCipherMode) bool {\n\tswitch m {\n\tcase AES256GCM64Tag, AES256GCM96Tag, AES256GCM104Tag, AES256GCM112Tag, AES256GCM120Tag, AES256GCM128Tag, SM4GCM64Tag, SM4GCM128Tag:\n\t\treturn true\n\t}\n\treturn false\n}","typeGuard":"func validSymmetricMode(m SymmetricCipherMode) bool { return isKnownMode(m) }","tryCatchPattern":"if !validSymmetricMode(mode) {\n\tmode, err = NewSymmetricCipherMode(\"AES-256-GCM-128\")\n}","preventionTips":["Never cast raw ints to SymmetricCipherMode","Construct modes only via NewSymmetricCipherMode","Avoid leaving mode fields at their zero value"],"tags":["go","crypto","noise-protocol","enum"],"backgroundTag":"unsupported-enum-value","analyzedSha":"6e04ca5ff03222a699c24205cd4bf8fee9af7ffe","analyzedAt":"2026-09-07T15:44:59.941Z","contentChangedAt":"2026-09-07T15:44:59.941Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}