{"record":{"id":"7714a1fd569195c7","repo":"OpenNHP/opennhp","slug":"unsupported-gcm-type-d","errorCode":null,"errorMessage":"unsupported GCM type: %d","messagePattern":"unsupported GCM type: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nhp/core/crypto.go","lineNumber":183,"sourceCode":"\t\tsm4Block, err := sm4.NewCipher(key[:16])\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to create SM4 cipher: %w\", err)\n\t\t}\n\t\taead, err := cipher.NewGCM(sm4Block)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to create SM4-GCM: %w\", err)\n\t\t}\n\t\treturn aead, nil\n\n\tcase GCM_CHACHA20POLY1305:\n\t\taead, err := chacha20poly1305.New(key[:])\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to create ChaCha20-Poly1305: %w\", err)\n\t\t}\n\t\treturn aead, nil\n\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"unsupported GCM type: %d\", t)\n\t}\n}\n\nfunc CBCEncryption(t GcmTypeEnum, key *[SymmetricKeySize]byte, plaintext []byte, inPlace bool) ([]byte, error) {\n\tvar block cipher.Block\n\tvar iv []byte\n\tvar err error\n\tswitch t {\n\tcase GCM_AES256:\n\t\tblock, err = aes.NewCipher(key[:])\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to create AES cipher for CBC: %w\", err)\n\t\t}\n\t\tiv = key[8:24]\n\n\tcase GCM_SM4:\n\t\tblock, err = sm4.NewCipher(key[:16])\n\t\tif err != nil {","sourceCodeStart":165,"sourceCodeEnd":201,"githubUrl":"https://github.com/OpenNHP/opennhp/blob/6e04ca5ff03222a699c24205cd4bf8fee9af7ffe/nhp/core/crypto.go#L165-L201","documentation":"AeadFromKey returns this error when the GcmTypeEnum argument is not GCM_AES256 (0), GCM_SM4 (1), or GCM_CHACHA20POLY1305 (2). Because GcmTypeEnum is an int enum, any out-of-range integer — from bad config, wire data, or an uninitialized variable — lands in the default branch. It means an unrecognized AEAD algorithm selector reached the crypto layer.","triggerScenarios":"Passing a GcmTypeEnum cast from an unvalidated integer (e.g. -1 sentinel, value from config.toml or a protocol field), or adding a new GcmTypeEnum constant without a corresponding case in AeadFromKey.","commonSituations":"Mapping a cipher-scheme number to GCM type with an off-by-one or wrong table; deserializing a peer's algorithm identifier that doesn't match the local enum; extending the enum in a fork without updating the switch.","solutions":["Obtain GCM types via NewCipherSuite(scheme) instead of constructing them manually","Validate externally-sourced integers against the GCM_AES256/GCM_SM4/GCM_CHACHA20POLY1305 constants before casting","Log the numeric value and compare with the enum constants 0/1/2","If a new constant was added, add its case to AeadFromKey (and CBC paths) and rebuild","Note CBCEncryption has its own unsupported-value message — check which function actually returned the error"],"exampleFix":"// before\naead, err := core.AeadFromKey(core.GcmTypeEnum(cfg.AeadCode), &key)\n// after\nif cfg.AeadCode < int(core.GCM_AES256) || cfg.AeadCode > int(core.GCM_CHACHA20POLY1305) {\n    return fmt.Errorf(\"invalid aead code %d\", cfg.AeadCode)\n}\naead, err := core.AeadFromKey(core.GcmTypeEnum(cfg.AeadCode), &key)\nif err != nil {\n    return err\n}","handlingStrategy":"validation","validationCode":"func isValidGcmType(t core.GcmTypeEnum) bool {\n    return t >= core.GCM_AES256 && t <= core.GCM_CHACHA20POLY1305\n}\n\nif !isValidGcmType(t) {\n    return fmt.Errorf(\"gcm type %d out of range\", int(t))\n}","typeGuard":"func asGcmType(v int) (core.GcmTypeEnum, bool) {\n    if v < int(core.GCM_AES256) || v > int(core.GCM_CHACHA20POLY1305) {\n        return 0, false\n    }\n    return core.GcmTypeEnum(v), true\n}","tryCatchPattern":"aead, err := core.AeadFromKey(t, &key)\nif err != nil {\n    if strings.Contains(err.Error(), \"unsupported GCM type\") {\n        return fmt.Errorf(\"bad AEAD selector %d: %w\", int(t), err)\n    }\n    return err\n}","preventionTips":["Get GCM types only from NewCipherSuite(scheme)","Range-check any integer from config or wire data before casting to GcmTypeEnum","Add a switch case in AeadFromKey whenever GcmTypeEnum is extended"],"tags":["crypto","aead","enum","invalid-argument"],"backgroundTag":"invalid-enum-value","analyzedSha":"6e04ca5ff03222a699c24205cd4bf8fee9af7ffe","analyzedAt":"2026-09-07T15:44:59.941Z","contentChangedAt":"2026-09-07T15:44:59.941Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}