{"record":{"id":"7a108ea5198da3cb","repo":"OpenNHP/opennhp","slug":"size-incorrect","errorCode":null,"errorMessage":"size incorrect","messagePattern":"size incorrect","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nhp/core/crypto.go","lineNumber":322,"sourceCode":"\trng := rand.Reader\n\n\tciphertext, err := sm2.EncryptASN1(rng, sm2PublicKey, secretMessage)\n\tif err != nil {\n\t\tfmt.Fprintf(os.Stderr, \"Error from encryption: %s\\n\", err)\n\t\treturn \"\", err\n\t}\n\t// Since encryption is a randomized function, ciphertext will be\n\t// different each time.\n\tfmt.Printf(\"Ciphertext: %x\\n\", ciphertext)\n\treturn hex.EncodeToString(ciphertext), err\n}\n\nfunc SM2Decrypt(privateKeyBase64 string, message string) (string, error) {\n\t//ASN.1\n\tciphertext, err := hex.DecodeString(message)\n\tprivKeyBytes, err := base64.StdEncoding.DecodeString(privateKeyBase64)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"size incorrect\")\n\t}\n\n\ttestkey, err := sm2.NewPrivateKey(privKeyBytes)\n\tif err != nil {\n\t\tlog.Fatalf(\"fail to new private key %v\", err)\n\t}\n\n\tsourceText, err := testkey.Decrypt(nil, ciphertext, nil)\n\tif err != nil {\n\t\tfmt.Fprintf(os.Stderr, \"Error from decryption: %s\\n\", err)\n\t\treturn \"\", err\n\t}\n\treturn string(sourceText), err\n}\n\n// AESEncryption Function\nfunc AESEncrypt(plainText []byte, key []byte) ([]byte, error) {\n\tblock, err := aes.NewCipher(key)","sourceCodeStart":304,"sourceCodeEnd":340,"githubUrl":"https://github.com/OpenNHP/opennhp/blob/6e04ca5ff03222a699c24205cd4bf8fee9af7ffe/nhp/core/crypto.go#L304-L340","documentation":"SM2Decrypt returns \"size incorrect\" when base64.StdEncoding.DecodeString fails on the private-key argument. The message is misleading: it is a base64 decoding failure of privateKeyBase64, not a ciphertext-size problem. (Note the hex.DecodeString error on the line above is also silently discarded — the guard only covers the base64 decode.)","triggerScenarios":"Passing a privateKeyBase64 string that is not valid standard base64: raw hex, PEM-wrapped text, whitespace/newlines, URL-safe base64, or a key exported in a non-base64 format.","commonSituations":"Pasting an SM2 private key from a PEM file or hex dump into config; a config.toml value with trailing newline or quotes; keys generated by another tool that emits hex or DER instead of the expected base64.","solutions":["Ensure the private key is standard base64 (StdEncoding, not URL-safe, no PEM headers) before calling SM2Decrypt.","Trim whitespace/newlines and quotes from the key string loaded from config.","If the source key is hex or PEM, convert: PEM -> DER -> raw/private bytes -> base64.","Check whether the hex.DecodeString(message) error is the real failure — validate the ciphertext is valid hex too, since its error is currently swallowed.","Prefer keygen-generated keys (`keygen --sm2`) whose export format matches this API."],"exampleFix":"// before\nplain, err := core.SM2Decrypt(cfg.SM2PrivateKeyHex, msg) // hex string passed\n// after\nkeyBytes, _ := hex.DecodeString(cfg.SM2PrivateKeyHex)\nb64Key := base64.StdEncoding.EncodeToString(keyBytes)\nplain, err := core.SM2Decrypt(b64Key, msg)","handlingStrategy":"validation","validationCode":"if _, err := base64.StdEncoding.DecodeString(privateKeyB64); err != nil {\n    return fmt.Errorf(\"SM2 private key is not valid base64: %w\", err)\n}\nif _, err := hex.DecodeString(message); err != nil {\n    return fmt.Errorf(\"SM2 ciphertext is not valid hex: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"plain, err := core.SM2Decrypt(keyB64, msg)\nif err != nil && err.Error() == \"size incorrect\" {\n    return fmt.Errorf(\"private key not valid base64: %w\", err)\n}","preventionTips":["Store SM2 private keys strictly as standard base64; strip whitespace and PEM wrappers.","Convert hex/PEM exports to base64 before calling SM2Decrypt.","Pre-validate both the key (base64) and ciphertext (hex) since some decode errors are swallowed inside."],"tags":["go","crypto","sm2","base64","key-format"],"backgroundTag":"invalid-argument-format","analyzedSha":"6e04ca5ff03222a699c24205cd4bf8fee9af7ffe","analyzedAt":"2026-09-07T15:44:59.941Z","contentChangedAt":"2026-09-07T15:44:59.941Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}