{"record":{"id":"84d9d7f16b20ee33","repo":"golang/go","slug":"tls-invalid-server-key-share","errorCode":null,"errorMessage":"tls: invalid server key share","messagePattern":"tls: invalid server key share","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/tls/handshake_client_tls13.go","lineNumber":482,"sourceCode":"\tc.peerCertificates = hs.session.peerCertificates\n\tc.verifiedChains = hs.session.verifiedChains\n\tc.ocspResponse = hs.session.ocspResponse\n\tc.scts = hs.session.scts\n\treturn nil\n}\n\nfunc (hs *clientHandshakeStateTLS13) establishHandshakeKeys() error {\n\tc := hs.c\n\n\tke, err := keyExchangeForCurveID(hs.serverHello.serverShare.group)\n\tif err != nil {\n\t\tc.sendAlert(alertInternalError)\n\t\treturn err\n\t}\n\tsharedKey, err := ke.clientSharedSecret(hs.keyShareKeys, hs.serverHello.serverShare.data)\n\tif err != nil {\n\t\tc.sendAlert(alertIllegalParameter)\n\t\treturn errors.New(\"tls: invalid server key share\")\n\t}\n\tc.curveID = hs.serverHello.serverShare.group\n\n\tearlySecret := hs.earlySecret\n\tif !hs.usingPSK {\n\t\tearlySecret = tls13.NewEarlySecret(hs.suite.hash.New, nil)\n\t}\n\n\thandshakeSecret := earlySecret.HandshakeSecret(sharedKey)\n\n\tclientSecret := handshakeSecret.ClientHandshakeTrafficSecret(hs.transcript)\n\tc.setWriteTrafficSecret(hs.suite, QUICEncryptionLevelHandshake, clientSecret)\n\tserverSecret := handshakeSecret.ServerHandshakeTrafficSecret(hs.transcript)\n\tif err := c.setReadTrafficSecret(hs.suite, QUICEncryptionLevelHandshake, serverSecret, false); err != nil {\n\t\treturn err\n\t}\n\n\tif c.quic != nil {","sourceCodeStart":464,"sourceCodeEnd":500,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/tls/handshake_client_tls13.go#L464-L500","documentation":"During establishHandshakeKeys, Go computes the ECDH shared secret from the server's key share. If the crypto operation fails (the server's share is malformed, not on the curve, wrong length, or an invalid point), Go wraps it as 'tls: invalid server key share' and sends `illegal_parameter`. This guards against malformed or attack-crafted public keys.","triggerScenarios":"ke.clientSharedSecret returns an error when processing hs.serverHello.serverShare.data against the client's key share keys. Common when the server share is truncated, off-curve, or all-zero.","commonSituations":"Server bug producing a malformed public key, an active MITM (e.g., invalid-curve attack), corrupted packets, or a misbehaving TLS proxy. Rare against healthy peers.","solutions":["Treat the server's key share as untrusted and abort; do not retry indefinitely against the same peer.","Capture the ServerHello key_share bytes and validate the point on the expected curve.","Test against a known-good peer to rule out local tampering.","Report to the server operator if the bad share is confirmed server-origin."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"// Invalid server key share can be a security probe; do not auto-retry indefinitely.\nif err := conn.Handshake(); err != nil {\n    if strings.Contains(err.Error(), \"invalid server key share\") {\n        log.Printf(\"possible MITM or buggy peer %s: %v\", addr, err)\n    }\n    return err\n}","preventionTips":["Treat invalid-curve / malformed key-share errors as security-relevant; investigate before retrying.","Use certificate pinning or VerifyConnection callbacks to add defence in depth against MITM.","Prefer X25519 (which has built-in cofactor handling) to reduce off-curve attack surface."],"tags":["tls","tls13","handshake","key-share","ecdh","protocol-violation","security","network","go"],"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T08:17:17.861Z"}