{"record":{"id":"95f12ed7cf299616","repo":"OpenNHP/opennhp","slug":"unsupported-cipher-type-for-cbc-d","errorCode":null,"errorMessage":"unsupported cipher type for CBC: %d","messagePattern":"unsupported cipher type for CBC: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nhp/core/crypto.go","lineNumber":210,"sourceCode":"\tcase GCM_AES256:\n\t\tblock, err = aes.NewCipher(key[:])\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to create AES cipher for CBC: %w\", err)\n\t\t}\n\t\tiv = key[8:24]\n\n\tcase GCM_SM4:\n\t\tblock, err = sm4.NewCipher(key[:16])\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to create SM4 cipher for CBC: %w\", err)\n\t\t}\n\t\tiv = key[16:]\n\n\tcase GCM_CHACHA20POLY1305:\n\t\treturn nil, ErrNotApplicable\n\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"unsupported cipher type for CBC: %d\", t)\n\t}\n\n\tvar paddedPlainText []byte\n\tif len(plaintext)%block.BlockSize() == 0 {\n\t\t// skip padding\n\t\tpaddedPlainText = plaintext\n\t} else {\n\t\tpkcs7 := padding.NewPKCS7Padding(uint(block.BlockSize()))\n\t\tpaddedPlainText = pkcs7.Pad(plaintext)\n\t}\n\n\tvar ciphertext []byte\n\tif inPlace {\n\t\tciphertext = paddedPlainText\n\t} else {\n\t\tciphertext = make([]byte, 0, len(plaintext))\n\t}\n","sourceCodeStart":192,"sourceCodeEnd":228,"githubUrl":"https://github.com/OpenNHP/opennhp/blob/6e04ca5ff03222a699c24205cd4bf8fee9af7ffe/nhp/core/crypto.go#L192-L228","documentation":"CBCEncryption only supports block ciphers (AES-256 and SM4) for CBC mode. When the GcmTypeEnum passed is not GCM_AES256 or GCM_SM4 — e.g. GCM_CHACHA20POLY1305 handled earlier via ErrNotApplicable, or any unknown numeric value — the default branch rejects it because CBC mode cannot be applied to a stream cipher or an unregistered type.","triggerScenarios":"Calling CBCEncryption(t, key, plaintext, inPlace) with a GcmTypeEnum value other than GCM_AES256 or GCM_SM4, such as GCM_CHACHA20POLY1305 misuse reaching the default branch, a zero-value enum, or a cipher type loaded from config that doesn't match any case.","commonSituations":"Cipher scheme read from TOML config or wire data as an arbitrary integer; code refactors that map a Noise cipher suite (e.g. ChaCha20Poly1305) to CBC helpers; new enum added to GcmTypeEnum without updating CBCEncryption.","solutions":["Pass only GCM_AES256 or GCM_SM4 to CBCEncryption; verify the enum value at the call site.","If the caller wants ChaCha20Poly1305, use AeadFromKey/AEAD encryption instead — CBC is ErrNotApplicable for stream ciphers.","Validate the cipher-type config field (e.g. in config.toml) maps to a supported GcmTypeEnum before calling.","Add the missing case to CBCEncryption if a new block cipher was introduced to the enum."],"exampleFix":"// before\ndata, err := core.CBCEncryption(core.GCM_CHACHA20POLY1305, key, plaintext, false)\n// after\ndata, err := core.CBCEncryption(core.GCM_AES256, key, plaintext, false)\n// or for ChaCha20Poly1305 use AEAD:\naead, err := core.AeadFromKey(core.GCM_CHACHA20POLY1305, key)","handlingStrategy":"validation","validationCode":"func cbcSupported(t core.GcmTypeEnum) bool { return t == core.GCM_AES256 || t == core.GCM_SM4 }\nif !cbcSupported(scheme) { return fmt.Errorf(\"scheme %v cannot use CBC\", scheme) }","typeGuard":"func isBlockCipherCBC(t core.GcmTypeEnum) bool { return t == core.GCM_AES256 || t == core.GCM_SM4 }","tryCatchPattern":"data, err := core.CBCEncryption(t, key, pt, false)\nif errors.Is(err, core.ErrNotApplicable) {\n    // stream cipher: fall back to AEAD path\n} else if err != nil {\n    return fmt.Errorf(\"CBC encrypt: %w\", err)\n}","preventionTips":["Centralize cipher-scheme selection in one config constant; never pass raw ints.","Use AEAD (AeadFromKey) for ChaCha20Poly1305; reserve CBC helpers for block ciphers only.","Validate cipher-type config fields against the enum at startup."],"tags":["go","crypto","cipher-config"],"backgroundTag":"unsupported-enum-value","analyzedSha":"6e04ca5ff03222a699c24205cd4bf8fee9af7ffe","analyzedAt":"2026-09-07T15:44:59.941Z","contentChangedAt":"2026-09-07T15:44:59.941Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}