{"record":{"id":"ad47fa8bfdcc5d0c","repo":"XTLS/Xray-core","slug":"bad-encrypt-request-packet-id","errorCode":null,"errorMessage":"bad encrypt request packet id","messagePattern":"bad encrypt request packet id","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"transport/internet/finalmask/xmc/client.go","lineNumber":127,"sourceCode":"\tif err != nil {\n\t\treturn fmt.Errorf(\"select profile: %w\", err)\n\t}\n\tselectedProfile := c.profiles[randomProfile.Int64()]\n\tusername := String(selectedProfile.Username)\n\n\terr = writePacket(c.writer, 0x00, &username, &selectedProfile.UUID)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"write login start: %w\", err)\n\t}\n\n\t// Encryption Request\n\tpkt, err := readPacket(c.reader)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"read encryption request: %w\", err)\n\t}\n\n\tif pkt.packetID != 0x01 {\n\t\treturn fmt.Errorf(\"bad encrypt request packet id\")\n\t}\n\n\tvar (\n\t\tserverId    String\n\t\tpublicKey   Bytes\n\t\tverifyToken Bytes\n\t)\n\n\terr = pkt.readFields(&serverId, &publicKey, &verifyToken)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"read encryption request fields: %w\", err)\n\t}\n\n\tif !bytes.Equal(publicKey, c.rsaPublicKey) {\n\t\treturn fmt.Errorf(\"server public key mismatch\")\n\t}\n\n\tk, err := x509.ParsePKIXPublicKey(publicKey)","sourceCodeStart":109,"sourceCodeEnd":145,"githubUrl":"https://github.com/XTLS/Xray-core/blob/7d214f8b094f75322fa3990f8aadad1c912f24f5/transport/internet/finalmask/xmc/client.go#L109-L145","documentation":"The Encryption Request was expected to have packet ID 0x01, but the server sent a different ID. In the Minecraft login state after Login Start, the next packet is either Encryption Request (0x01) or Login Disconnect / Compression (0x00/0x03); a different ID means the peer is not following the expected login sequence.","triggerScenarios":"Server responding with Login Disconnect (0x00, e.g. banned/whitelisted/full), Set Compression (0x03) because it skips encryption, or arbitrary data because the port is not a Minecraft login server. The check fires before any fields are parsed.","commonSituations":"Target server in offline mode or configured without encryption; server rejecting the username (disconnect packet arrives instead); protocol version drift where packet IDs shifted.","solutions":["Confirm the server enables encryption for login (online-mode-equivalent setup).","Read the disconnect reason: if the ID was 0x00, the server sent a ChatComponent explaining the rejection (banned, full, whitelist).","Match protocol expectations: the client pins protocol version 775, so the server must support it."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := cc.Handshake(); err != nil {\n\tif strings.Contains(err.Error(), \"bad encrypt request packet id\") {\n\t\treturn fmt.Errorf(\"server did not send Encryption Request (id 0x01); it may have disconnected us or run without encryption: %w\", err)\n\t}\n\treturn err\n}","preventionTips":["Confirm the target server performs the encryption phase of login (not offline/bare mode).","Remember packet ID 0x00 at this stage usually carries a disconnect reason worth inspecting."],"tags":["network","xmc","finalmask","handshake","protocol"],"backgroundTag":null,"analyzedSha":"7d214f8b094f75322fa3990f8aadad1c912f24f5","analyzedAt":"2026-08-15T14:26:24.325Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}