{"record":{"id":"b0436fb1dc398581","repo":"embassy-rs/embassy","slug":"cannot-update-aad-after-starting-payload","errorCode":null,"errorMessage":"Cannot update AAD after starting payload!","messagePattern":"Cannot update AAD after starting payload!","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"embassy-stm32/src/cryp/mod.rs","lineNumber":1306,"sourceCode":"    /// This function is only valid for authenticated ciphers including GCM, CCM, and GMAC.\n    /// All additional associated data (AAD) must be supplied to this function prior to starting the payload phase with `payload_blocking`.\n    /// The AAD must be supplied in multiples of the block size (128-bits for AES, 64-bits for DES), except when supplying the last block.\n    /// When supplying the last block of AAD, `last_aad_block` must be `true`.\n    pub fn aad_blocking<\n        'c,\n        const TAG_SIZE: usize,\n        C: Cipher<'c> + CipherSized + IVSized + CipherAuthenticated<TAG_SIZE>,\n    >(\n        &self,\n        ctx: &mut Context<'c, C>,\n        aad: &[u8],\n        last_aad_block: bool,\n    ) {\n        self.load_context(ctx);\n\n        // Perform checks for correctness.\n        if ctx.aad_complete {\n            panic!(\"Cannot update AAD after starting payload!\")\n        }\n\n        ctx.header_len += aad.len() as u64;\n\n        // Header phase\n        T::regs().cr().modify(|w| w.set_crypen(false));\n        T::regs().cr().modify(|w| w.set_gcm_ccmph(1));\n        T::regs().cr().modify(|w| w.set_crypen(true));\n\n        // First write the header B1 block if not yet written.\n        if !ctx.header_processed {\n            ctx.header_processed = true;\n            let header = ctx.cipher.get_header_block();\n            ctx.aad_buffer[0..header.len()].copy_from_slice(header);\n            ctx.aad_buffer_len += header.len();\n        }\n\n        // Fill the header block to make a full block.","sourceCodeStart":1288,"sourceCodeEnd":1324,"githubUrl":"https://github.com/embassy-rs/embassy/blob/463a07b963419a1bfe61d5d597c44acb810afb8b/embassy-stm32/src/cryp/mod.rs#L1288-L1324","documentation":"The CRYP AES driver enforces GCM/CCM phase ordering: once the AAD (header) phase is complete (aad_complete set, payload phase started), additional_header() can no longer be called. AAD must be fully supplied before any payload data; interleaving AAD after payload is not supported by this hardware flow.","triggerScenarios":"Calling additional_header() on a context after the payload phase has begun (ctx.aad_complete == true), e.g. appending more AAD after encrypting a chunk.","commonSituations":"Protocols that interleave header and body; AEAD callers using frameworks that allow AAD/payload interleaving mapped onto this sequential driver; reusing a context across calls without tracking phase.","solutions":["Collect all AAD first and call additional_header() for all of it (last block flagged), then start the payload phase.","Buffer payload bytes until AAD is complete if AAD arrives late.","Use a fresh cipher context — phase state cannot be rewound."],"exampleFix":"// before\nctx.additional_header(aad1, false);\nctx.payload(chunk, &mut out, false);\nctx.additional_header(aad2, true); // panics\n// after\nctx.additional_header(aad1, false);\nctx.additional_header(aad2, true);\nctx.payload(chunk, &mut out, false);","handlingStrategy":"type-guard","validationCode":"if !ctx.aad_complete { ctx.additional_header(more_aad, false); } else { /* buffer or error */ }","typeGuard":"fn can_add_aad(ctx: &CipherContext) -> bool { !ctx.aad_complete }","tryCatchPattern":null,"preventionTips":["Structure AEAD usage AAD-first, payload-second","Track AAD completion in your own protocol code","Do not expose interleaved-AAD APIs over this sequential driver"],"tags":["embedded","crypto","aead","gcm","cryp","panic"],"backgroundTag":"invalid-state-transition","analyzedSha":"463a07b963419a1bfe61d5d597c44acb810afb8b","analyzedAt":"2026-09-10T13:38:26.660Z","contentChangedAt":"2026-09-10T13:38:26.660Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}