{"record":{"id":"b267f40214ed592e","repo":"XTLS/Xray-core","slug":"derive-minecraft-rsa-key-w","errorCode":null,"errorMessage":"derive minecraft rsa key: %w","messagePattern":"derive minecraft rsa key: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"infra/conf/transport_finalmask.go","lineNumber":772,"sourceCode":"\t\tUsername:          c.Username,\n\t\tUuid:              append([]byte(nil), profileUUID[:]...),\n\t\tTexturesValue:     c.TexturesValue,\n\t\tTexturesSignature: c.TexturesSignature,\n\t}, nil\n}\n\nfunc (c *XMC) Build() (proto.Message, error) {\n\tif len(c.Profiles) == 0 {\n\t\treturn nil, fmt.Errorf(\"minecraft profiles are required\")\n\t}\n\n\tif c.Password == \"\" {\n\t\treturn nil, fmt.Errorf(\"empty password\")\n\t}\n\n\trsaPrivateKey, err := xmc.DeriveRSAKey(c.Password)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"derive minecraft rsa key: %w\", err)\n\t}\n\n\trsaPublicKey, err := x509.MarshalPKIXPublicKey(&rsaPrivateKey.PublicKey)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"marshal minecraft rsa public key: %w\", err)\n\t}\n\n\tprofiles := make([]*xmc.Profile, 0, len(c.Profiles))\n\tfor i := range c.Profiles {\n\t\tprofile, err := c.Profiles[i].Build()\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"build minecraft profile %d: %w\", i, err)\n\t\t}\n\t\tprofiles = append(profiles, profile)\n\t}\n\n\treturn &xmc.Config{\n\t\tPassword:      c.Password,","sourceCodeStart":754,"sourceCodeEnd":790,"githubUrl":"https://github.com/XTLS/Xray-core/blob/7d214f8b094f75322fa3990f8aadad1c912f24f5/infra/conf/transport_finalmask.go#L754-L790","documentation":"XMC.Build calls xmc.DeriveRSAKey(c.Password) to stretch the shared password into an RSA private key; this error wraps any failure inside that derivation routine. It is an internal crypto/strecthing failure, not a config-syntax problem.","triggerScenarios":"A non-empty password that the derivation routine still rejects (e.g. parameters unsuitable for the stretch function). In practice extremely rare; most XMC password problems surface earlier as the empty-password check.","commonSituations":"Version skew between client and server xray builds where DeriveRSAKey's parameter validation changed; pathological password values (extremely long, or containing only whitespace/NUL) if the routine validates input.","solutions":["Read the wrapped %w error to see which step of derivation failed","Retry with a normal printable-ASCII password of moderate length","Align client and server on the same xray-core version so DeriveRSAKey behaves identically","If it persists on current versions, report upstream with the (non-secret) password shape"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"if _, err := xmcConfig.Build(); err != nil {\n    if strings.Contains(err.Error(), \"derive minecraft rsa key\") {\n        // internal derivation failure: change password material and retry once, then surface\n        return fmt.Errorf(\"xmc key derivation failed (likely version skew or bad password shape): %w\", err)\n    }\n    return err\n}","preventionTips":["Keep client and server xray-core versions aligned","Avoid pathological password values (NULs, extreme length)","Log the wrapped error — it names the failing derivation step"],"tags":["xmc","minecraft","crypto","rsa"],"backgroundTag":null,"analyzedSha":"7d214f8b094f75322fa3990f8aadad1c912f24f5","analyzedAt":"2026-08-15T14:26:24.325Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}