{"record":{"id":"b3763c80c8ac7747","repo":"OpenNHP/opennhp","slug":"failed-to-create-blake2s-hash-w","errorCode":null,"errorMessage":"failed to create blake2s hash: %w","messagePattern":"failed to create blake2s hash: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nhp/core/crypto.go","lineNumber":90,"sourceCode":"\tcase common.CIPHER_SCHEME_CURVE:\n\t\tfallthrough\n\tdefault:\n\t\tciphers = &CipherSuite{\n\t\t\tScheme:   common.CIPHER_SCHEME_CURVE,\n\t\t\tHashType: HASH_BLAKE2S,\n\t\t\tEccType:  ECC_CURVE25519,\n\t\t\tGcmType:  GCM_AES256,\n\t\t}\n\t}\n\treturn\n}\n\nfunc NewHash(t HashTypeEnum) (hash.Hash, error) {\n\tswitch t {\n\tcase HASH_BLAKE2S:\n\t\th, err := blake2s.New256(nil)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to create blake2s hash: %w\", err)\n\t\t}\n\t\treturn h, nil\n\n\tcase HASH_SM3:\n\t\treturn sm3.New(), nil\n\n\tcase HASH_SHA256:\n\t\treturn sha256.New(), nil\n\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"unsupported hash type: %d\", t)\n\t}\n}\n\ntype Ecdh interface {\n\tSetPrivateKey(prk []byte) error\n\tPrivateKey() []byte\n\tPublicKey() []byte","sourceCodeStart":72,"sourceCodeEnd":108,"githubUrl":"https://github.com/OpenNHP/opennhp/blob/6e04ca5ff03222a699c24205cd4bf8fee9af7ffe/nhp/core/crypto.go#L72-L108","documentation":"NewHash(HASH_BLAKE2S) wraps the error returned by blake2s.New256(nil) when the BLAKE2s hash object cannot be constructed. In golang.org/x/crypto/blake2s, New256 only fails if a non-nil key of invalid length is supplied; since OpenNHP always passes nil, this error is practically unreachable and would indicate a broken/modified dependency. It exists so callers receive a wrapped, typed error rather than a panic.","triggerScenarios":"Calling NewHash(HASH_BLAKE2S) when the underlying blake2s.New256(nil) call returns an error — in stock golang.org/x/crypto this only happens if a keyed hash is requested with a key whose length exceeds blake2s.Size (32 bytes); OpenNHP passes nil so this cannot normally fire.","commonSituations":"A vendored or replaced golang.org/x/crypto version whose blake2s implementation differs; a fork that changed NewHash to pass a key; build/dependency corruption. Regular users will essentially never see it during normal knock/protocol operation.","solutions":["Run 'go mod tidy' and 'go mod verify' to ensure an unmodified golang.org/x/crypto dependency","Inspect any Replace directives in go.mod that point blake2s/x-crypto at a fork","Log the wrapped error (%w chain) to see the root cause reported by the blake2s package","If you control the call site, keep key=nil for plain hashing; use blake2s keyed mode only with a key of exactly 32 bytes"],"exampleFix":"// before\nh, err := blake2s.New256(someKey) // key of arbitrary length\n// after\nif len(someKey) != 0 && len(someKey) > blake2s.Size {\n    someKey = someKey[:blake2s.Size]\n}\nh, err := blake2s.New256(nil) // plain hash, cannot fail in practice","handlingStrategy":"try-catch","validationCode":"if hashType != core.HASH_BLAKE2S && hashType != core.HASH_SM3 && hashType != core.HASH_SHA256 {\n    return fmt.Errorf(\"unsupported hash type %d before calling NewHash\", hashType)\n}","typeGuard":"func isValidHashType(t core.HashTypeEnum) bool {\n    return t == core.HASH_BLAKE2S || t == core.HASH_SM3 || t == core.HASH_SHA256\n}","tryCatchPattern":"h, err := core.NewHash(core.HASH_BLAKE2S)\nif err != nil {\n    return fmt.Errorf(\"hash init failed: %w\", err)\n}\ndefer h.Reset()","preventionTips":["Always request hash types from NewCipherSuite(scheme) rather than hand-picking","Keep golang.org/x/crypto unmodified; verify with go mod verify","Never pass a keyed blake2s argument unless the key is exactly 32 bytes"],"tags":["crypto","hash","blake2s","go"],"backgroundTag":"internal-invariant-violation","analyzedSha":"6e04ca5ff03222a699c24205cd4bf8fee9af7ffe","analyzedAt":"2026-09-07T15:44:59.941Z","contentChangedAt":"2026-09-07T15:44:59.941Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}