{"record":{"id":"b9ddcb12dee987dd","repo":"tailscale/tailscale","slug":"can-t-seal-with-zero-keys","errorCode":null,"errorMessage":"can't seal with zero keys","messagePattern":"can't seal with zero keys","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"types/key/machine.go","lineNumber":106,"sourceCode":"// Deprecated: this function is risky to use, because it produces\n// serialized values that do not identify themselves as a\n// MachinePrivate, allowing other code to potentially parse it back in\n// as the wrong key type. For new uses that don't require this\n// specific raw byte serialization, please use\n// MarshalText/UnmarshalText.\nfunc (k MachinePrivate) UntypedBytes() []byte {\n\treturn bytes.Clone(k.k[:])\n}\n\n// SealTo wraps cleartext into a NaCl box (see\n// golang.org/x/crypto/nacl) to p, authenticated from k, using a\n// random nonce.\n//\n// The returned ciphertext is a 24-byte nonce concatenated with the\n// box value.\nfunc (k MachinePrivate) SealTo(p MachinePublic, cleartext []byte) (ciphertext []byte) {\n\tif k.IsZero() || p.IsZero() {\n\t\tpanic(\"can't seal with zero keys\")\n\t}\n\tvar nonce [24]byte\n\trand(nonce[:])\n\treturn box.Seal(nonce[:], cleartext, &nonce, &p.k, &k.k)\n}\n\n// SharedKey returns the precomputed Nacl box shared key between k and p.\nfunc (k MachinePrivate) SharedKey(p MachinePublic) MachinePrecomputedSharedKey {\n\tvar shared MachinePrecomputedSharedKey\n\tbox.Precompute(&shared.k, &p.k, &k.k)\n\treturn shared\n}\n\n// MachinePrecomputedSharedKey is a precomputed shared NaCl box shared key.\ntype MachinePrecomputedSharedKey struct {\n\tk [32]byte\n}\n","sourceCodeStart":88,"sourceCodeEnd":124,"githubUrl":"https://github.com/tailscale/tailscale/blob/6e0912f97994f927632b34ae9e63b53d6516a6ac/types/key/machine.go#L88-L124","documentation":"Programming guard in MachinePrivate.SealTo: NaCl box sealing to a peer was attempted with a zero private key (or otherwise degenerate key state), which would yield unauthenticated ciphertext, so the method panics.","triggerScenarios":"Thrown at types/key/machine.go:106 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Initialize the MachinePrivate before any SealTo operation","Guard with IsZero() when the machine key may legitimately be absent","Verify key loading/persistence at startup"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"6e0912f97994f927632b34ae9e63b53d6516a6ac","analyzedAt":"2026-08-18T08:17:25.280Z","contentChangedAt":"2026-08-18T08:17:25.280Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}