{"record":{"id":"ba57fd50671ae4d8","repo":"OpenNHP/opennhp","slug":"failed-to-create-aes-gcm-w","errorCode":null,"errorMessage":"failed to create AES-GCM: %w","messagePattern":"failed to create AES-GCM: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nhp/core/crypto.go","lineNumber":160,"sourceCode":"\t\te = curve.NewECDH()\n\n\tcase ECC_SM2:\n\t\te = gmsm.NewECDH()\n\t}\n\n\treturn e\n}\n\nfunc AeadFromKey(t GcmTypeEnum, key *[SymmetricKeySize]byte) (cipher.AEAD, error) {\n\tswitch t {\n\tcase GCM_AES256:\n\t\taesBlock, err := aes.NewCipher(key[:])\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to create AES cipher: %w\", err)\n\t\t}\n\t\taead, err := cipher.NewGCM(aesBlock)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to create AES-GCM: %w\", err)\n\t\t}\n\t\treturn aead, nil\n\n\tcase GCM_SM4:\n\t\tsm4Block, err := sm4.NewCipher(key[:16])\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to create SM4 cipher: %w\", err)\n\t\t}\n\t\taead, err := cipher.NewGCM(sm4Block)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to create SM4-GCM: %w\", err)\n\t\t}\n\t\treturn aead, nil\n\n\tcase GCM_CHACHA20POLY1305:\n\t\taead, err := chacha20poly1305.New(key[:])\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to create ChaCha20-Poly1305: %w\", err)","sourceCodeStart":142,"sourceCodeEnd":178,"githubUrl":"https://github.com/OpenNHP/opennhp/blob/6e04ca5ff03222a699c24205cd4bf8fee9af7ffe/nhp/core/crypto.go#L142-L178","documentation":"AeadFromKey wraps cipher.NewGCM(aesBlock) failure with this message. Go's cipher.NewGCM returns an error only if the block cipher's block size is not 16 bytes; a real aes.Block from crypto/aes always has a 16-byte block size, so this error is practically unreachable with the standard library and signals dependency corruption or a custom cipher.Block implementation. It is defensive wrapping for completeness.","triggerScenarios":"cipher.NewGCM receiving a block whose BlockSize() != 16 — only possible if crypto/aes is replaced by a non-conforming implementation or the Go toolchain/dependency graph is corrupted.","commonSituations":"Vendored or forked Go crypto stacks, exotic build environments, or tampered dependencies. Normal OpenNHP operation (knock, ACK, DHP traffic encryption) will not hit it.","solutions":["Run 'go mod verify' and rebuild with an official Go toolchain","Check for replace directives or vendored forks of crypto/cipher or crypto/aes","Update Go to a current supported release and rerun go test ./nhp/core/...","Log the wrapped error to capture the underlying NewGCM message"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"block, err := aes.NewCipher(key[:])\nif err == nil && block.BlockSize() != 16 {\n    return fmt.Errorf(\"unexpected AES block size %d\", block.BlockSize())\n}","typeGuard":null,"tryCatchPattern":"aead, err := core.AeadFromKey(core.GCM_AES256, &key)\nif err != nil {\n    return fmt.Errorf(\"GCM init failed: %w\", err)\n}","preventionTips":["Use official Go toolchains and unmodified crypto dependencies (go mod verify)","Avoid vendored forks of crypto/aes or crypto/cipher","Treat any occurrence as a build/dependency integrity incident"],"tags":["crypto","aes","gcm","go"],"backgroundTag":"internal-invariant-violation","analyzedSha":"6e04ca5ff03222a699c24205cd4bf8fee9af7ffe","analyzedAt":"2026-09-07T15:44:59.941Z","contentChangedAt":"2026-09-07T15:44:59.941Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}