{"record":{"id":"c36c285e3c20611d","repo":"shadowsocks/shadowsocks-windows","slug":"cannot-initialize-mbed-tls-cipher-context","errorCode":null,"errorMessage":"Cannot initialize mbed TLS cipher context","messagePattern":"Cannot initialize mbed TLS cipher context","errorType":"exception","errorClass":"System.Exception","httpStatus":null,"severity":"critical","filePath":"shadowsocks-csharp/Encryption/AEAD/AEADMbedTLSEncryptor.cs","lineNumber":54,"sourceCode":"            return _ciphers;\r\n        }\r\n\r\n        public override void InitCipher(byte[] salt, bool isEncrypt, bool isUdp)\r\n        {\r\n            base.InitCipher(salt, isEncrypt, isUdp);\r\n            IntPtr ctx = Marshal.AllocHGlobal(MbedTLS.cipher_get_size_ex());\r\n            if (isEncrypt)\r\n            {\r\n                _encryptCtx = ctx;\r\n            }\r\n            else\r\n            {\r\n                _decryptCtx = ctx;\r\n            }\r\n\r\n            MbedTLS.cipher_init(ctx);\r\n            if (MbedTLS.cipher_setup(ctx, MbedTLS.cipher_info_from_string(_innerLibName)) != 0)\r\n                throw new System.Exception(\"Cannot initialize mbed TLS cipher context\");\r\n\r\n            DeriveSessionKey(isEncrypt ? _encryptSalt : _decryptSalt,\r\n                _Masterkey, _sessionKey);\r\n            CipherSetKey(isEncrypt, _sessionKey);\r\n        }\r\n\r\n        private void CipherSetKey(bool isEncrypt, byte[] key)\r\n        {\r\n            IntPtr ctx = isEncrypt ? _encryptCtx : _decryptCtx;\r\n            int ret = MbedTLS.cipher_setkey(ctx, key, keyLen * 8,\r\n                isEncrypt ? MbedTLS.MBEDTLS_ENCRYPT : MbedTLS.MBEDTLS_DECRYPT);\r\n            if (ret != 0) throw new System.Exception(\"failed to set key\");\r\n            ret = MbedTLS.cipher_reset(ctx);\r\n            if (ret != 0) throw new System.Exception(\"failed to finish preparation\");\r\n        }\r\n\r\n        public override void cipherEncrypt(byte[] plaintext, uint plen, byte[] ciphertext, ref uint clen)\r\n        {\r","sourceCodeStart":36,"sourceCodeEnd":72,"githubUrl":"https://github.com/shadowsocks/shadowsocks-windows/blob/891d971682eefcaa2e640258d3b352a3ad3b2233/shadowsocks-csharp/Encryption/AEAD/AEADMbedTLSEncryptor.cs#L36-L72","documentation":"Thrown from AEADMbedTLSEncryptor.InitCipher when MbedTLS.cipher_setup returns non-zero, meaning the native cipher context could not be configured with the cipher_info resolved from _innerLibName. This typically means cipher_info_from_string returned null/invalid for the requested algorithm because this build of mbedTLS does not include that cipher.","triggerScenarios":"The _innerLibName (e.g. \"AES-256-GCM\") is not compiled into the bundled mbedTLS binary; a method was selected that mbedTLS does not expose; the native library was swapped for a stripped build.","commonSituations":"Shipping a minimal mbedTLS build without AES-GCM/CHACHA20; mismatch between the cipher table (which lists the method) and the native library capabilities; platform-specific native lib that lacks the algorithm.","solutions":["Build/ship a full mbedTLS that includes the required ciphers (MBEDTLS_GCM_C, MBEDTLS_CHACHAPOLY_C, MBEDTLS_CHACHA20_C, MBEDTLS_POLY1305_C).","Confirm cipher_info_from_string(_innerLibName) is non-null before calling cipher_setup and surface which name failed.","Fall back to the OpenSSL AEAD encryptor if mbedTLS lacks the cipher on this platform."],"exampleFix":"// before\nif (MbedTLS.cipher_setup(ctx, MbedTLS.cipher_info_from_string(_innerLibName)) != 0)\n    throw new System.Exception(\"Cannot initialize mbed TLS cipher context\");\n\n// after: separate the lookup so the failure is specific\nvar info = MbedTLS.cipher_info_from_string(_innerLibName);\nif (info == IntPtr.Zero)\n    throw new System.Exception($\"mbed TLS has no cipher for {_innerLibName}\");\nif (MbedTLS.cipher_setup(ctx, info) != 0)\n    throw new System.Exception(\"Cannot initialize mbed TLS cipher context\");","handlingStrategy":"fallback","validationCode":"// Check cipher availability before setup\nvar info = MbedTLS.cipher_info_from_string(_innerLibName);\nif (info == IntPtr.Zero) throw new System.Exception($\"mbedTLS lacks {_innerLibName}\");","typeGuard":"bool MbedTLSSupportsCipher(string innerName) =>\n    MbedTLS.cipher_info_from_string(innerName) != IntPtr.Zero;","tryCatchPattern":"try { useMbedTLS(); }\ncatch (Exception ex) when (ex.Message.Contains(\"mbed TLS cipher context\"))\n{ /* fall back to OpenSSL AEAD encryptor for this method */ }","preventionTips":["Ship a full mbedTLS build (GCM + CHACHAPOLY) or fall back to OpenSSL.","Validate cipher_info_from_string at startup for all advertised methods.","Pin the native mbedTLS version to one known to include your ciphers."],"tags":["encryption","aead","mbedtls","cipher","native-library"],"backgroundTag":null,"analyzedSha":"891d971682eefcaa2e640258d3b352a3ad3b2233","analyzedAt":"2026-08-13T10:12:34.434Z","schemaVersion":2},"datasetVersion":"2026-08-13T14:17:21.547Z"}