{"record":{"id":"c4cd246ca6555123","repo":"shadowsocks/shadowsocks-rust","slug":"aes-128","errorCode":null,"errorMessage":"AES-128","messagePattern":"AES-128","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/shadowsocks/src/relay/tcprelay/aead_2022.rs","lineNumber":317,"sourceCode":"        // https://github.com/Shadowsocks-NET/shadowsocks-specs/blob/main/2022-2-shadowsocks-2022-extensible-identity-headers.md\n        let mut cipher = if require_eih {\n            match self.user_manager {\n                Some(ref user_manager) => {\n                    // Assume we have at least 1 EIH\n                    if header_chunk.len() < 16 {\n                        error!(\"expecting EIH, but header chunk len: {}\", header_chunk.len());\n                        return Err(ProtocolError::MissingExtendedIdentityHeader).into();\n                    }\n\n                    let (eih, remain_header_chunk) = header_chunk.split_at_mut(16);\n                    header_chunk = remain_header_chunk;\n\n                    let key_material = [key, salt].concat();\n                    let identity_sub_key = blake3::derive_key(AEAD2022_EIH_SUBKEY_CONTEXT, &key_material);\n                    let mut user_hash = Block::from([0u8; 16]);\n                    match self.method {\n                        CipherKind::AEAD2022_BLAKE3_AES_128_GCM => {\n                            let cipher = Aes128::new_from_slice(&identity_sub_key[0..16]).expect(\"AES-128\");\n                            cipher.decrypt_block_b2b(\n                                <&Block as TryFrom<&[u8]>>::try_from(eih).expect(\"EIH key length mismatch\"),\n                                &mut user_hash,\n                            );\n                        }\n                        CipherKind::AEAD2022_BLAKE3_AES_256_GCM => {\n                            let cipher = Aes256::new_from_slice(&identity_sub_key[0..32]).expect(\"AES-256\");\n                            cipher.decrypt_block_b2b(\n                                <&Block as TryFrom<&[u8]>>::try_from(eih).expect(\"EIH key length mismatch\"),\n                                &mut user_hash,\n                            );\n                        }\n                        _ => unreachable!(\"{} doesn't support EIH\", self.method),\n                    }\n\n                    let user_hash = user_hash.as_slice();\n                    trace!(\n                        \"server EIH {:?}, hash: {:?}\",","sourceCodeStart":299,"sourceCodeEnd":335,"githubUrl":"https://github.com/shadowsocks/shadowsocks-rust/blob/8eb0f0a65b1d976ab6bed5787327ef86529b0435/crates/shadowsocks/src/relay/tcprelay/aead_2022.rs#L299-L335","documentation":"In the AEAD-2022 EIH (extended identity header) handling, for AES-128 methods the identity sub-key is fed to Aes128::new_from_slice(&identity_sub_key[0..16]).expect(\"AES-128\"). blake3::derive_key always returns 32 bytes, so the 16-byte slice is guaranteed valid — this expect can only fire if derive_key returned a shorter hash or the slice bounds changed, i.e. an internal invariant of the crypto setup is broken.","triggerScenarios":"Practically unreachable while blake3 derive_key yields ≥16 bytes; could only panic if the code slicing (0..16) is modified, or a substitute KDF returns less material.","commonSituations":"Developers hitting this after modifying the key-derivation code or bumping blake3/aes crate versions with changed API semantics; not seen in normal operation.","solutions":["No user action needed — if you see it, report a bug with the version of shadowsocks-rust and blake3","If editing the code, propagate a ProtocolError instead of expect","Pin/verify blake3 crate behavior (derive_key output length) after dependency upgrades"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"debug_assert!(identity_sub_key.len() >= 16, \"EIH sub-key too short\");","typeGuard":"fn key_material_ok(k: &[u8]) -> bool { k.len() >= 16 }","tryCatchPattern":"let cipher = Aes128::new_from_slice(&identity_sub_key[0..16])\n    .map_err(|_| ProtocolError::InvalidState)?;","preventionTips":["Pin blake3 crate version in CI and test derive_key output length","Run AEAD-2022 integration tests after dependency upgrades","Do not modify the 0..16 slice bounds without adding asserts"],"tags":["rust","aead-2022","panic","cryptography"],"backgroundTag":"internal-invariant-violation","analyzedSha":"8eb0f0a65b1d976ab6bed5787327ef86529b0435","analyzedAt":"2026-09-09T12:20:43.168Z","contentChangedAt":"2026-09-09T12:20:43.168Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}