{"record":{"id":"da6bcfd949ef5f04","repo":"XTLS/Xray-core","slug":"new-crypto-writer-w","errorCode":null,"errorMessage":"new crypto writer: %w","messagePattern":"new crypto writer: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"transport/internet/finalmask/xmc/client.go","lineNumber":191,"sourceCode":"\terr = writePacket(\n\t\tc.writer,\n\t\t0x01,\n\t\t(*Bytes)(&encryptedSharedSecret),\n\t\t(*Bytes)(&encryptedVerifyToken),\n\t)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"write encryption response: %w\", err)\n\t}\n\n\t// Enable encryption\n\tc.reader, err = newCryptoReader(c.reader, sharedSecret)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"new crypto reader: %w\", err)\n\t}\n\n\tc.writer, err = newCryptoWriter(c.writer, sharedSecret)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"new crypto writer: %w\", err)\n\t}\n\n\tpkt, err = readPacket(c.reader)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"read login finished: %w\", err)\n\t}\n\tif pkt.packetID == 0x00 {\n\t\tvar reason String\n\t\tif readErr := pkt.readFields(&reason); readErr != nil {\n\t\t\treturn fmt.Errorf(\"authentication rejected\")\n\t\t}\n\t\treturn fmt.Errorf(\"authentication rejected: %s\", reason)\n\t}\n\tif pkt.packetID != 0x02 {\n\t\treturn fmt.Errorf(\"bad login finished packet id: %d\", pkt.packetID)\n\t}\n\n\treceivedProfile, err := readLoginSuccess(pkt)","sourceCodeStart":173,"sourceCodeEnd":209,"githubUrl":"https://github.com/XTLS/Xray-core/blob/7d214f8b094f75322fa3990f8aadad1c912f24f5/transport/internet/finalmask/xmc/client.go#L173-L209","documentation":"Constructing the AES-CFB crypto writer failed in newCryptoWriter, symmetric to error 866. It initializes the outbound cipher from the same fixed 16-byte sharedSecret, so aes.NewCipher cannot fail and this branch is defensive dead code under current upstream sources.","triggerScenarios":"First Write after the Encryption Response; only fires if the shared secret length was changed away from 16 bytes or newCryptoWriter's internals were modified in a fork.","commonSituations":"Not observed in practice; would indicate a customized build.","solutions":["Verify the 16-byte shared secret is untouched in your build","Compare your crypto.go with upstream","File an upstream issue with a reproducer if it occurs on stock code"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"if _, err := conn.Write(buf); err != nil && strings.Contains(err.Error(), \"new crypto writer\") {\n    log.Error(\"unexpected crypto init failure\", \"err\", err)\n    return err // no retry: deterministic init failure\n}","preventionTips":["Keep AES key material at fixed sizes (16/24/32 bytes)","Avoid forks that alter crypto constructors","Add CI tests exercising the full client/server handshake"],"tags":["crypto","aes","internal","go"],"backgroundTag":null,"analyzedSha":"7d214f8b094f75322fa3990f8aadad1c912f24f5","analyzedAt":"2026-08-15T14:26:24.325Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}