{"record":{"id":"e16baed5cb7e87af","repo":"shadowsocks/shadowsocks-windows","slug":"openssl-fail-to-set-aead-nonce-length","errorCode":null,"errorMessage":"openssl: fail to set AEAD nonce length","messagePattern":"openssl: fail to set AEAD nonce length","errorType":"exception","errorClass":"System.Exception","httpStatus":null,"severity":"critical","filePath":"shadowsocks-csharp/Encryption/AEAD/AEADOpenSSLEncryptor.cs","lineNumber":75,"sourceCode":"            }\r\n            else\r\n            {\r\n                _decryptCtx = ctx;\r\n            }\r\n\r\n            DeriveSessionKey(isEncrypt ? _encryptSalt : _decryptSalt, _Masterkey,\r\n                isEncrypt ? _opensslEncSubkey : _opensslDecSubkey);\r\n\r\n            var ret = OpenSSL.EVP_CipherInit_ex(ctx, _cipherInfoPtr, IntPtr.Zero, null, null,\r\n                isEncrypt ? OpenSSL.OPENSSL_ENCRYPT : OpenSSL.OPENSSL_DECRYPT);\r\n            if (ret != 1) throw new System.Exception(\"openssl: fail to init ctx\");\r\n\r\n            ret = OpenSSL.EVP_CIPHER_CTX_set_key_length(ctx, keyLen);\r\n            if (ret != 1) throw new System.Exception(\"openssl: fail to set key length\");\r\n\r\n            ret = OpenSSL.EVP_CIPHER_CTX_ctrl(ctx, OpenSSL.EVP_CTRL_AEAD_SET_IVLEN,\r\n                nonceLen, IntPtr.Zero);\r\n            if (ret != 1) throw new System.Exception(\"openssl: fail to set AEAD nonce length\");\r\n\r\n            ret = OpenSSL.EVP_CipherInit_ex(ctx, IntPtr.Zero, IntPtr.Zero,\r\n                isEncrypt ? _opensslEncSubkey : _opensslDecSubkey,\r\n                null,\r\n                isEncrypt ? OpenSSL.OPENSSL_ENCRYPT : OpenSSL.OPENSSL_DECRYPT);\r\n            if (ret != 1) throw new System.Exception(\"openssl: cannot set key\");\r\n            OpenSSL.EVP_CIPHER_CTX_set_padding(ctx, 0);\r\n        }\r\n\r\n        public override void cipherEncrypt(byte[] plaintext, uint plen, byte[] ciphertext, ref uint clen)\r\n        {\r\n            OpenSSL.SetCtxNonce(_encryptCtx, _encNonce, true);\r\n            // buf: all plaintext\r\n            // outbuf: ciphertext + tag\r\n            int ret;\r\n            int tmpLen = 0;\r\n            clen = 0;\r\n            var tagBuf = new byte[tagLen];\r","sourceCodeStart":57,"sourceCodeEnd":93,"githubUrl":"https://github.com/shadowsocks/shadowsocks-windows/blob/891d971682eefcaa2e640258d3b352a3ad3b2233/shadowsocks-csharp/Encryption/AEAD/AEADOpenSSLEncryptor.cs#L57-L93","documentation":"Thrown from AEADOpenSSLEncryptor.InitCipher when EVP_CIPHER_CTX_ctrl with EVP_CTRL_AEAD_SET_IVLEN returns != 1. This ctrl call sets the nonce/IV length for the AEAD cipher; OpenSSL rejects it if the length is not allowed by the cipher (e.g. not the standard 12 for GCM) or if the cipher does not support variable IV length.","triggerScenarios":"nonceLen is not 12 for AES-GCM (the spec length); the selected cipher is not actually an AEAD cipher; nonceLen computed wrong from EncryptorInfo.NonceSize.","commonSituations":"EncryptorInfo.NonceSize set to a non-standard value; method misclassified as AEAD in the cipher table; a CHACHA20 cipher expecting a different IV length.","solutions":["Confirm EncryptorInfo.NonceSize is 12 for GCM/CHACHA20-POLY1305.","Ensure the method is genuinely an AEAD cipher handled by this code path.","Cross-check nonceLen against the cipher specification before init."],"exampleFix":"// before\nret = OpenSSL.EVP_CIPHER_CTX_ctrl(ctx, OpenSSL.EVP_CTRL_AEAD_SET_IVLEN, nonceLen, IntPtr.Zero);\nif (ret != 1) throw new System.Exception(\"openssl: fail to set AEAD nonce length\");\n\n// after\nif (ret != 1)\n    throw new System.Exception($\"openssl: fail to set AEAD nonce length (nonceLen={nonceLen}); must be 12 for GCM/CHACHA20\");","handlingStrategy":"validation","validationCode":"// Validate nonce length before the ctrl call\nif (nonceLen != 12) throw new ArgumentException($\"AEAD nonce must be 12, got {nonceLen}\");","typeGuard":"bool IsStandardAeadNonceLen(int n) => n == 12;","tryCatchPattern":"try { OpenSSL.EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_IVLEN, nonceLen, IntPtr.Zero); }\ncatch (Exception ex) when (ex.Message.Contains(\"nonce length\"))\n{ /* fix EncryptorInfo.NonceSize to 12 */ }","preventionTips":["Keep EncryptorInfo.NonceSize at 12 for GCM/CHACHA20-POLY1305.","Ensure the method is genuinely AEAD before this code path.","Validate nonce length against the cipher spec during config load."],"tags":["encryption","aead","openssl","nonce","configuration"],"backgroundTag":null,"analyzedSha":"891d971682eefcaa2e640258d3b352a3ad3b2233","analyzedAt":"2026-08-13T10:12:34.434Z","schemaVersion":2},"datasetVersion":"2026-08-13T14:17:21.547Z"}