{"record":{"id":"f0e62e0ca5520142","repo":"XTLS/Xray-core","slug":"write-encryption-response-w","errorCode":null,"errorMessage":"write encryption response: %w","messagePattern":"write encryption response: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"transport/internet/finalmask/xmc/client.go","lineNumber":180,"sourceCode":"\t\treturn fmt.Errorf(\"encrypt shared secret: %w\", err)\n\t}\n\n\tverifyToken = append(verifyToken, []byte(c.password)...) // append pre-shared password\n\n\tencryptedVerifyToken, err := rsa.EncryptPKCS1v15(rand.Reader, rsaPublicKey, verifyToken)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"encrypt verify token: %w\", err)\n\t}\n\n\t// Send Encryption Response\n\terr = writePacket(\n\t\tc.writer,\n\t\t0x01,\n\t\t(*Bytes)(&encryptedSharedSecret),\n\t\t(*Bytes)(&encryptedVerifyToken),\n\t)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"write encryption response: %w\", err)\n\t}\n\n\t// Enable encryption\n\tc.reader, err = newCryptoReader(c.reader, sharedSecret)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"new crypto reader: %w\", err)\n\t}\n\n\tc.writer, err = newCryptoWriter(c.writer, sharedSecret)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"new crypto writer: %w\", err)\n\t}\n\n\tpkt, err = readPacket(c.reader)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"read login finished: %w\", err)\n\t}\n\tif pkt.packetID == 0x00 {","sourceCodeStart":162,"sourceCodeEnd":198,"githubUrl":"https://github.com/XTLS/Xray-core/blob/7d214f8b094f75322fa3990f8aadad1c912f24f5/transport/internet/finalmask/xmc/client.go#L162-L198","documentation":"Writing the Encryption Response packet (0x01 with the RSA-encrypted shared secret and verify token) to the underlying connection failed. This is a plain network/socket error on the raw TCP conn, wrapped by writePacket — connection reset, broken pipe, write deadline exceeded, or the peer closed during handshake.","triggerScenarios":"The first Read or Write on the conn returned by WrapConnClient executes the deferred handshake; it fails when the server (or a middlebox) closed the TCP connection between sending the Encryption Request and receiving the response, or the handshake deadline fired (deadlines.beginHandshake).","commonSituations":"Server rejected the connection at the socket level, NAT/firewall idle teardown, wrong port pointing at a non-xmc service that closed after garbage input, or a handshake timeout that is too tight.","solutions":["Check the wrapped error: io.EOF/reset/timeout tells you whether it is peer-close or deadline","Verify the outbound config points at the real xmc server address and port","Increase or review handshake timeout settings on the underlying connection","Look at server-side logs at that moment — the server may be aborting due to its own key/profile errors"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"n, err := conn.Read(buf)\nif err != nil {\n    if strings.Contains(err.Error(), \"write encryption response\") {\n        return backoff.Retry(dialAndWrap, 3) // transient network cut during handshake\n    }\n    return err\n}","preventionTips":["Treat first-Read/Write errors as setup failures: close, re-dial, retry with backoff","Keep handshake deadlines modest so dead peers fail fast","Log server-side events correlated with client handshake failures"],"tags":["network","tcp","handshake","go"],"backgroundTag":null,"analyzedSha":"7d214f8b094f75322fa3990f8aadad1c912f24f5","analyzedAt":"2026-08-15T14:26:24.325Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}