{"record":{"id":"fddb85b85fb1f234","repo":"OpenNHP/opennhp","slug":"failed-to-create-hmac-hash-w-fddb85","errorCode":null,"errorMessage":"failed to create HMAC hash: %w","messagePattern":"failed to create HMAC hash: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nhp/core/responder.go","lineNumber":314,"sourceCode":"\t}\n\n\t// init chain hash -> ChainHash0\n\tppd.chainHash, err = NewHash(ppd.Ciphers.HashType)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to create chain hash: %w\", err)\n\t}\n\tppd.chainHash.Write([]byte(InitialHashString))\n\n\t// init chain key -> ChainKey0\n\tppd.noise.HashType = ppd.Ciphers.HashType\n\tppd.noise.MixKey(&ppd.chainKey, ppd.chainHash.Sum(nil), []byte(InitialChainKeyString))\n\n\tppd.HeaderType, ppd.BodySize = ppd.header.TypeAndPayloadSize()\n\n\t// init hmac hash -> HmacHash0\n\tppd.hmacHash, err = NewHash(ppd.Ciphers.HashType)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to create HMAC hash: %w\", err)\n\t}\n\tppd.hmacHash.Write([]byte(InitialHashString))\n\n\t// evolve hmac hash HmacHash0 -> HmacHash1\n\tppd.hmacHash.Write(ppd.deviceEcdh.PublicKey())\n\n\t// check hmac\n\tif ppd.device.deviceType == NHP_SERVER {\n\t\t// server overload handling\n\t\toverload := ppd.device.IsOverload()\n\t\tif overload {\n\t\t\t// overload, further discard unwanted packet type\n\t\t\tppd.Overload = true\n\t\t\tif !ppd.IsAllowedAtOverload() {\n\t\t\t\tlog.Critical(\"discard packet type %d due to overload\", ppd.HeaderType)\n\t\t\t\terr = ErrServerOverload\n\t\t\t\treturn\n\t\t\t}","sourceCodeStart":296,"sourceCodeEnd":332,"githubUrl":"https://github.com/OpenNHP/opennhp/blob/6e04ca5ff03222a699c24205cd4bf8fee9af7ffe/nhp/core/responder.go#L296-L332","documentation":"Immediately after the chain hash, createPacketParserData initializes the HMAC hash (HmacHash0) used for per-packet MAC verification; NewHash failed for the same class of reasons as the chain-hash error — the CipherSuite's HashType is unsupported or the hash backend is broken. Packet processing aborts before HMAC checking, so no message is decrypted or dispatched.","triggerScenarios":"Same as the chain-hash failure: invalid HashType reaching NewHash from NewCipherSuite during PacketToMsg/parseRKNOnServer, or a failing hash backend; typically only after customizing cipher suites or upgrading the crypto dependency.","commonSituations":"Custom crypto builds; dependency regressions; hand-constructed CipherSuites in tests or plugins; practically never in stock deployments where both schemes use always-available hashes.","solutions":["Log ppd.Ciphers.HashType and ppd.CipherScheme at failure to identify the unsupported value.","Rebuild against a known-good crypto dependency version where SM3/BLAKE2s instantiate correctly.","Ensure all CipherSuites are produced by NewCipherSuite rather than constructed literally.","Add boot-time smoke tests calling NewHash for each supported scheme."],"exampleFix":"// before\ntestSuite := &core.CipherSuite{HashType: 0xFF}\n_ , err := d.CreatePacketParserData(pd) // failed to create HMAC hash\n// after\ntestSuite := core.NewCipherSuite(common.CIPHER_SCHEME_GMSM)\n_, err := d.CreatePacketParserData(pd)","handlingStrategy":"try-catch","validationCode":"if _, err := core.NewHash(suite.HashType); err != nil {\n\treturn fmt.Errorf(\"hmac hash unavailable for hashType %d\", suite.HashType)\n}","typeGuard":null,"tryCatchPattern":"ppd.hmacHash, err = NewHash(ppd.Ciphers.HashType)\nif err != nil {\n\tlog.Error(\"hmac hash init failed hashType=%d: %v\", ppd.Ciphers.HashType, err)\n\treturn nil, fmt.Errorf(\"failed to create HMAC hash: %w\", err)\n}","preventionTips":["Shared root cause with chain-hash init — apply the same startup smoke tests.","Never hand-populate CipherSuite fields.","Keep hash implementations compiled into all build variants.","Alert on first occurrence; it indicates a backend/build problem, not bad traffic."],"tags":["go","cryptography","hash-init","hmac"],"backgroundTag":"module-init-failed","analyzedSha":"6e04ca5ff03222a699c24205cd4bf8fee9af7ffe","analyzedAt":"2026-09-07T15:44:59.941Z","contentChangedAt":"2026-09-07T15:44:59.941Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}