{"record":{"id":"fe8d6d225856eeab","repo":"OpenNHP/opennhp","slug":"failed-to-create-sm4-cipher-for-cbc-decryption-w","errorCode":null,"errorMessage":"failed to create SM4 cipher for CBC decryption: %w","messagePattern":"failed to create SM4 cipher for CBC decryption: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nhp/core/crypto.go","lineNumber":251,"sourceCode":"\treturn ciphertext, nil\n}\n\nfunc CBCDecryption(t GcmTypeEnum, key *[SymmetricKeySize]byte, ciphertext []byte, inPlace bool) ([]byte, error) {\n\tvar block cipher.Block\n\tvar iv []byte\n\tvar err error\n\tswitch t {\n\tcase GCM_AES256:\n\t\tblock, err = aes.NewCipher(key[:])\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to create AES cipher for CBC decryption: %w\", err)\n\t\t}\n\t\tiv = key[8:24]\n\n\tcase GCM_SM4:\n\t\tblock, err = sm4.NewCipher(key[:16])\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to create SM4 cipher for CBC decryption: %w\", err)\n\t\t}\n\t\tiv = key[16:]\n\n\tcase GCM_CHACHA20POLY1305:\n\t\treturn nil, ErrNotApplicable\n\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"unsupported cipher type for CBC decryption: %d\", t)\n\t}\n\n\t// Validate ciphertext: must be at least one block and a multiple of block size\n\tif len(ciphertext) < block.BlockSize() {\n\t\treturn nil, fmt.Errorf(\"ciphertext too short: need at least %d bytes\", block.BlockSize())\n\t}\n\tif len(ciphertext)%block.BlockSize() != 0 {\n\t\treturn nil, fmt.Errorf(\"ciphertext length %d is not a multiple of block size %d\", len(ciphertext), block.BlockSize())\n\t}\n","sourceCodeStart":233,"sourceCodeEnd":269,"githubUrl":"https://github.com/OpenNHP/opennhp/blob/6e04ca5ff03222a699c24205cd4bf8fee9af7ffe/nhp/core/crypto.go#L233-L269","documentation":"In CBCDecryption's GCM_SM4 branch, sm4.NewCipher(key[:16]) failed. SM4 requires a 16-byte key; the first 16 bytes of the supplied key buffer were invalid for SM4 key construction. Like the AES variant, this indicates malformed key material rather than a transient fault.","triggerScenarios":"Calling CBCDecryption with GCM_SM4 where the key buffer's first 16 bytes are invalid for the SM4 implementation — e.g. an all-zero, wrong-length, or mis-derived key array passed in.","commonSituations":"SM2/SM4 (CIPHER_SCHEME_GMSM) deployments where curve keys were generated with --curve instead of --sm2; key bytes copied from a base64 string that decoded to the wrong length; mixing AES and SM4 keys across peers.","solutions":["Regenerate keys with `nhp-serverd keygen --sm2` (or the matching keygen) so SM4-compatible key material is used.","Ensure the key passed corresponds to CIPHER_SCHEME_GMSM, not a curve25519/AES key.","Verify the first 16 bytes of the key slice are the intended SM4 key and the slice was filled correctly.","Inspect the wrapped %w error for the exact sm4.NewCipher failure reason."],"exampleFix":"// before\nsharedKey := core.DeriveCurveKey(...) // 32-byte curve key used with SM4\nplain, err := core.CBCDecryption(core.GCM_SM4, sharedKey, ct, false)\n// after\nif cfg.CipherScheme == core.CIPHER_SCHEME_GMSM {\n    sharedKey = core.DeriveSMKey(...) // SM-compatible key\n}","handlingStrategy":"validation","validationCode":"if scheme == core.GCM_SM4 && isCurveKey(keyMaterial) {\n    return errors.New(\"SM4 requires SM2-scheme key material, not curve25519 key\")\n}","typeGuard":null,"tryCatchPattern":"plain, err := core.CBCDecryption(core.GCM_SM4, key, ct, false)\nif err != nil {\n    return fmt.Errorf(\"SM4 CBC decrypt (verify --sm2 keygen keys): %w\", err)\n}","preventionTips":["Use `keygen --sm2` for GMSM deployments and `--curve` otherwise; never mix.","Tag key material with its scheme and check scheme matches the cipher before use.","Test decrypt with a known vector at startup to fail fast on bad keys."],"tags":["go","crypto","sm4","key-length"],"backgroundTag":"invalid-argument-value","analyzedSha":"6e04ca5ff03222a699c24205cd4bf8fee9af7ffe","analyzedAt":"2026-09-07T15:44:59.941Z","contentChangedAt":"2026-09-07T15:44:59.941Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}