{"record":{"id":"ff7d60f1b5f87252","repo":"golang/go","slug":"cipher-message-authentication-failed-ff7d60","errorCode":null,"errorMessage":"cipher: message authentication failed","messagePattern":"cipher: message authentication failed","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/internal/boring/aes.go","lineNumber":349,"sourceCode":"\tif inexactOverlap(dst[n:], plaintext) {\n\t\tpanic(\"cipher: invalid buffer overlap\")\n\t}\n\n\toutLen := C.size_t(len(plaintext) + gcmTagSize)\n\tok := C.EVP_AEAD_CTX_seal_wrapper(\n\t\t&g.ctx,\n\t\t(*C.uint8_t)(unsafe.Pointer(&dst[n])), outLen,\n\t\tbase(nonce), C.size_t(len(nonce)),\n\t\tbase(plaintext), C.size_t(len(plaintext)),\n\t\tbase(additionalData), C.size_t(len(additionalData)))\n\truntime.KeepAlive(g)\n\tif ok == 0 {\n\t\tpanic(fail(\"EVP_AEAD_CTX_seal\"))\n\t}\n\treturn dst[:n+int(outLen)]\n}\n\nvar errOpen = errors.New(\"cipher: message authentication failed\")\n\nfunc (g *aesGCM) Open(dst, nonce, ciphertext, additionalData []byte) ([]byte, error) {\n\tif len(nonce) != gcmStandardNonceSize {\n\t\tpanic(\"cipher: incorrect nonce length given to GCM\")\n\t}\n\tif len(ciphertext) < gcmTagSize {\n\t\treturn nil, errOpen\n\t}\n\tif uint64(len(ciphertext)) > ((1<<32)-2)*aesBlockSize+gcmTagSize {\n\t\treturn nil, errOpen\n\t}\n\n\t// Make room in dst to append ciphertext without tag.\n\tn := len(dst)\n\tfor cap(dst) < n+len(ciphertext)-gcmTagSize {\n\t\tdst = append(dst[:cap(dst)], 0)\n\t}\n\tdst = dst[:n+len(ciphertext)-gcmTagSize]","sourceCodeStart":331,"sourceCodeEnd":367,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/internal/boring/aes.go#L331-L367","documentation":"errOpen is returned by aesGCM.Open when the ciphertext cannot be authenticated — either because it is shorter than the GCM tag (16 bytes), exceeds the maximum GCM plaintext bound, or the authentication tag does not verify during decryption. It is the standard 'cipher: message authentication failed' sentinel reused by crypto/cipher.","triggerScenarios":"Calling AEAD.Open with ciphertext shorter than gcmTagSize (16), ciphertext larger than ((1<<32)-2)*blockSize + tagSize, a wrong/truncated nonce, or any bit-flip in ciphertext/tag that breaks GCM authentication.","commonSituations":"Wrong nonce reuse/mismatch between seal and open; corrupted ciphertext on the wire; truncated messages; replaying ciphertext with a different key; bit-flip injection attacks being correctly rejected.","solutions":["Verify the nonce passed to Open matches the one used with Seal (and is unique per message).","Ensure ciphertext was not truncated — check total length before calling Open.","Confirm the key and additionalData (AAD) are identical on both sides.","Treat this error as authentication failure: do not use any plaintext, surface/abort rather than retry."],"exampleFix":"// before\nplaintext, err := aead.Open(nil, nonce, cipherText[:15], aad) // shorter than tag -> errOpen\n\n// after\nif len(cipherText) < 16 { return errors.New(\"ciphertext too short\") }\nplaintext, err := aead.Open(nil, nonce, cipherText, aad)","handlingStrategy":"try-catch","validationCode":"func safeOpen(aead cipher.AEAD, nonce, ct, aad []byte) ([]byte, error) {\n    if len(ct) < aead.Overhead() {\n        return nil, errors.New(\"ciphertext shorter than tag\")\n    }\n    return aead.Open(nil, nonce, ct, aad)\n}","typeGuard":null,"tryCatchPattern":"pt, err := aead.Open(nil, nonce, ct, aad)\nif err != nil {\n    if errors.Is(err, cipher.ErrAuth) || strings.Contains(err.Error(), \"message authentication failed\") {\n        // authentication failure: discard, abort, do not retry unchanged\n        return err\n    }\n    return err\n}","preventionTips":["Always use a unique nonce per message and pass the same nonce to Open as to Seal.","Length-check ciphertext before Open.","Match key and AAD on both sides.","Never reuse plaintext from a failed Open."],"tags":["crypto","aes","gcm","boringcrypto","authentication"],"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T08:17:17.861Z"}