{"record":{"id":"ffec15cb02998293","repo":"moonD4rk/HackBrowserData","slug":"nonce-length-must-equal-gcm-nonce-size","errorCode":null,"errorMessage":"nonce length must equal GCM nonce size","messagePattern":"nonce length must equal GCM nonce size","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crypto/errors.go","lineNumber":11,"sourceCode":"package crypto\n\nimport \"errors\"\n\n// Sentinel errors for crypto operations.\nvar (\n\terrShortCiphertext   = errors.New(\"ciphertext too short\")\n\terrInvalidBlockSize  = errors.New(\"ciphertext is not a multiple of the block size\")\n\terrInvalidIVLength   = errors.New(\"IV length must equal block size\")\n\terrInvalidPadding    = errors.New(\"invalid PKCS5 padding\")\n\terrInvalidNonceLen   = errors.New(\"nonce length must equal GCM nonce size\")\n\terrUnsupportedIVLen  = errors.New(\"unsupported IV length\")\n\terrDecodeASN1        = errors.New(\"failed to decode ASN1 data\")\n\terrDPAPINotSupported = errors.New(\"DPAPI not supported on this platform\") //nolint:unused // used on darwin/linux only\n)\n","sourceCodeStart":1,"sourceCodeEnd":16,"githubUrl":"https://github.com/moonD4rk/HackBrowserData/blob/0503d04d7a8d0379d060268a74f1b149e5a0aad5/crypto/errors.go#L1-L16","documentation":"errInvalidNonceLen is returned by AESGCMEncrypt/AESGCMDecrypt when the supplied nonce length differs from the AEAD's NonceSize (12 bytes for GCM). GCM is only safe and correct with its expected nonce size, so calls with 8- or 16-byte nonces are rejected.","triggerScenarios":"Calling AESGCMEncrypt/AESGCMDecrypt with a nonce whose length != aead.NonceSize(); e.g. slicing the wrong byte range out of a 'v20' blob, or passing an empty nonce when prefix parsing failed.","commonSituations":"Chromium v20 (app-bound) blobs where the nonce layout differs from v10; hardcoded nonce lengths in caller code not matching the GCM nonce size; key material sourced from Yandex/Firefox paths with different sizes.","solutions":["Use the crypto package's gcmNonceSize constant (or aead.NonceSize()) when slicing the nonce instead of a hardcoded length.","Verify the blob format version: v10 uses a 12-byte nonce after the 3-byte prefix; adjust offsets for other versions.","Check for off-by-one or version-prefix offset errors when extracting the nonce.","Log len(nonce) when this error fires to find the wrong offset quickly."],"exampleFix":"// before\nnonce := ct[3:16] // 13 bytes, wrong\n// after\nnonce := ct[versionPrefixLen : versionPrefixLen+gcmNonceSize]","handlingStrategy":"validation","validationCode":"const gcmNonceSize = 12\nif len(nonce) != gcmNonceSize { return fmt.Errorf(\"nonce must be %d bytes, got %d\", gcmNonceSize, len(nonce)) }","typeGuard":"func validNonce(n []byte, want int) bool { return len(n) == want }","tryCatchPattern":"out, err := crypto.AESGCMDecrypt(key, nonce, ct)\nif errors.Is(err, crypto.ErrInvalidNonceLen) {\n    return fmt.Errorf(\"nonce len %d: %w\", len(nonce), err)\n}","preventionTips":["Slice nonces with the versionPrefixLen/gcmNonceSize constants, never magic numbers.","Verify blob version (v10/v20) before assuming nonce offsets.","Log nonce length on failure to diagnose offset bugs.","Add tests covering both v10 and v20 blob layouts."],"tags":["crypto","aes-gcm","nonce","parameter-validation"],"backgroundTag":"invalid-argument-value","analyzedSha":"0503d04d7a8d0379d060268a74f1b149e5a0aad5","analyzedAt":"2026-09-06T13:38:28.707Z","contentChangedAt":"2026-09-06T13:38:28.707Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}