crowdsecurity/crowdsec · critical

failed to create GCM: %w

Error message

failed to create GCM: %w

What it means

sealCookieV0 wraps the AES block in GCM (Galois/Counter Mode) for authenticated encryption. This error means cipher.NewGCM rejected the block; like the cipher-creation error, it should be unreachable with standard Go crypto primitives and a correctly derived AES key — a defensive internal check.

Source

Thrown at pkg/appsec/challenge/crypto.go:129

	}

	if len(reason) > MaxAllowlistReasonLen {
		return "", fmt.Errorf("%w: %d > %d", ErrAllowlistReasonSize, len(reason), MaxAllowlistReasonLen)
	}

	key, err := deriveKey(masterCookieKey)
	if err != nil {
		return "", err
	}

	block, err := aes.NewCipher(key)
	if err != nil {
		return "", fmt.Errorf("failed to create cipher: %w", err)
	}

	gcm, err := cipher.NewGCM(block)
	if err != nil {
		return "", fmt.Errorf("failed to create GCM: %w", err)
	}

	// Reject an over-limit envelope before marshaling it.
	maxPlaintext := maxCookieLen/4*3 - 1 - gcm.NonceSize() - gcm.Overhead()
	if plaintextLen := cookiePlaintextFixedHeaderLen + len(reason) + proto.Size(envelope); plaintextLen > maxPlaintext {
		return "", fmt.Errorf("%w: plaintext=%d > %d", ErrCookieTooLarge, plaintextLen, maxPlaintext)
	}

	envelopeBytes, err := proto.Marshal(envelope)
	if err != nil {
		return "", fmt.Errorf("failed to marshal challenge cookie proto: %w", err)
	}

	nonce := make([]byte, gcm.NonceSize())
	if _, err := rand.Read(nonce); err != nil {
		return "", fmt.Errorf("failed to generate nonce: %w", err)
	}

View on GitHub (pinned to 909b515798)

Solutions

1. Check the wrapped error for GCM-specific failure text.
2. Verify the Go toolchain and crypto packages are unmodified (no vendored forks, standard FIPS constraints reviewed).
3. Rebuild the binary with an unmodified toolchain if a custom crypto build is suspected.

if err != nil {
    return fmt.Errorf("cookie sealing failed (gcm): %w", err)
}

When it happens

Trigger: Calling sealCookieV0 when cipher.NewGCM fails on the derived AES block — an internal invariant breach, not a caller-visible condition in supported configurations.

Common situations: Effectively never in production with Go's standard crypto/aes + crypto/cipher packages; would indicate a corrupted toolchain, FIPS-mode restriction, or vendored crypto fork.

Understand the failure class

Background: "This is a bug, please report it": internal invariant violations, unreachable panics, and SNH errors explained — this error's family across 47 libraries.

Related errors

• failed to create cipher: %w
• cookie expired
• unknown cookie version
• empty master secret
• generate PoW salt: %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/b8044fd5c62160f6. Report an issue: GitHub.