golang/go · error

tls: invalid client key share

Error message

tls: invalid client key share

What it means

The client sent a key_share for a group the server selected, but computing the shared secret (ke.serverSharedSecret) failed — the share bytes are malformed: wrong length, point not on curve, all-zero X25519, etc. Per RFC 8446 §4.2.8 the server sends illegal_parameter.

Source

Thrown at src/crypto/tls/handshake_server_tls13.go:257

	}
	if clientKeyShare == nil {
		ks, err := hs.doHelloRetryRequest(selectedGroup)
		if err != nil {
			return err
		}
		clientKeyShare = ks
	}
	c.curveID = selectedGroup

	ke, err := keyExchangeForCurveID(selectedGroup)
	if err != nil {
		c.sendAlert(alertInternalError)
		return errors.New("tls: internal error: supportsCurve accepted unimplemented curve")
	}
	hs.sharedKey, hs.hello.serverShare, err = ke.serverSharedSecret(c.config.rand(), clientKeyShare.data)
	if err != nil {
		c.sendAlert(alertIllegalParameter)
		return errors.New("tls: invalid client key share")
	}

	selectedProto, err := negotiateALPN(c.config.NextProtos, hs.clientHello.alpnProtocols, c.quic != nil)
	if err != nil {
		c.sendAlert(alertNoApplicationProtocol)
		return err
	}
	c.clientProtocol = selectedProto

	if c.quic != nil {
		// RFC 9001 Section 4.2: Clients MUST NOT offer TLS versions older than 1.3.
		for _, v := range hs.clientHello.supportedVersions {
			if v < VersionTLS13 {
				c.sendAlert(alertProtocolVersion)
				return errors.New("tls: client offered TLS version older than TLS 1.3")
			}
		}
		// RFC 9001 Section 8.2.

View on GitHub (pinned to b6b368adc5)

Solutions

1. Regenerate the key share with a correct implementation of the selected group
2. If you can't predict which group the server selects, send valid key shares for every group you offer
3. Update the client TLS/crypto library to fix key-share serialization bugs

if err := tlsConn.Handshake(); err != nil {
    if strings.Contains(err.Error(), "invalid client key share") {
        log.Printf("malformed key share from %v", remote)
    }
    c.Close()
    return
}

When it happens

Trigger: clientKeyShare.data is a truncated/zeroed key share, an EC point not on the selected curve, the identity point, or X25519 bytes of the wrong length. Buggy key-share generation, fuzzers, or attackers probing.

Common situations: Buggy client key-share generation; memory corruption on the client; fuzzers; a client that sent a key_share whose bytes were corrupted in transit.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• tls: missing signature_algorithms from TLS 1.2 peer
• tls: peer doesn't support any of the certificate's signature
• client doesn't support ECDHE, can only use legacy RSA key ex
• tls: server sent an unnecessary HelloRetryRequest key_share
• tls: malformed key_share extension

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/469d725c52e9be3e. Report an issue: GitHub.