proto: CreateRegisterChallengeRequest: illegal tag %d (wire

Error message

proto: CreateRegisterChallengeRequest: illegal tag %d (wire type %d)

What it means

A tag with a non-positive field number (e.g. 0x00, field 0) appeared while decoding CreateRegisterChallengeRequest. Valid protobuf tags always have field number >= 1, so the generated Unmarshal rejects the payload with this error, embedding the raw tag and wire type for diagnosis.

Source

Thrown at api/client/proto/authservice.pb.go:60508

				return ErrIntOverflowAuthservice
			}
			if iNdEx >= l {
				return io.ErrUnexpectedEOF
			}
			b := dAtA[iNdEx]
			iNdEx++
			wire |= uint64(b&0x7F) << shift
			if b < 0x80 {
				break
			}
		}
		fieldNum := int32(wire >> 3)
		wireType := int(wire & 0x7)
		if wireType == 4 {
			return fmt.Errorf("proto: CreateRegisterChallengeRequest: wiretype end group for non-group")
		}
		if fieldNum <= 0 {
			return fmt.Errorf("proto: CreateRegisterChallengeRequest: illegal tag %d (wire type %d)", fieldNum, wire)
		}
		switch fieldNum {
		case 1:
			if wireType != 2 {
				return fmt.Errorf("proto: wrong wireType = %d for field TokenID", wireType)
			}
			var stringLen uint64
			for shift := uint(0); ; shift += 7 {
				if shift >= 64 {
					return ErrIntOverflowAuthservice
				}
				if iNdEx >= l {
					return io.ErrUnexpectedEOF
				}
				b := dAtA[iNdEx]
				iNdEx++
				stringLen |= uint64(b&0x7F) << shift
				if b < 0x80 {

View on GitHub (pinned to 1283425b60)

Solutions

Check the buffer for leading zero bytes and trim/align to the real message start
Confirm the producer marshals CreateRegisterChallengeRequest with a matching schema version
Add length-prefix framing so offsets cannot drift
Validate with protoc --decode_raw when debugging third-party producers

Example fix

// before
payload := make([]byte, 64) // copied into, rest zeros
proto.Unmarshal(payload, req)
// after
payload = payload[:bytesWritten]
err := proto.Unmarshal(payload, req)

Defensive patterns

Strategy: validation

Validate before calling

func noLeadingZeros(b []byte) error {
    if len(b) == 0 { return errors.New("empty payload") }
    if b[0] == 0x00 { return errors.New("leading zero tag: buffer misaligned or zero-padded") }
    return nil
}

Type guard

func isIllegalTagError(err error) bool {
    return err != nil && strings.Contains(err.Error(), "illegal tag")
}

Try / catch

if err := proto.Unmarshal(payload, req); err != nil {
    if isIllegalTagError(err) {
        return trace.BadParameter("payload corrupt: invalid leading tag")
    }
    return trace.Wrap(err)
}

Prevention

Copy buffers with payload[:n] instead of fixed-size zeroed arrays
Add length-prefix framing to prevent offset drift
Verify the message type matches between producer and consumer
Check incoming payloads for zero padding before decode

When it happens

Trigger: Unmarshaling corrupted, zero-filled, or misaligned bytes where the next tag decodes to field number 0 — e.g. an empty padding region, wrong stream offset, or bytes of a different message type.

Common situations: Zero-initialized buffers passed as payloads; off-by-one stream framing; fuzz inputs; mismatched message types between producer and consumer in register-challenge flows.

Related errors

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/9b1e7242b5ee02f3. Report an issue: GitHub.