moonD4rk/HackBrowserData · error

nonce length must equal GCM nonce size

Error message

nonce length must equal GCM nonce size

What it means

errInvalidNonceLen is returned by AESGCMEncrypt/AESGCMDecrypt when the supplied nonce length differs from the AEAD's NonceSize (12 bytes for GCM). GCM is only safe and correct with its expected nonce size, so calls with 8- or 16-byte nonces are rejected.

Source

Thrown at crypto/errors.go:11

package crypto

import "errors"

// Sentinel errors for crypto operations.
var (
	errShortCiphertext   = errors.New("ciphertext too short")
	errInvalidBlockSize  = errors.New("ciphertext is not a multiple of the block size")
	errInvalidIVLength   = errors.New("IV length must equal block size")
	errInvalidPadding    = errors.New("invalid PKCS5 padding")
	errInvalidNonceLen   = errors.New("nonce length must equal GCM nonce size")
	errUnsupportedIVLen  = errors.New("unsupported IV length")
	errDecodeASN1        = errors.New("failed to decode ASN1 data")
	errDPAPINotSupported = errors.New("DPAPI not supported on this platform") //nolint:unused // used on darwin/linux only
)

View on GitHub (pinned to 0503d04d7a)

Solutions

1. Use the crypto package's gcmNonceSize constant (or aead.NonceSize()) when slicing the nonce instead of a hardcoded length.
2. Verify the blob format version: v10 uses a 12-byte nonce after the 3-byte prefix; adjust offsets for other versions.
3. Check for off-by-one or version-prefix offset errors when extracting the nonce.
4. Log len(nonce) when this error fires to find the wrong offset quickly.

Example fix

// before
nonce := ct[3:16] // 13 bytes, wrong
// after
nonce := ct[versionPrefixLen : versionPrefixLen+gcmNonceSize]

const gcmNonceSize = 12
if len(nonce) != gcmNonceSize { return fmt.Errorf("nonce must be %d bytes, got %d", gcmNonceSize, len(nonce)) }

func validNonce(n []byte, want int) bool { return len(n) == want }

out, err := crypto.AESGCMDecrypt(key, nonce, ct)
if errors.Is(err, crypto.ErrInvalidNonceLen) {
    return fmt.Errorf("nonce len %d: %w", len(nonce), err)
}

When it happens

Trigger: Calling AESGCMEncrypt/AESGCMDecrypt with a nonce whose length != aead.NonceSize(); e.g. slicing the wrong byte range out of a 'v20' blob, or passing an empty nonce when prefix parsing failed.

Common situations: Chromium v20 (app-bound) blobs where the nonce layout differs from v10; hardcoded nonce lengths in caller code not matching the GCM nonce size; key material sourced from Yandex/Firefox paths with different sizes.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• ciphertext too short
• ciphertext is not a multiple of the block size
• invalid PKCS5 padding
• unsupported IV length
• failed to decode ASN1 data

AI-assisted analysis of moonD4rk/HackBrowserData@0503d04d7a (2026-09-06). Data as JSON: /api/errors/ffec15cb02998293. Report an issue: GitHub.