ory/hydra · error

cannot create XChaCha20-Poly1305 AEAD

Error message

cannot create XChaCha20-Poly1305 AEAD

What it means

New constructs an XChaCha20-Poly1305 AEAD cipher used to seal opaque payloads (like JWK encryption). It only fails if chacha20poly1305.NewX rejects the key; since the key is a fixed [32]byte, failure indicates the underlying crypto library could not initialize the cipher — practically never hit by key size, but wrapped for safety.

Source

Thrown at oryx/aead/aead_oss.go:22

//go:build !commercial

// Package aead provides the authenticated cipher (AEAD) that Ory uses to
// seal opaque payloads such as pagination tokens.
package aead

import (
	"crypto/cipher"

	"github.com/pkg/errors"
	"golang.org/x/crypto/chacha20poly1305"
)

// New returns the XChaCha20-Poly1305 AEAD that seals opaque payloads under
// the given key. Its 192-bit random nonce imposes no practical limit on the
// number of payloads sealed per key.
func New(key [32]byte) (cipher.AEAD, error) {
	a, err := chacha20poly1305.NewX(key[:])
	return a, errors.Wrap(err, "cannot create XChaCha20-Poly1305 AEAD")
}

View on GitHub (pinned to 4174065ffb)

Solutions

1. Update golang.org/x/crypto to a current version (go get -u golang.org/x/crypto)
2. Check the environment for FIPS/restricted crypto policies that disable ChaCha20-Poly1305 and switch to AES-GCM-backed AEAD if supported
3. Rebuild the binary to ensure a consistent vendored crypto library
4. Inspect the wrapped cause (%+v) to see the exact error from chacha20poly1305.NewX

Example fix

// before
aead.New(key) // assumes XChaCha20 always available
// after
a, err := aead.New(key)
if err != nil {
    // fall back or abort with a clear log
    return errors.Wrap(err, "AEAD init failed")
}

a, err := aead.New(key)
if err != nil {
    return fmt.Errorf("AEAD unavailable: %w", err) // inspect cause; check x/crypto version & FIPS policy
}

When it happens

Trigger: chacha20poly1305.NewX returning an error — in current golang.org/x/crypto this only happens with keys not 32 bytes long, which is prevented by the [32]byte type, so it may occur from an incompatible/older x/crypto build or FIPS-restricted crypto environment.

Common situations: Builds with vendored/outdated golang.org/x/crypto; restricted environments (FIPS-only crypto policies) where ChaCha20-Poly1305 is disallowed; corrupt builds.

Related errors

• key must be exactly 32 long bytes, got %d bytes
• cannot create AEAD
• cannot open AEAD
• cookiex: at least one secret is required
• ErrUnknownHashAlgorithm

AI-assisted analysis of ory/hydra@4174065ffb (2026-09-03). Data as JSON: /api/errors/ef1f2a85b5297ab6. Report an issue: GitHub.