shadowsocks/shadowsocks-windows · critical · System.Exception

openssl: cipher not found

Error message

openssl: cipher not found

What it means

Thrown from AEADOpenSSLEncryptor.InitCipher when OpenSSL.GetCipherInfo(_innerLibName) returns IntPtr.Zero, meaning the OpenSSL EVP_CIPHER for the requested algorithm name could not be found. This is the OpenSSL analogue of error 9: the bundled/linked OpenSSL build does not provide that cipher.

Source

Thrown at shadowsocks-csharp/Encryption/AEAD/AEADOpenSSLEncryptor.cs:50

            {"aes-256-gcm", new EncryptorInfo("aes-256-gcm", 32, 32, 12, 16, CIPHER_AES)},
            {"chacha20-ietf-poly1305", new EncryptorInfo("chacha20-poly1305", 32, 32, 12, 16, CIPHER_CHACHA20IETFPOLY1305)}
        };

        public static List<string> SupportedCiphers()
        {
            return new List<string>(_ciphers.Keys);
        }

        protected override Dictionary<string, EncryptorInfo> getCiphers()
        {
            return _ciphers;
        }

        public override void InitCipher(byte[] salt, bool isEncrypt, bool isUdp)
        {
            base.InitCipher(salt, isEncrypt, isUdp);
            _cipherInfoPtr = OpenSSL.GetCipherInfo(_innerLibName);
            if (_cipherInfoPtr == IntPtr.Zero) throw new System.Exception("openssl: cipher not found");
            IntPtr ctx = OpenSSL.EVP_CIPHER_CTX_new();
            if (ctx == IntPtr.Zero) throw new System.Exception("openssl: fail to create ctx");

            if (isEncrypt)
            {
                _encryptCtx = ctx;
            }
            else
            {
                _decryptCtx = ctx;
            }

            DeriveSessionKey(isEncrypt ? _encryptSalt : _decryptSalt, _Masterkey,
                isEncrypt ? _opensslEncSubkey : _opensslDecSubkey);

            var ret = OpenSSL.EVP_CipherInit_ex(ctx, _cipherInfoPtr, IntPtr.Zero, null, null,
                isEncrypt ? OpenSSL.OPENSSL_ENCRYPT : OpenSSL.OPENSSL_DECRYPT);
            if (ret != 1) throw new System.Exception("openssl: fail to init ctx");

View on GitHub (pinned to 891d971682)

Solutions

1. Use an OpenSSL build compiled with AEAD ciphers (AES-NI/GCM, CHACHA20-POLY1305).
2. Verify _innerLibName matches an EVP name OpenSSL recognises (EVP_get_cipherbyname).
3. Fall back to the mbedTLS encryptor if OpenSSL lacks the cipher.

Example fix

// before
_cipherInfoPtr = OpenSSL.GetCipherInfo(_innerLibName);
if (_cipherInfoPtr == IntPtr.Zero) throw new System.Exception("openssl: cipher not found");

// after
if (_cipherInfoPtr == IntPtr.Zero)
    throw new System.Exception($"openssl: cipher not found for {_innerLibName} (rebuild OpenSSL with AEAD support)");

// Check OpenSSL cipher availability before init
if (OpenSSL.GetCipherInfo(_innerLibName) == IntPtr.Zero)
    throw new System.Exception($"OpenSSL lacks {_innerLibName}");

bool OpenSSLSupportsCipher(string innerName) =>
    OpenSSL.GetCipherInfo(innerName) != IntPtr.Zero;

try { useOpenSSL(); }
catch (Exception ex) when (ex.Message.Contains("openssl: cipher not found"))
{ /* fall back to mbedTLS AEAD encryptor */ }

When it happens

Trigger: _innerLibName (e.g. "aes-256-gcm", "chacha20-poly1305") is not compiled into the OpenSSL library in use; a typo or wrong naming (OpenSSL expects specific EVP names like "aes-256-gcm"); an older OpenSSL 1.0.x lacking AEAD ciphers.

Common situations: Shipping OpenSSL without AEAD support; version downgrade of the native lib; platform (e.g. some mobile/embedded) with a stripped OpenSSL; method name format mismatch between mbedTLS and OpenSSL tables.

Related errors

• Cannot initialize mbed TLS cipher context
• openssl: fail to create ctx
• method not found
• openssl: fail to init ctx
• openssl: fail to set key length

AI-assisted analysis of shadowsocks/shadowsocks-windows@891d971682 (2026-08-13). Data as JSON: /api/errors/58072f1670da1f6d. Report an issue: GitHub.