tailscale/tailscale · error

can't seal with zero keys

Error message

can't seal with zero keys

What it means

Programming guard in MachinePrivate.SealTo: NaCl box sealing to a peer was attempted with a zero private key (or otherwise degenerate key state), which would yield unauthenticated ciphertext, so the method panics.

Source

Thrown at types/key/machine.go:106

// Deprecated: this function is risky to use, because it produces
// serialized values that do not identify themselves as a
// MachinePrivate, allowing other code to potentially parse it back in
// as the wrong key type. For new uses that don't require this
// specific raw byte serialization, please use
// MarshalText/UnmarshalText.
func (k MachinePrivate) UntypedBytes() []byte {
	return bytes.Clone(k.k[:])
}

// SealTo wraps cleartext into a NaCl box (see
// golang.org/x/crypto/nacl) to p, authenticated from k, using a
// random nonce.
//
// The returned ciphertext is a 24-byte nonce concatenated with the
// box value.
func (k MachinePrivate) SealTo(p MachinePublic, cleartext []byte) (ciphertext []byte) {
	if k.IsZero() || p.IsZero() {
		panic("can't seal with zero keys")
	}
	var nonce [24]byte
	rand(nonce[:])
	return box.Seal(nonce[:], cleartext, &nonce, &p.k, &k.k)
}

// SharedKey returns the precomputed Nacl box shared key between k and p.
func (k MachinePrivate) SharedKey(p MachinePublic) MachinePrecomputedSharedKey {
	var shared MachinePrecomputedSharedKey
	box.Precompute(&shared.k, &p.k, &k.k)
	return shared
}

// MachinePrecomputedSharedKey is a precomputed shared NaCl box shared key.
type MachinePrecomputedSharedKey struct {
	k [32]byte
}

View on GitHub (pinned to 6e0912f979)

Solutions

1. Initialize the MachinePrivate before any SealTo operation
2. Guard with IsZero() when the machine key may legitimately be absent
3. Verify key loading/persistence at startup

When it happens

Trigger: Thrown at types/key/machine.go:106 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of tailscale/tailscale@6e0912f979 (2026-08-18). Data as JSON: /api/errors/b9ddcb12dee987dd. Report an issue: GitHub.