# SS22 switch from 16 to 32 char length passwords crashes Node

**URL:** https://f.docs.rw/t/topic/250
**Category:** Баг-репорты
**Created:** 2026-06-22T13:45:20Z
**Posts:** 2

## Post 1 by @inoutDeev — 2026-06-22T13:45:20Z

Hi

There is a rare bug where if you created a SS inbound with 16 char length password, and add it to nodes and make it available in internal squads for users, with at least one successful connection to, then switching it to 32 char length, the corresponding node will crash with below error:  
`Failed to start: main: failed to create server > proxy/shadowsocks_2022: create service > bad key`

---

## Post 2 by @remnawave — 2026-07-05T18:16:43Z

> <https://github.com/remnawave/backend/pull/193>
>
> ## Problem
> 
> Creating or editing a `2022-blake3-aes-256-gcm` inbound with a passw…ord that is not a base64 value of exactly 32 bytes makes the node crash on start:
> 
> ```
> Failed to start: main: failed to create server > proxy/shadowsocks_2022: create service > bad key
> ```
> 
> Reported on the forum: https://f.docs.rw/t/250
> 
> ## Cause
> 
> The validator checked the character length of the password string (`settings.password.length < 32`) instead of the decoded key length.
> 
> Per SIP022, the password for a 2022-blake3-* method must be a base64 string that decodes to exactly the cipher key size (32 bytes for aes-256-gcm), which is what `openssl rand -base64 32` produces. A 32 character string is not the same thing: a raw 32 char value decodes to 24 bytes, still passed the old check, and then the node failed with `bad key`.
> 
> ## Fix
> 
> Validate the decoded key size instead of the string length. The key size is resolved from the method, so this stays correct if more 2022-blake3-* methods are added later. The error message now points at the actual requirement.
> 
> Validation runs when a config profile is created or updated (`new XRayConfig(...)`), so an invalid password is now rejected at save time with a clear message instead of reaching the node and crashing it.
> 
> ## Notes
> 
> Auto generated user keys are unaffected: `createPassword()` returns 32 bytes and `encodeSS2022Password` base64 encodes them to a valid 32 byte key.

---

## Post 3 by @system — 2026-07-13T07:27:37Z

Эта тема была автоматически закрыта через 2 дня после последнего ответа. В ней больше нельзя отвечать.