diff --git a/cipher/hctr.go b/cipher/hctr.go
index ea41de6..33d1fea 100644
--- a/cipher/hctr.go
+++ b/cipher/hctr.go
@@ -120,7 +120,7 @@ func (h *hctr) BlockSize() int {
 // in HCTR mode. The lenght of tweak and hash key must be the same as the [Block]'s block size.
 func NewHCTR(cipher _cipher.Block, tweak, hkey []byte) (LengthPreservingMode, error) {
 	if len(tweak) != blockSize || len(hkey) != blockSize {
-		return nil, errors.New("hctr: invalid tweak and/or hash key length")
+		return nil, errors.New("cipher: invalid tweak and/or hash key length")
 	}
 	c := &hctr{}
 	c.cipher = cipher
@@ -220,13 +220,13 @@ func (h *hctr) uhash(m []byte, out *[blockSize]byte) {
 
 func (h *hctr) EncryptBytes(ciphertext, plaintext []byte) {
 	if len(ciphertext) < len(plaintext) {
-		panic("hctr: ciphertext is smaller than plaintext")
+		panic("cipher: ciphertext is smaller than plaintext")
 	}
 	if len(plaintext) < blockSize {
-		panic("hctr: plaintext length is smaller than the block size")
+		panic("cipher: plaintext length is smaller than the block size")
 	}
 	if alias.InexactOverlap(ciphertext[:len(plaintext)], plaintext) {
-		panic("hctr: invalid buffer overlap")
+		panic("cipher: invalid buffer overlap")
 	}
 
 	var z1, z2 [blockSize]byte
@@ -245,13 +245,13 @@ func (h *hctr) EncryptBytes(ciphertext, plaintext []byte) {
 
 func (h *hctr) DecryptBytes(plaintext, ciphertext []byte) {
 	if len(plaintext) < len(ciphertext) {
-		panic("hctr: plaintext is smaller than cihpertext")
+		panic("cipher: plaintext is smaller than cihpertext")
 	}
 	if len(ciphertext) < blockSize {
-		panic("hctr: ciphertext length is smaller than the block size")
+		panic("cipher: ciphertext length is smaller than the block size")
 	}
 	if alias.InexactOverlap(plaintext[:len(ciphertext)], ciphertext) {
-		panic("hctr: invalid buffer overlap")
+		panic("cipher: invalid buffer overlap")
 	}
 
 	var z1, z2 [blockSize]byte
diff --git a/cipher/xts.go b/cipher/xts.go
index 22a9611..17d0bc0 100644
--- a/cipher/xts.go
+++ b/cipher/xts.go
@@ -72,7 +72,7 @@ func NewGBXTSEncrypterWithSector(cipherFunc CipherCreator, key, tweakKey []byte,
 
 func newXTSEncrypter(cipherFunc CipherCreator, key, tweakKey, tweak []byte, isGB bool) (_cipher.BlockMode, error) {
 	if len(tweak) != blockSize {
-		return nil, errors.New("xts: invalid tweak length")
+		return nil, errors.New("cipher: invalid tweak length")
 	}
 
 	k1, err := cipherFunc(key)
@@ -80,7 +80,7 @@ func newXTSEncrypter(cipherFunc CipherCreator, key, tweakKey, tweak []byte, isGB
 		return nil, err
 	}
 	if k1.BlockSize() != blockSize {
-		return nil, errors.New("xts: cipher does not have a block size of 16")
+		return nil, errors.New("cipher: cipher does not have a block size of 16")
 	}
 
 	k2, err := cipherFunc(tweakKey)
@@ -144,7 +144,7 @@ func NewGBXTSDecrypterWithSector(cipherFunc CipherCreator, key, tweakKey []byte,
 
 func newXTSDecrypter(cipherFunc CipherCreator, key, tweakKey, tweak []byte, isGB bool) (_cipher.BlockMode, error) {
 	if len(tweak) != blockSize {
-		return nil, errors.New("xts: invalid tweak length")
+		return nil, errors.New("cipher: invalid tweak length")
 	}
 
 	k1, err := cipherFunc(key)
@@ -152,7 +152,7 @@ func newXTSDecrypter(cipherFunc CipherCreator, key, tweakKey, tweak []byte, isGB
 		return nil, err
 	}
 	if k1.BlockSize() != blockSize {
-		return nil, errors.New("xts: cipher does not have a block size of 16")
+		return nil, errors.New("cipher: cipher does not have a block size of 16")
 	}
 
 	k2, err := cipherFunc(tweakKey)
@@ -183,13 +183,13 @@ func (c *xtsEncrypter) BlockSize() int {
 // Sectors must be a multiple of 16 bytes and less than 2²⁴ bytes.
 func (c *xtsEncrypter) CryptBlocks(ciphertext, plaintext []byte) {
 	if len(ciphertext) < len(plaintext) {
-		panic("xts: ciphertext is smaller than plaintext")
+		panic("cipher: ciphertext is smaller than plaintext")
 	}
 	if len(plaintext) < blockSize {
-		panic("xts: plaintext length is smaller than the block size")
+		panic("cipher: plaintext length is smaller than the block size")
 	}
 	if alias.InexactOverlap(ciphertext[:len(plaintext)], plaintext) {
-		panic("xts: invalid buffer overlap")
+		panic("cipher: invalid buffer overlap")
 	}
 
 	lastCiphertext := ciphertext
@@ -244,13 +244,13 @@ func (c *xtsDecrypter) BlockSize() int {
 // Sectors must be a multiple of 16 bytes and less than 2²⁴ bytes.
 func (c *xtsDecrypter) CryptBlocks(plaintext, ciphertext []byte) {
 	if len(plaintext) < len(ciphertext) {
-		panic("xts: plaintext is smaller than ciphertext")
+		panic("cipher: plaintext is smaller than ciphertext")
 	}
 	if len(ciphertext) < blockSize {
-		panic("xts: ciphertext length is smaller than the block size")
+		panic("cipher: ciphertext length is smaller than the block size")
 	}
 	if alias.InexactOverlap(plaintext[:len(ciphertext)], ciphertext) {
-		panic("xts: invalid buffer overlap")
+		panic("cipher: invalid buffer overlap")
 	}
 
 	if concCipher, ok := c.b.(concurrentBlocks); ok {
diff --git a/sm4/sm4_xts.go b/sm4/sm4_xts.go
index 60aeb8a..58e9d2e 100644
--- a/sm4/sm4_xts.go
+++ b/sm4/sm4_xts.go
@@ -56,13 +56,13 @@ func decryptSm4XtsGB(xk *uint32, tweak *[BlockSize]byte, dst, src []byte)
 
 func validateXtsInput(dst, src []byte) {
 	if len(dst) < len(src) {
-		panic("xts: dst is smaller than src")
+		panic("cipher: dst is smaller than src")
 	}
 	if len(src) < BlockSize {
-		panic("xts: src length is smaller than the block size")
+		panic("cipher: src length is smaller than the block size")
 	}
 	if alias.InexactOverlap(dst[:len(src)], src) {
-		panic("xts: invalid buffer overlap")
+		panic("cipher: invalid buffer overlap")
 	}
 }