{"record":{"id":"026508576ef06c39","repo":"golang/go","slug":"unsupported-kdf-04x","errorCode":null,"errorMessage":"unsupported KDF %04x","messagePattern":"unsupported KDF %04x","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/hpke/kdf.go","lineNumber":46,"sourceCode":"\n// NewKDF returns the KDF implementation for the given KDF ID.\n//\n// Applications are encouraged to use specific implementations like [HKDFSHA256]\n// instead, unless runtime agility is required.\nfunc NewKDF(id uint16) (KDF, error) {\n\tswitch id {\n\tcase 0x0001: // HKDF-SHA256\n\t\treturn HKDFSHA256(), nil\n\tcase 0x0002: // HKDF-SHA384\n\t\treturn HKDFSHA384(), nil\n\tcase 0x0003: // HKDF-SHA512\n\t\treturn HKDFSHA512(), nil\n\tcase 0x0010: // SHAKE128\n\t\treturn SHAKE128(), nil\n\tcase 0x0011: // SHAKE256\n\t\treturn SHAKE256(), nil\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"unsupported KDF %04x\", id)\n\t}\n}\n\n// HKDFSHA256 returns an HKDF-SHA256 KDF implementation.\nfunc HKDFSHA256() KDF { return hkdfSHA256 }\n\n// HKDFSHA384 returns an HKDF-SHA384 KDF implementation.\nfunc HKDFSHA384() KDF { return hkdfSHA384 }\n\n// HKDFSHA512 returns an HKDF-SHA512 KDF implementation.\nfunc HKDFSHA512() KDF { return hkdfSHA512 }\n\ntype hkdfKDF struct {\n\thash func() hash.Hash\n\tid   uint16\n\tnH   int\n}\n","sourceCodeStart":28,"sourceCodeEnd":64,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/hpke/kdf.go#L28-L64","documentation":"`hpke.NewKDF(id uint16)` resolves a Key Derivation Function from the HPKE IANA registry. Five IDs are supported: 0x0001 (HKDF-SHA256), 0x0002 (HKDF-SHA384), 0x0003 (HKDF-SHA512), 0x0010 (SHAKE128), 0x0011 (SHAKE256). Any other ID returns this error. The ID typically arrives from the HPKE mode/suite selection off the wire.","triggerScenarios":"Peer advertises a KDF ID outside the supported set; corrupt suite bytes; interop with a profile that uses a KDF not yet in this x/crypto version; misuse where a raw SHA-256 algorithm ID is passed instead of the HPKE KDF ID.","commonSituations":"Newer HPKE draft adding a KDF not in the local build; mis-mapping between a TLS/hash registry ID and the HPKE KDF registry ID; fuzz test cycling every uint16.","solutions":["Verify the incoming KDF ID is one of {0x0001,0x0002,0x0003,0x0010,0x0011} before calling NewKDF.","Update x/crypto to a version supporting the KDF you need.","Pin both peers to a known-good suite (e.g. HKDF-SHA256)."],"exampleFix":"// before\nk, err := hpke.NewKDF(rawKDFID) // rawKDFID from corrupt/untrusted header\n// after\nswitch rawKDFID {\ncase 0x0001, 0x0002, 0x0003, 0x0010, 0x0011:\n    k, err = hpke.NewKDF(rawKDFID)\ndefault:\n    return fmt.Errorf(\"unsupported KDF %04x\", rawKDFID)\n}","handlingStrategy":"type-guard","validationCode":"supportedKDF := map[uint16]bool{0x0001:true,0x0002:true,0x0003:true,0x0010:true,0x0011:true}\nif !supportedKDF[id] {\n    return fmt.Errorf(\"KDF %04x not supported\", id)\n}","typeGuard":"func isSupportedKDF(id uint16) bool {\n    switch id {\n    case 0x0001, 0x0002, 0x0003, 0x0010, 0x0011:\n        return true\n    }\n    return false\n}","tryCatchPattern":null,"preventionTips":["Validate the full suite (KEM/KDF/AEAD) before instantiating any component.","Log the rejected ID for protocol diagnostics."],"tags":["crypto","hpke","kdf","protocol-negotiation"],"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T12:17:08.281Z"}