{"record":{"id":"02e282a64440270e","repo":"ory/hydra","slug":"jwksx-key-size-must-be-a-multiple-of-8-for-algori","errorCode":null,"errorMessage":"jwksx: key size must be a multiple of 8 for algorithm \"%s\" but got: %d","messagePattern":"jwksx: key size must be a multiple of 8 for algorithm \"(.+?)\" but got: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"oryx/jwksx/generator.go","lineNumber":118,"sourceCode":"\t\tkey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)\n\t\treturn key, errors.Wrapf(err, \"jwks: unable to generate key\")\n\tcase jose.ES384:\n\t\t// NB: The cryptographic operations do not use constant-time algorithms.\n\t\tkey, err := ecdsa.GenerateKey(elliptic.P384(), rand.Reader)\n\t\treturn key, errors.Wrapf(err, \"jwks: unable to generate key\")\n\tcase jose.ES512:\n\t\t// NB: The cryptographic operations do not use constant-time algorithms.\n\t\tkey, err := ecdsa.GenerateKey(elliptic.P521(), rand.Reader)\n\t\treturn key, errors.Wrapf(err, \"jwks: unable to generate key\")\n\tcase jose.EdDSA:\n\t\t_, key, err := ed25519.GenerateKey(rand.Reader)\n\t\treturn key, errors.Wrapf(err, \"jwks: unable to generate key\")\n\tcase jose.RS256, jose.RS384, jose.RS512, jose.PS256, jose.PS384, jose.PS512:\n\t\tkey, err := rsa.GenerateKey(rand.Reader, bits)\n\t\treturn key, errors.Wrapf(err, \"jwks: unable to generate key\")\n\tcase jose.HS256, jose.HS384, jose.HS512:\n\t\tif bits%8 != 0 {\n\t\t\treturn nil, errors.Errorf(`jwksx: key size must be a multiple of 8 for algorithm \"%s\" but got: %d`, alg, bits)\n\t\t}\n\n\t\tkey := make([]byte, bits/8)\n\t\tif _, err := io.ReadFull(rand.Reader, key); err != nil {\n\t\t\treturn nil, errors.Wrapf(err, \"jwks: unable to generate key\")\n\t\t}\n\t\treturn key, nil\n\tdefault:\n\t\treturn nil, errors.Errorf(`jwksx: available algorithms are \"%+v\" but unknown algorithm was requested: \"%s\"`, GenerateSigningKeysAvailableAlgorithms(), alg)\n\t}\n}\n","sourceCodeStart":100,"sourceCodeEnd":130,"githubUrl":"https://github.com/ory/hydra/blob/4174065ffb052799890f7480f5360a877a67ffc1/oryx/jwksx/generator.go#L100-L130","documentation":"Returned by jwksx generate for HS256/HS384/HS512 when the requested key size in bits is not divisible by 8, so it cannot be converted to a whole number of bytes for the HMAC secret. The configured bitsize for the symmetric signing key is at fault.","triggerScenarios":"Thrown at oryx/jwksx/generator.go:118 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Set the HS256/384/512 key length to a multiple of 8 bits (a whole number of bytes)","Use a standard size such as 256 or 512 bits for the HMAC key","Validate key sizes in configuration before key generation"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4174065ffb052799890f7480f5360a877a67ffc1","analyzedAt":"2026-09-03T14:52:41.581Z","contentChangedAt":"2026-09-03T14:52:41.581Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}