{"record":{"id":"2566c4b1275a609c","repo":"ory/hydra","slug":"unknown-algorithm-s-for-encryption-key","errorCode":null,"errorMessage":"unknown algorithm %s for encryption key","messagePattern":"unknown algorithm (.+?) for encryption key","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"oryx/josex/generate.go","lineNumber":119,"sourceCode":"\tcase jose.ECDH_ES, jose.ECDH_ES_A128KW, jose.ECDH_ES_A192KW, jose.ECDH_ES_A256KW:\n\t\tvar crv elliptic.Curve\n\t\tswitch bits {\n\t\tcase 0, 256:\n\t\t\tcrv = elliptic.P256()\n\t\tcase 384:\n\t\t\tcrv = elliptic.P384()\n\t\tcase 521:\n\t\t\tcrv = elliptic.P521()\n\t\tdefault:\n\t\t\treturn nil, nil, errors.New(\"invalid elliptic curve key size, use one of 256, 384, or 521\")\n\t\t}\n\t\tkey, err := ecdsa.GenerateKey(crv, rand.Reader)\n\t\tif err != nil {\n\t\t\treturn nil, nil, err\n\t\t}\n\t\treturn key.Public(), key, err\n\tdefault:\n\t\treturn nil, nil, fmt.Errorf(\"unknown algorithm %s for encryption key\", alg)\n\t}\n}\n","sourceCodeStart":101,"sourceCodeEnd":122,"githubUrl":"https://github.com/ory/hydra/blob/4174065ffb052799890f7480f5360a877a67ffc1/oryx/josex/generate.go#L101-L122","documentation":"Returned by NewEncryptionKey when the requested JWE algorithm is not one of the symmetric/asymmetric key-generation cases handled above (RSA, ECDSA, ECDH-ES families, etc.). The algorithm string is unsupported for key generation, typically a typo or an algorithm that requires externally supplied keys.","triggerScenarios":"Calling josex.NewEncryptionKey with a signature algorithm like ES256, an unsupported/typo'd alg string, or a PBES2/A128GCM key-management value; passing bits incompatible with an ECDH curve is a sibling error, but a truly unknown alg hits this message.","commonSituations":"Mixing up signature and encryption algorithm constants in config; using dir or A*GCM key-wrap algorithms which need a symmetric key, not a generated keypair; typos in YAML/JSON JWK generation settings.","solutions":["Use a supported encryption alg: RSA1_5, RSA-OAEP, RSA-OAEP-256, ECDH-ES, ECDH-ES+A128KW, ECDH-ES+A192KW, ECDH-ES+A256KW","For dir/A*GCM algorithms, generate/provide a symmetric key rather than calling NewEncryptionKey","Check you are not passing a SignatureAlgorithm where a KeyAlgorithm is expected"],"exampleFix":"// before\npub, priv, err := josex.NewEncryptionKey(jose.KeyAlgorithm(\"dir\"), 0)\n// after\npub, priv, err := josex.NewEncryptionKey(jose.RSA_OAEP_256, 2048)","handlingStrategy":"validation","validationCode":"var supportedEncAlgs = map[jose.KeyAlgorithm]bool{\n    jose.RSA1_5: true, jose.RSA_OAEP: true, jose.RSA_OAEP_256: true,\n    jose.ECDH_ES: true, jose.ECDH_ES_A128KW: true, jose.ECDH_ES_A192KW: true, jose.ECDH_ES_A256KW: true,\n}\nfunc checkEncryptionAlg(alg jose.KeyAlgorithm) error {\n    if !supportedEncAlgs[alg] {\n        return fmt.Errorf(\"alg %q not supported for encryption key generation\", alg)\n    }\n    return nil\n}","typeGuard":"func isKeyEncryptionAlg(alg string) bool {\n    switch alg {\n    case \"RSA1_5\", \"RSA-OAEP\", \"RSA-OAEP-256\", \"ECDH-ES\", \"ECDH-ES+A128KW\", \"ECDH-ES+A192KW\", \"ECDH-ES+A256KW\":\n        return true\n    }\n    return false\n}","tryCatchPattern":"pub, priv, err := josex.NewEncryptionKey(alg, bits)\nif err != nil {\n    return fmt.Errorf(\"config error: cannot generate encryption key: %w\", err)\n}","preventionTips":["Do not confuse jose.SignatureAlgorithm with jose.KeyAlgorithm — use the typed constants","Remember dir/A*GCM require symmetric keys, not generated keypairs","Validate encryption config at startup before first use","Pin curve sizes (256/384/521) when using ECDH-ES to avoid the sibling curve-size error"],"tags":["jose","jwk","crypto","encryption","go"],"backgroundTag":"unsupported-jose-algorithm","analyzedSha":"4174065ffb052799890f7480f5360a877a67ffc1","analyzedAt":"2026-09-03T14:52:41.581Z","contentChangedAt":"2026-09-03T14:52:41.581Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}