{"record":{"id":"330231dc73f455c1","repo":"hyperledger/fabric","slug":"hash-family-not-recognized-s","errorCode":null,"errorMessage":"hash family not recognized [%s]","messagePattern":"hash family not recognized \\[(.+?)\\]","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"msp/identities.go","lineNumber":233,"sourceCode":"\n\t// We serialize identities by prepending the MSPID and appending the ASN.1 DER content of the cert\n\tsId := &msp.SerializedIdentity{Mspid: id.id.Mspid, IdBytes: pemBytes}\n\tidBytes, err := proto.Marshal(sId)\n\tif err != nil {\n\t\treturn nil, errors.Wrapf(err, \"could not marshal a SerializedIdentity structure for identity %s\", id.id)\n\t}\n\n\treturn idBytes, nil\n}\n\nfunc (id *identity) getHashOpt(hashFamily string) (bccsp.HashOpts, error) {\n\tswitch hashFamily {\n\tcase bccsp.SHA2:\n\t\treturn bccsp.GetHashOpt(bccsp.SHA256)\n\tcase bccsp.SHA3:\n\t\treturn bccsp.GetHashOpt(bccsp.SHA3_256)\n\t}\n\treturn nil, errors.Errorf(\"hash family not recognized [%s]\", hashFamily)\n}\n\ntype signingidentity struct {\n\t// we embed everything from a base identity\n\tidentity\n\n\t// signer corresponds to the object that can produce signatures from this identity\n\tsigner crypto.Signer\n}\n\nfunc newSigningIdentity(cert *x509.Certificate, pk bccsp.Key, signer crypto.Signer, msp *bccspmsp) (SigningIdentity, error) {\n\t// mspIdentityLogger.Infof(\"Creating signing identity instance for ID %s\", id)\n\tmspId, err := newIdentity(cert, pk, msp)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\treturn &signingidentity{\n\t\tidentity: identity{","sourceCodeStart":215,"sourceCodeEnd":251,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/msp/identities.go#L215-L251","documentation":"getHashOpt maps a hash-family string (SHA2 or SHA3, as set in the MSP config's crypto configuration) to a BCCSP hash option. If the hash family is anything else it returns nil and this error. It is thrown when a signingidentity or verifier was built with a hash family BCCSP's msp layer does not support.","triggerScenarios":"Calling Verify or Sign on an identity whose MSP was configured with CryptoConfig/SignatureHashFamily set to something other than \"SHA2\" or \"SHA3\" (case-sensitive).","commonSituations":"Hand-edited or generated config.yaml with a typo like \"sha256\", \"SHA\", or \"SHA512\" in the signature hash family field; config produced by a tool writing unsupported values.","solutions":["Set the MSP config crypto spec SignatureHashFamily to exactly \"SHA2\" (or \"SHA3\") in config.yaml","Regenerate the MSP directory with cryptogen or the Fabric CA instead of hand-editing crypto config","If you need a different hash, change it at the BCCSP provider level, not the MSP hash family field"],"exampleFix":"// before (config.yaml)\ncrypto:\n  hash: SHA512\n// after\ncrypto:\n  hash: SHA2","handlingStrategy":"validation","validationCode":"func validHashFamily(h string) bool { return h == \"SHA2\" || h == \"SHA3\" }\nif !validHashFamily(cfg.CryptoConfig.SignatureHashFamily) {\n    return fmt.Errorf(\"unsupported hash family %q; use SHA2 or SHA3\", cfg.CryptoConfig.SignatureHashFamily)\n}","typeGuard":null,"tryCatchPattern":"id, err := signingIdentity.Sign(msg)\nif err != nil && strings.Contains(err.Error(), \"hash family not recognized\") {\n    // reconfigure MSP with SHA2/SHA3 before retrying\n}","preventionTips":["Only ever set SignatureHashFamily to the literal strings SHA2 or SHA3","Use cryptogen/Fabric CA to generate MSP config.yaml instead of hand-editing","Unit-test Sign/Verify on each configured MSP at startup"],"tags":["msp","bccsp","hash","config"],"backgroundTag":"unsupported-hash-family","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}