{"record":{"id":"3e0e74d898557126","repo":"denoland/deno","slug":"err-crypto-unknown-cipher-3e0e74","errorCode":"ERR_CRYPTO_UNKNOWN_CIPHER","errorMessage":"Unknown cipher","messagePattern":"Unknown cipher","errorType":"exception","errorClass":"ERR_CRYPTO_UNKNOWN_CIPHER","httpStatus":null,"severity":"error","filePath":"ext/node/polyfills/internal/crypto/keygen.ts","lineNumber":335,"sourceCode":"}\n\nfunction parsePrivateKeyEncoding(\n  enc: any,\n  keyType: string | undefined,\n  objName: string,\n) {\n  validateObject(enc, \"options\");\n\n  const { format, type } = parseKeyFormatAndType(enc, keyType, false, objName);\n\n  const { cipher, passphrase } = enc;\n\n  if (cipher != null) {\n    if (typeof cipher !== \"string\") {\n      throw new ERR_INVALID_ARG_VALUE(option(\"cipher\", objName), cipher);\n    }\n    if (!getCiphers().includes(cipher)) {\n      throw new ERR_CRYPTO_UNKNOWN_CIPHER();\n    }\n    if (\n      format === \"der\" &&\n      (type === \"pkcs1\" || type === \"sec1\")\n    ) {\n      throw new ERR_CRYPTO_INCOMPATIBLE_KEY_OPTIONS(\n        type,\n        \"does not support encryption\",\n      );\n    }\n  } else if (passphrase !== undefined) {\n    throw new ERR_INVALID_ARG_VALUE(option(\"cipher\", objName), cipher);\n  }\n\n  if (cipher != null && !isStringOrBuffer(passphrase)) {\n    throw new ERR_INVALID_ARG_VALUE(option(\"passphrase\", objName), passphrase);\n  }\n","sourceCodeStart":317,"sourceCodeEnd":353,"githubUrl":"https://github.com/denoland/deno/blob/9ad36f7a2cce60488e6ec52283efb32efddaf93a/ext/node/polyfills/internal/crypto/keygen.ts#L317-L353","documentation":"After confirming cipher is a string, the polyfill checks it against crypto.getCiphers() (ext/node/polyfills/internal/crypto/keygen.ts:334-337) and throws ERR_CRYPTO_UNKNOWN_CIPHER when the name is not in the list. The check is an exact, case-sensitive includes(), so uppercase spellings and aliases not exposed by the OpenSSL build fail just like invented names. Deno's supported set can also differ from a full Node/OpenSSL build.","triggerScenarios":"cipher: 'AES-256-CBC' (uppercase, case-sensitive miss); typo like 'aes-256-cbx'; a cipher not compiled into the runtime (e.g. 'des3' variants, 'camellia-256-cbc' depending on build); a cipher name from a different crypto stack (WebCrypto AES-GCM label used verbatim).","commonSituations":"Cipher names from config files, IaC templates, or documentation that use different casing; hardcoding a legacy cipher the platform dropped; running the same code on Node and Deno where the available cipher lists differ.","solutions":["Pick the name from crypto.getCiphers() at runtime - e.g. verify getCiphers().includes(cipher) before generating.","Use canonical lowercase OpenSSL names such as 'aes-256-cbc' or 'aes-128-gcm'.","Make the cipher configurable with a safe default so a missing name falls back rather than crashing."],"exampleFix":"// before\nprivateKeyEncoding: { cipher: 'AES-256-CBC', passphrase: 'pw', /* ... */ } // not in getCiphers()\n\n// after\nconst cipher = 'aes-256-cbc';\nif (!crypto.getCiphers().includes(cipher)) throw new Error(`cipher unavailable: ${cipher}`);\nprivateKeyEncoding: { cipher, passphrase: 'pw', /* ... */ }","handlingStrategy":"validation","validationCode":"const cipher = String(cfg.cipher || 'aes-256-cbc');\nif (!crypto.getCiphers().includes(cipher)) {\n  throw new Error(`cipher '${cipher}' unavailable in this runtime; pick from crypto.getCiphers()`);\n}\nprivateKeyEncoding: { format: 'pem', type: 'pkcs8', cipher, passphrase };","typeGuard":"function isAvailableCipher(name) {\n  return typeof name === 'string' && crypto.getCiphers().includes(name);\n}","tryCatchPattern":"try { crypto.generateKeyPairSync(alg, opts); }\ncatch (e) {\n  if (e.code === 'ERR_CRYPTO_UNKNOWN_CIPHER') {\n    opts.privateKeyEncoding.cipher = 'aes-256-cbc';\n    return crypto.generateKeyPairSync(alg, opts);\n  }\n  throw e;\n}","preventionTips":["Check membership in crypto.getCiphers() before generating keys.","Use canonical lowercase OpenSSL cipher names.","Make the cipher configurable with a known-good default."],"tags":["crypto","cipher","key-generation","node-compat"],"backgroundTag":"unknown-cipher-algorithm","analyzedSha":"9ad36f7a2cce60488e6ec52283efb32efddaf93a","analyzedAt":"2026-08-20T13:07:44.778Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}