{"record":{"id":"41b27a54e9d1c735","repo":"denoland/deno","slug":"kmacimportparams-length-cannot-be-0","errorCode":null,"errorMessage":"KmacImportParams.length cannot be 0","messagePattern":"KmacImportParams\\.length cannot be 0","errorType":"exception","errorClass":"DOMException","httpStatus":null,"severity":"error","filePath":"ext/node/polyfills/internal/crypto/keys.ts","lineNumber":820,"sourceCode":"        );\n      }\n      const alg = algorithm as { length?: number };\n      if (alg.length !== undefined && alg.length === 0) {\n        throw new DOMException(\n          \"HmacImportParams.length cannot be 0\",\n          \"DataError\",\n        );\n      }\n    } else if (algName === \"KMAC128\" || algName === \"KMAC256\") {\n      if (usages.length === 0) {\n        throw new DOMException(\n          \"Usages cannot be empty when importing a secret key.\",\n          \"SyntaxError\",\n        );\n      }\n      const alg = algorithm as { length?: number };\n      if (alg.length !== undefined && alg.length === 0) {\n        throw new DOMException(\n          \"KmacImportParams.length cannot be 0\",\n          \"DataError\",\n        );\n      }\n    } else {\n      if (usages.length === 0) {\n        throw new DOMException(\n          \"Usages cannot be empty when importing a secret key.\",\n          \"SyntaxError\",\n        );\n      }\n    }\n\n    return importCryptoKeySync(\n      \"raw\",\n      rawData,\n      algorithm,\n      extractable,","sourceCodeStart":802,"sourceCodeEnd":838,"githubUrl":"https://github.com/denoland/deno/blob/9ad36f7a2cce60488e6ec52283efb32efddaf93a/ext/node/polyfills/internal/crypto/keys.ts#L802-L838","documentation":"Thrown by SecretKeyObject.toCryptoKey() when the algorithm object for 'KMAC128'/'KMAC256' carries length === 0. KmacImportParams.length is the output/key length in bits and zero is invalid. The check is skipped when the property is absent, so hitting it means a zero value was explicitly supplied, usually via computation.","triggerScenarios":"createSecretKey(secret).toCryptoKey({ name: 'KMAC128', length: 0 }, false, ['sign']).","commonSituations":"length sourced from a config field defaulting to 0; arithmetic that produces 0 for some inputs (empty input length, disabled option); unit confusion between bytes and bits.","solutions":["Omit length to use the algorithm default","Pass the intended length in bits (e.g., 256)","Guard: only set length when it is a positive number"],"exampleFix":"// before\nconst params = { name: 'KMAC256', length: outLen };\n\n// after\nconst params = { name: 'KMAC256' };\nif (outLen > 0) params.length = outLen;","handlingStrategy":"validation","validationCode":"const params: Record<string, unknown> = { name: 'KMAC256' };\nif (Number.isFinite(length) && length! > 0) params.length = length;\nconst key = secretKeyObject.toCryptoKey(params, false, usages);","typeGuard":"const isValidKmacLength = (n: unknown): n is number =>\n  typeof n === 'number' && Number.isInteger(n) && n > 0;","tryCatchPattern":"try {\n  key = secretKeyObject.toCryptoKey(params, false, usages);\n} catch (e) {\n  if (e instanceof DOMException && e.name === 'DataError' && /length cannot be 0/.test(e.message)) {\n    const { length: _drop, ...rest } = params as any;\n    key = secretKeyObject.toCryptoKey(rest, false, usages);\n  } else throw e;\n}","preventionTips":["Build KMAC params conditionally, same as HMAC","Validate any length coming from config before it reaches crypto APIs","Prefer omitting length unless a spec forces a specific output length"],"tags":["crypto","webcrypto","kmac","key-length","node-compat"],"backgroundTag":"webcrypto-zero-length-key","analyzedSha":"9ad36f7a2cce60488e6ec52283efb32efddaf93a","analyzedAt":"2026-08-20T13:07:44.778Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}