{"record":{"id":"522073b24bc25073","repo":"auth0/node-jsonwebtoken","slug":"invalid-key-for-this-operation-its-rsa-pss-parame-522073","errorCode":null,"errorMessage":"Invalid key for this operation, its RSA-PSS parameter saltLength does not meet the requirements of \"alg\" ${algorithm}.","messagePattern":"Invalid key for this operation, its RSA-PSS parameter saltLength does not meet the requirements of \"alg\" (.+?)\\.","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/validateAsymmetricKey.js","lineNumber":60,"sourceCode":"      const keyCurve = key.asymmetricKeyDetails.namedCurve;\n      const allowedCurve = allowedCurves[algorithm];\n\n      if (keyCurve !== allowedCurve) {\n        throw new Error(`\"alg\" parameter \"${algorithm}\" requires curve \"${allowedCurve}\".`);\n      }\n      break;\n\n    case 'rsa-pss':\n      if (RSA_PSS_KEY_DETAILS_SUPPORTED) {\n        const length = parseInt(algorithm.slice(-3), 10);\n        const { hashAlgorithm, mgf1HashAlgorithm, saltLength } = key.asymmetricKeyDetails;\n\n        if (hashAlgorithm !== `sha${length}` || mgf1HashAlgorithm !== hashAlgorithm) {\n          throw new Error(`Invalid key for this operation, its RSA-PSS parameters do not meet the requirements of \"alg\" ${algorithm}.`);\n        }\n\n        if (saltLength !== undefined && saltLength > length >> 3) {\n          throw new Error(`Invalid key for this operation, its RSA-PSS parameter saltLength does not meet the requirements of \"alg\" ${algorithm}.`)\n        }\n      }\n      break;\n    }\n  }\n}\n","sourceCodeStart":42,"sourceCodeEnd":67,"githubUrl":"https://github.com/auth0/node-jsonwebtoken/blob/b924272f29192e12926b5414546f7c5bfcc9579d/lib/validateAsymmetricKey.js#L42-L67","documentation":"Beyond hash parameters, RSA-PSS keys carry a saltLength. The PS* algorithm's salt length is bits(algorithm)/8 (e.g. PS256 -> 32 bytes); if the key's saltLength is defined and larger than that, jsonwebtoken rejects the key because the resulting signature would not conform to the algorithm's expected salt length.","triggerScenarios":"Signing/verifying with PS256/PS384/PS512 using an RSA-PSS KeyObject whose asymmetricKeyDetails.saltLength exceeds length>>3 (e.g. a key with saltLength 64 used with PS256), on Node versions exposing RSA-PSS key details.","commonSituations":"Keys generated by OpenSSL or HSM tooling with a custom/optimal salt length (often equal to hash length or larger) then used with a different PS* variant; HSM/KMS-exported PSS keys with enforced salt lengths.","solutions":["Regenerate the PSS key with salt length <= the algorithm's byte length (e.g. rsa_pss_keygen_saltlen:32 for PS256)","Or select the PS* algorithm whose salt length (alg bits / 8) accommodates the key's saltLength","Set options to a matching salt length or fall back to RS256 with a standard RSA key"],"exampleFix":"// before\nopenssl genpkey -algorithm RSA-PSS -pkeyopt rsa_pss_keygen_saltlen:62 -out key.pem  # used with PS256\n// after\nopenssl genpkey -algorithm RSA-PSS -pkeyopt rsa_pss_keygen_saltlen:32 -out key.pem","handlingStrategy":"validation","validationCode":"function pssSaltLengthOk(alg, key) {\n  if (!/^PS/.test(alg)) return true;\n  const bytes = parseInt(alg.slice(2), 10) >> 3;\n  const s = key.asymmetricKeyDetails?.saltLength;\n  return s === undefined || s <= bytes;\n}\nif (!pssSaltLengthOk(alg, key)) throw new Error('PSS saltLength ' + key.asymmetricKeyDetails.saltLength + ' exceeds ' + alg + ' requirement');","typeGuard":"function hasAcceptablePssSaltLength(alg, key) {\n  const maxBytes = parseInt(alg.replace(/^PS/, ''), 10) >> 3;\n  const s = key.asymmetricKeyDetails?.saltLength;\n  return s === undefined || s <= maxBytes;\n}","tryCatchPattern":"try {\n  return jwt.sign(payload, pssKey, { algorithm: alg });\n} catch (err) {\n  if (/saltLength does not meet/.test(err.message)) {\n    // degrade to RS256 with the PKCS#1 variant of the key or regenerate\n    throw new Error('Regenerate PSS key with saltLength <= ' + (parseInt(alg.slice(2), 10) >> 3));\n  }\n  throw err;\n}","preventionTips":["Set rsa_pss_keygen_saltlen explicitly to the algorithm's byte length when generating keys","Verify saltLength on imported HSM/KMS keys before use","Avoid mixing salt lengths across signing and verifying environments","Document the PS* variant per key in your key inventory"],"tags":["jwt","rsa-pss","salt-length"],"backgroundTag":"jwt-rsa-pss-parameters-invalid","analyzedSha":"b924272f29192e12926b5414546f7c5bfcc9579d","analyzedAt":"2026-09-02T21:29:06.876Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-10T02:17:09.455Z"}