{"record":{"id":"6150f60412715581","repo":"awslabs/llrt","slug":"unsupported-hmac-algorithm-for-graviola","errorCode":null,"errorMessage":"Unsupported HMAC algorithm for Graviola","messagePattern":"Unsupported HMAC algorithm for Graviola","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"modules/llrt_crypto/src/provider/graviola.rs","lineNumber":86,"sourceCode":"impl CryptoProvider for GraviolaProvider {\n    type Digest = GraviolaDigest;\n    type Hmac = GraviolaHmac;\n\n    fn digest(&self, algorithm: HashAlgorithm) -> Self::Digest {\n        match algorithm {\n            HashAlgorithm::Sha256 => GraviolaDigest::Sha256(Sha256::new()),\n            HashAlgorithm::Sha384 => GraviolaDigest::Sha384(Sha384::new()),\n            HashAlgorithm::Sha512 => GraviolaDigest::Sha512(Sha512::new()),\n            _ => panic!(\"Unsupported digest algorithm for Graviola\"),\n        }\n    }\n\n    fn hmac(&self, algorithm: HashAlgorithm, key: &[u8]) -> Self::Hmac {\n        match algorithm {\n            HashAlgorithm::Sha256 => GraviolaHmac::Sha256(Hmac::<Sha256>::new(key)),\n            HashAlgorithm::Sha384 => GraviolaHmac::Sha384(Hmac::<Sha384>::new(key)),\n            HashAlgorithm::Sha512 => GraviolaHmac::Sha512(Hmac::<Sha512>::new(key)),\n            _ => panic!(\"Unsupported HMAC algorithm for Graviola\"),\n        }\n    }\n\n    fn ecdsa_sign(\n        &self,\n        _curve: EllipticCurve,\n        _private_key_der: &[u8],\n        _digest: &[u8],\n    ) -> Result<Vec<u8>, CryptoError> {\n        Err(CryptoError::UnsupportedAlgorithm)\n    }\n\n    fn ecdsa_verify(\n        &self,\n        _curve: EllipticCurve,\n        _public_key_sec1: &[u8],\n        _signature: &[u8],\n        _digest: &[u8],","sourceCodeStart":68,"sourceCodeEnd":104,"githubUrl":"https://github.com/awslabs/llrt/blob/742fc00b82cbeaab1c1b76f0d706c302a5cbc306/modules/llrt_crypto/src/provider/graviola.rs#L68-L104","documentation":"This panic comes from the Graviola provider's `hmac` implementation when given a HashAlgorithm it cannot instantiate. Only HMAC-SHA256, HMAC-SHA384, and HMAC-SHA512 are implemented; every other variant (MD5, SHA-1, etc.) hits the `_` arm and panics. It mirrors the digest limitation but for keyed MAC operations.","triggerScenarios":"Creating an HMAC with HashAlgorithm::Md5 or Sha1 while the Graviola provider is the active backend.","commonSituations":"Interoperating with legacy systems that require HMAC-MD5/HMAC-SHA1 while the deployment uses the Graviola provider, or algorithm selected from configuration without validating against provider capabilities.","solutions":["Use HMAC-SHA256/384/512 instead.","Switch to the Ring or RustCrypto provider which supports more HMAC algorithms.","Validate the configured HMAC algorithm against provider support at startup.","Change provider feature flags in Cargo.toml to match the algorithms you need."],"exampleFix":"// before\nlet h = Hmac::new(HashAlgorithm::Sha1, key); // panics with Graviola\n// after\nlet h = Hmac::new(HashAlgorithm::Sha256, key);","handlingStrategy":"validation","validationCode":"const GRAVIOLA_HMAC = new Set(['sha256', 'sha384', 'sha512']);\nif (!GRAVIOLA_HMAC.has(algorithm)) throw new Error('Graviola provider does not support HMAC algorithm: ' + algorithm);","typeGuard":"function graviolaSupportsHmac(alg) {\n  return ['Sha256', 'Sha384', 'Sha512'].includes(alg);\n}","tryCatchPattern":"match hmac_result {\n    Err(CryptoError::UnsupportedHmac(a)) => switch_to_rustcrypto_provider(a),\n    Ok(h) => h,\n}","preventionTips":["Standardize on HMAC-SHA256 for new integrations.","Document provider limitations where algorithms are configurable.","Add a startup self-test that exercises configured algorithms before serving traffic."],"tags":["crypto","panic","hmac","unsupported-algorithm"],"backgroundTag":"unsupported-enum-value","analyzedSha":"742fc00b82cbeaab1c1b76f0d706c302a5cbc306","analyzedAt":"2026-09-12T11:14:07.838Z","contentChangedAt":"2026-09-12T11:14:07.838Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}