{"record":{"id":"864a16ef1cfc5db2","repo":"denoland/deno","slug":"err-crypto-unknown-dh-group-864a16","errorCode":"ERR_CRYPTO_UNKNOWN_DH_GROUP","errorMessage":"Unknown DH group","messagePattern":"Unknown DH group","errorType":"error_code","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"ext/node/polyfills/internal/crypto/keygen.ts","lineNumber":583,"sourceCode":"      const { group, primeLength, prime, generator } = options;\n      if (group != null) {\n        if (prime != null) {\n          throw new ERR_INCOMPATIBLE_OPTION_PAIR(\"group\", \"prime\");\n        }\n        if (primeLength != null) {\n          throw new ERR_INCOMPATIBLE_OPTION_PAIR(\"group\", \"primeLength\");\n        }\n        if (generator != null) {\n          throw new ERR_INCOMPATIBLE_OPTION_PAIR(\"group\", \"generator\");\n        }\n\n        validateString(group, \"options.group\");\n\n        if (\n          group !== \"modp5\" && group !== \"modp14\" && group !== \"modp15\" &&\n          group !== \"modp16\" && group !== \"modp17\" && group !== \"modp18\"\n        ) {\n          throw new ERR_CRYPTO_UNKNOWN_DH_GROUP();\n        }\n\n        if (mode === kSync) {\n          return op_node_generate_dh_group_key(group);\n        } else {\n          return op_node_generate_dh_group_key_async(group);\n        }\n      }\n\n      if (prime != null) {\n        if (primeLength != null) {\n          throw new ERR_INCOMPATIBLE_OPTION_PAIR(\"prime\", \"primeLength\");\n        }\n\n        validateBuffer(prime, \"options.prime\");\n      } else if (primeLength != null) {\n        validateInt32(primeLength, \"options.primeLength\", 0);\n      } else {","sourceCodeStart":565,"sourceCodeEnd":601,"githubUrl":"https://github.com/denoland/deno/blob/9ad36f7a2cce60488e6ec52283efb32efddaf93a/ext/node/polyfills/internal/crypto/keygen.ts#L565-L601","documentation":"When generateKeyPair('dh', { group }) is used, the polyfill only accepts the predefined MODP groups 'modp5', 'modp14', 'modp15', 'modp16', 'modp17', 'modp18'. Any other string reaches the allowlist check and throws ERR_CRYPTO_UNKNOWN_DH_GROUP ('Unknown DH group').","triggerScenarios":"crypto.generateKeyPair('dh', { group: 'modp2048' }) — group values like 'modp1', 'modp2', 'modp1024', 'modp2048', custom names, or typos that are not in the modp5/modp14-18 list.","commonSituations":"Using IKE/RFC naming where the 2048-bit group is 'modp2048' but node:crypto calls it 'modp14'; assuming all Oakley groups are supported; copying DH group identifiers from Java JCE or OpenSSL config.","solutions":["Map the desired bit size to a supported name: 1536→modp5, 2048→modp14, 3072→modp15, 4096→modp16, 6144→modp17, 8192→modp18","For unsupported sizes, generate custom parameters (openssl dhparam) and pass options.prime instead of group","Validate the group string against the allowlist before calling generateKeyPair"],"exampleFix":"// before\ncrypto.generateKeyPair('dh', { group: 'modp2048' });\n// after\ncrypto.generateKeyPair('dh', { group: 'modp14' }); // 2048-bit MODP group","handlingStrategy":"validation","validationCode":"const DH_GROUPS = ['modp5', 'modp14', 'modp15', 'modp16', 'modp17', 'modp18'];\nif (!DH_GROUPS.includes(dhOptions.group)) {\n  throw new Error(`Unknown DH group '${dhOptions.group}'; supported: ${DH_GROUPS.join(', ')}`);\n}\ncrypto.generateKeyPairSync('dh', dhOptions);","typeGuard":"function isSupportedDhGroup(name) {\n  return ['modp5', 'modp14', 'modp15', 'modp16', 'modp17', 'modp18'].includes(name);\n}","tryCatchPattern":"try {\n  crypto.generateKeyPairSync('dh', opts);\n} catch (e) {\n  if (e.code === 'ERR_CRYPTO_UNKNOWN_DH_GROUP') throw new Error(`Fix DH group name: ${opts.group}`);\n  throw e;\n}","preventionTips":["Map RFC/IKE bit sizes to modpN names once, in a constant","Keep the supported-group list next to your DH config code","For exotic sizes, pre-generate primes with openssl dhparam and pass prime"],"tags":["crypto","keygen","diffie-hellman","node-compat"],"backgroundTag":"unknown-dh-group","analyzedSha":"9ad36f7a2cce60488e6ec52283efb32efddaf93a","analyzedAt":"2026-08-20T13:07:44.778Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}