{"record":{"id":"b5e58f1db24797cd","repo":"golang/go","slug":"ecdsa-requested-hash-function-unavailable","errorCode":null,"errorMessage":"ecdsa: requested hash function unavailable: ","messagePattern":"ecdsa: requested hash function unavailable: ","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/ecdsa/ecdsa.go","lineNumber":464,"sourceCode":"\t\treturn signFIPSDeterministic(ecdsa.P224(), h, priv, hash)\n\tcase elliptic.P256().Params():\n\t\treturn signFIPSDeterministic(ecdsa.P256(), h, priv, hash)\n\tcase elliptic.P384().Params():\n\t\treturn signFIPSDeterministic(ecdsa.P384(), h, priv, hash)\n\tcase elliptic.P521().Params():\n\t\treturn signFIPSDeterministic(ecdsa.P521(), h, priv, hash)\n\tdefault:\n\t\treturn nil, errors.New(\"ecdsa: curve not supported by deterministic signatures\")\n\t}\n}\n\nfunc signFIPSDeterministic[P ecdsa.Point[P]](c *ecdsa.Curve[P], hashFunc crypto.Hash, priv *PrivateKey, hash []byte) ([]byte, error) {\n\tk, err := privateKeyToFIPS(c, priv)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tif !hashFunc.Available() {\n\t\treturn nil, errors.New(\"ecdsa: requested hash function unavailable: \" + hashFunc.String())\n\t}\n\th := fips140hash.UnwrapNew(hashFunc.New)\n\tif fips140only.Enforced() && !fips140only.ApprovedHash(h()) {\n\t\treturn nil, errors.New(\"crypto/ecdsa: use of hash functions other than SHA-2 or SHA-3 is not allowed in FIPS 140-only mode\")\n\t}\n\tsig, err := ecdsa.SignDeterministic(c, h, k, hash)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\treturn encodeSignature(sig.R, sig.S)\n}\n\nfunc encodeSignature(r, s []byte) ([]byte, error) {\n\tvar b cryptobyte.Builder\n\tb.AddASN1(asn1.SEQUENCE, func(b *cryptobyte.Builder) {\n\t\taddASN1IntBytes(b, r)\n\t\taddASN1IntBytes(b, s)\n\t})","sourceCodeStart":446,"sourceCodeEnd":482,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/ecdsa/ecdsa.go#L446-L482","documentation":"Thrown by signFIPSDeterministic when hashFunc.Available() returns false. This means the requested crypto.Hash algorithm is not compiled into the binary — typically because the hash package has not been imported (and thus linked) yet. In Go, hash implementations are registered via init() in their packages, so an unimported hash package is not available.","triggerScenarios":"Calling deterministic Sign with opts.HashFunc() set to a crypto.Hash constant whose implementation package hasn't been imported anywhere in the binary. For example, using crypto.SHA3_256 without importing crypto/sha3 anywhere, or using a hash like crypto.MD5 whose package was excluded via build tags.","commonSituations":"Using SHA-3 hashes without importing crypto/sha3; using BLAKE2 hashes without importing the blake2 package; tree-shaking or build configurations that exclude hash packages; cross-compilation that misses hash implementations.","solutions":["Import the hash package to ensure it's linked: add 'import _ \"crypto/sha3\"' if using SHA-3 hashes.","Switch to a hash that is already available (SHA-256 and SHA-512 from crypto/sha256/crypto/sha512 are commonly linked).","Check hashFunc.Available() before calling Sign and provide a clear error message to the user."],"exampleFix":"// before\nimport \"crypto\"\n// SHA-3 not imported anywhere\nsig, err := priv.Sign(nil, digest, crypto.SHA3_256)\n\n// after\nimport (\n    \"crypto\"\n    _ \"crypto/sha3\" // ensure SHA-3 is linked\n)\nsig, err := priv.Sign(nil, digest, crypto.SHA3_256)","handlingStrategy":"validation","validationCode":"func validateHashAvailable(h crypto.Hash) error {\n    if !h.Available() {\n        return fmt.Errorf(\"hash %s is not linked — import its package\", h)\n    }\n    return nil\n}","typeGuard":"func isHashAvailable(h crypto.Hash) bool {\n    return h.Available()\n}","tryCatchPattern":"sig, err := priv.Sign(nil, digest, h)\nif err != nil && strings.Contains(err.Error(), \"unavailable\") {\n    return fmt.Errorf(\"hash %s not linked; add 'import _ \"%s\"' to your code: %w\",\n        h, hashPackageFor(h), err)\n}","preventionTips":["Add blank imports for hash packages: 'import _ \"crypto/sha3\"' when using SHA-3.","Call crypto.Hash.Available() before using uncommon hashes in signing."],"tags":["crypto","ecdsa","signing","hash","build-config","linker","rfc6979"],"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T06:17:24.410Z"}