{"record":{"id":"b75abc3c05e747e4","repo":"denoland/deno","slug":"err-ossl-dh-bad-generator","errorCode":"ERR_OSSL_DH_BAD_GENERATOR","errorMessage":"bad generator","messagePattern":"bad generator","errorType":"error_code","errorClass":"NodeError","httpStatus":null,"severity":"error","filePath":"ext/node/polyfills/internal/crypto/diffiehellman.ts","lineNumber":200,"sourceCode":"          \"modulus too small\",\n        );\n      }\n\n      this.#prime = Buffer.from(\n        TypedArrayPrototypeGetBuffer(\n          op_node_gen_prime(this.#primeLength, false, null, null),\n        ),\n      );\n    }\n\n    if (!generator) {\n      generator = DH_GENERATOR;\n    }\n\n    if (typeof generator === \"number\") {\n      validateInt32(generator, \"generator\");\n      if (generator <= 0 || generator >= 0x7fffffff) {\n        throw new NodeError(\"ERR_OSSL_DH_BAD_GENERATOR\", \"bad generator\");\n      }\n      // Store with minimal byte representation, matching Node.js/OpenSSL behavior\n      if (generator <= 0xff) {\n        this.#generator = Buffer.alloc(1);\n        this.#generator.writeUint8(generator);\n      } else if (generator <= 0xffff) {\n        this.#generator = Buffer.alloc(2);\n        this.#generator.writeUint16BE(generator);\n      } else {\n        this.#generator = Buffer.alloc(4);\n        this.#generator.writeUint32BE(generator);\n      }\n    } else if (typeof generator === \"string\") {\n      generator = toBuf(generator, genEncoding as string);\n      this.#generator = generator;\n    } else if (\n      !isArrayBufferView(generator) && !isAnyArrayBuffer(generator)\n    ) {","sourceCodeStart":182,"sourceCodeEnd":218,"githubUrl":"https://github.com/denoland/deno/blob/9ad36f7a2cce60488e6ec52283efb32efddaf93a/ext/node/polyfills/internal/crypto/diffiehellman.ts#L182-L218","documentation":"A numeric generator for DiffieHellman is range-checked at diffiehellman.ts:200: it must be an int32 strictly between 0 and 0x7fffffff. Values <= 0 or >= 2147483647 throw ERR_OSSL_DH_BAD_GENERATOR ('bad generator'); NaN/negative also trip validateInt32 first.","triggerScenarios":"new DiffieHellman(2048, 0); generator -1; generator 2147483647 (0x7fffffff itself is rejected); generator NaN from a failed parse.","commonSituations":"Generator config defaulting to 0; sign errors producing negatives; code that treats 0x7fffffff as a safe sentinel value.","solutions":["Use generator 2 (or 5) — the implementation's generator check ultimately only accepts those two values anyway","Validate the number is an integer in (0, 0x7fffffff) before constructing","Fix config parsing that yields 0 or negative generators"],"exampleFix":"// before\nnew DiffieHellman(2048, 0); // bad generator\n\n// after\nnew DiffieHellman(2048, 2);","handlingStrategy":"validation","validationCode":"function assertDhGenerator(g) {\n  if (typeof g === 'number' && (!Number.isInteger(g) || g <= 0 || g >= 0x7fffffff)) {\n    throw new RangeError('generator must be an integer in (0, 2^31 - 1)');\n  }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Hard-code generator 2 unless the protocol mandates 5","Reject falsy/zero generator values during config validation"],"tags":["crypto","diffiehellman","validation"],"backgroundTag":"dh-bad-generator","analyzedSha":"9ad36f7a2cce60488e6ec52283efb32efddaf93a","analyzedAt":"2026-08-20T13:07:44.778Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}