{"record":{"id":"bf3b21413ccd61d0","repo":"denoland/deno","slug":"err-crypto-unknown-dh-group","errorCode":"ERR_CRYPTO_UNKNOWN_DH_GROUP","errorMessage":"Unknown DH group","messagePattern":"Unknown DH group","errorType":"exception","errorClass":"ERR_CRYPTO_UNKNOWN_DH_GROUP","httpStatus":null,"severity":"error","filePath":"ext/node/polyfills/internal/crypto/diffiehellman.ts","lineNumber":1296,"sourceCode":"      0xFFFFFFFF,\n    ],\n    generator: 2,\n  },\n};\n\nDiffieHellman.prototype = DiffieHellmanImpl.prototype;\n\nfunction DiffieHellmanGroup(name: string) {\n  return new DiffieHellmanGroupImpl(name);\n}\n\nclass DiffieHellmanGroupImpl {\n  verifyError!: number;\n  #diffiehellman: DiffieHellmanImpl;\n\n  constructor(name: string) {\n    if (!ArrayPrototypeIncludes(DH_GROUP_NAMES, name)) {\n      throw new ERR_CRYPTO_UNKNOWN_DH_GROUP();\n    }\n    const words = DH_GROUPS[name].prime;\n    const buf = Buffer.alloc(words.length * 4);\n    for (let i = 0; i < words.length; i++) {\n      buf.writeUInt32BE(words[i], i * 4);\n    }\n    this.#diffiehellman = new DiffieHellmanImpl(\n      buf,\n      DH_GROUPS[name].generator,\n    );\n    this.verifyError = 0;\n  }\n\n  computeSecret(\n    otherPublicKey: ArrayBufferView | string,\n    inputEncoding?: any,\n    outputEncoding?: any,\n  ): Buffer | string {","sourceCodeStart":1278,"sourceCodeEnd":1314,"githubUrl":"https://github.com/denoland/deno/blob/9ad36f7a2cce60488e6ec52283efb32efddaf93a/ext/node/polyfills/internal/crypto/diffiehellman.ts#L1278-L1314","documentation":"DiffieHellmanGroupImpl (diffiehellman.ts:1296) — used by crypto.getDiffieHellmanGroup and crypto.createDiffieHellmanGroup — only recognizes the MODP groups listed in DH_GROUP_NAMES: modp1, modp2, modp5, modp14, modp15, modp16, modp17, modp18. Any other name throws ERR_CRYPTO_UNKNOWN_DH_GROUP before any DH object is built.","triggerScenarios":"getDiffieHellmanGroup('modp2048') or 'modp1024' — bit-size aliases do not exist (2048-bit is modp14, 1024-bit is modp2); 'modp0', 'modp3' and other gaps in the list; case variants like 'MODP14'; SSH-style names like 'group14' or RFC-only ids.","commonSituations":"Copying group identifiers from SSH/IPsec/TLS docs that use bit sizes or different naming; assuming aliases exist because other libraries accept them; typo'd group names from config.","solutions":["Use one of: modp1, modp2, modp5, modp14, modp15, modp16, modp17, modp18","Map bit sizes to names: 1024 -> modp2, 2048 -> modp14, 3072 -> modp15, 4096 -> modp16","For non-MODP groups, build DH from raw prime bytes with createDiffieHellman(primeBuf, 2)"],"exampleFix":"// before\nconst dh = getDiffieHellmanGroup('modp2048'); // ERR_CRYPTO_UNKNOWN_DH_GROUP\n\n// after\nconst dh = getDiffieHellmanGroup('modp14'); // 2048-bit MODP group","handlingStrategy":"validation","validationCode":"const DH_GROUPS_OK = new Set(['modp1', 'modp2', 'modp5', 'modp14', 'modp15', 'modp16', 'modp17', 'modp18']);\nif (!DH_GROUPS_OK.has(name)) throw new RangeError(`unknown DH group ${name}; use one of ${[...DH_GROUPS_OK].join(', ')}`);","typeGuard":"const isKnownDhGroup = (n) => ['modp1', 'modp2', 'modp5', 'modp14', 'modp15', 'modp16', 'modp17', 'modp18'].includes(n);","tryCatchPattern":null,"preventionTips":["Store group names as validated constants, never free-form config strings","Translate bit sizes to group names (2048 -> modp14) in one mapping function"],"tags":["crypto","diffiehellman","ietf","validation"],"backgroundTag":"unknown-dh-group","analyzedSha":"9ad36f7a2cce60488e6ec52283efb32efddaf93a","analyzedAt":"2026-08-20T13:07:44.778Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}