{"record":{"id":"c589b8ffe4c6f6dc","repo":"golang/go","slug":"unsupported-curve","errorCode":null,"errorMessage":"unsupported curve","messagePattern":"unsupported curve","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/hpke/kem.go","lineNumber":171,"sourceCode":"\tcase ecdh.P521():\n\t\treturn dhKEMP521\n\tcase ecdh.X25519():\n\t\treturn dhKEMX25519\n\tdefault:\n\t\t// The set of ecdh.Curve implementations is closed, because the\n\t\t// interface has unexported methods. Therefore, this default case is\n\t\t// only hit if a new curve is added that DHKEM doesn't support.\n\t\treturn unsupportedCurveKEM{}\n\t}\n}\n\ntype unsupportedCurveKEM struct{}\n\nfunc (unsupportedCurveKEM) ID() uint16 {\n\treturn 0\n}\nfunc (unsupportedCurveKEM) GenerateKey() (PrivateKey, error) {\n\treturn nil, errors.New(\"unsupported curve\")\n}\nfunc (unsupportedCurveKEM) NewPublicKey([]byte) (PublicKey, error) {\n\treturn nil, errors.New(\"unsupported curve\")\n}\nfunc (unsupportedCurveKEM) NewPrivateKey([]byte) (PrivateKey, error) {\n\treturn nil, errors.New(\"unsupported curve\")\n}\nfunc (unsupportedCurveKEM) DeriveKeyPair([]byte) (PrivateKey, error) {\n\treturn nil, errors.New(\"unsupported curve\")\n}\nfunc (unsupportedCurveKEM) encSize() int {\n\treturn 0\n}\n\ntype dhKEMPublicKey struct {\n\tkem *dhKEM\n\tpub *ecdh.PublicKey\n}","sourceCodeStart":153,"sourceCodeEnd":189,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/hpke/kem.go#L153-L189","documentation":"unsupportedCurveKEM is a sentinel returned by DHKEM() when the supplied ecdh.Curve is not P-256/P-384/P-521/X25519. Every method on this sentinel returns \"unsupported curve\". Because ecdh.Curve is a closed interface (unexported methods), this default branch is only reachable if a new curve type is added to the standard library or by an internal fork.","triggerScenarios":"DHKEM(unknownCurve).GenerateKey() where unknownCurve is any ecdh.Curve outside the four supported. In practice reachable only by a fork that introduces a new ecdh.Curve constant, or by a future stdlib addition this build predates.","commonSituations":"Vendoring an older copy of crypto/hpke into a toolchain whose crypto/ecdh gained a new curve; or a downstream fork adding experimental curves.","solutions":["Pass one of ecdh.P256(), ecdh.P384(), ecdh.P521(), or ecdh.X25519() to DHKEM.","Upgrade the vendored crypto/hpke to match the toolchain's crypto/ecdh.","Avoid constructing ecdh.Curve values from external input."],"exampleFix":"// before\nkem := hpke.DHKEM(someNewCurve)\nk, err := kem.GenerateKey() // \"unsupported curve\"\n\n// after\nkem := hpke.DHKEM(ecdh.X25519())\nk, err := kem.GenerateKey()","handlingStrategy":"validation","validationCode":"func supportedDHCurve(c ecdh.Curve) bool {\n    switch c {\n    case ecdh.P256(), ecdh.P384(), ecdh.P521(), ecdh.X25519():\n        return true\n    }\n    return false\n}\n\nfunc generateKey(c ecdh.Curve) (hpke.PrivateKey, error) {\n    if !supportedDHCurve(c) {\n        return nil, fmt.Errorf(\"curve %v not supported by DHKEM\", c)\n    }\n    return hpke.DHKEM(c).GenerateKey()\n}","typeGuard":null,"tryCatchPattern":"k, err := kem.GenerateKey()\nif err != nil && err.Error() == \"unsupported curve\" {\n    return fmt.Errorf(\"DHKEM returned sentinel; pass a supported ecdh.Curve\")\n}","preventionTips":["Never construct ecdh.Curve values from external/untrusted input.","Pin the supported curve set in one helper used by every caller.","Upgrade vendored crypto/hpke when adopting a newer Go toolchain."],"tags":["hpke","kem","ecdh","cryptography","go"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}