{"record":{"id":"d44d5e5b0612f8c0","repo":"denoland/deno","slug":"err-crypto-unknown-cipher","errorCode":"ERR_CRYPTO_UNKNOWN_CIPHER","errorMessage":"Unknown cipher","messagePattern":"Unknown cipher","errorType":"error_code","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"ext/node/polyfills/internal/crypto/cipher.ts","lineNumber":235,"sourceCode":"    this._aesWrapKey = toU8(key);\n    this._aesWrapIv = toU8(iv);\n    this._context = 1; // non-zero sentinel; not used for wrap ops\n  } else {\n    try {\n      this._context = op_node_create_cipheriv(\n        cipher,\n        toU8(key),\n        toU8(iv),\n        authTagLength,\n      );\n    } catch (e) {\n      // The op reports an unrecognized algorithm as a TypeError that includes\n      // the cipher name; surface Node's ERR_CRYPTO_UNKNOWN_CIPHER instead.\n      if (\n        ObjectPrototypeIsPrototypeOf(TypeErrorPrototype, e) &&\n        StringPrototypeStartsWith(e.message, \"Unknown cipher\")\n      ) {\n        throw new ERR_CRYPTO_UNKNOWN_CIPHER();\n      }\n      throw e;\n    }\n    if (this._context == 0) {\n      throw new ERR_CRYPTO_UNKNOWN_CIPHER();\n    }\n  }\n\n  this._needsBlockCache = !this._isAesWrap &&\n    !(cipher == \"aes-128-gcm\" || cipher == \"aes-256-gcm\" ||\n      cipher == \"aes-128-ctr\" || cipher == \"aes-192-ctr\" ||\n      cipher == \"aes-256-ctr\" || cipher == \"chacha20\" ||\n      cipher == \"chacha20-poly1305\");\n  this._authTag = undefined;\n  this._autoPadding = true;\n  this._finalized = false;\n  this._decoder = undefined;\n}","sourceCodeStart":217,"sourceCodeEnd":253,"githubUrl":"https://github.com/denoland/deno/blob/9ad36f7a2cce60488e6ec52283efb32efddaf93a/ext/node/polyfills/internal/crypto/cipher.ts#L217-L253","documentation":"createCipheriv() throws ERR_CRYPTO_UNKNOWN_CIPHER when the algorithm string is not recognized by Deno's Rust crypto backend. The native constructor (ext/node_crypto/cipher.rs) returns the error `Unknown cipher <name>`, which the constructor's catch block detects (TypeError whose message starts with 'Unknown cipher') and converts to Node's ERR_CRYPTO_UNKNOWN_CIPHER so code checking the code property behaves as on Node.","triggerScenarios":"createCipheriv('aes128-gcm') (OpenSSL legacy name without dashes); typos or whitespace like 'aes-128-gcm '; algorithms Node/OpenSSL supports but this backend does not (e.g. 'camellia-128-cbc', 'aes-128-ocb', 'id-aes128-gcm').","commonSituations":"Algorithm names sourced from env vars or YAML config with a typo; strings copied from OpenSSL command-line docs; running Node-targeted encryption code under Deno where the supported set (aes-{128,192,256}-{cbc,ctr,gcm}, chacha20, chacha20-poly1305, des-ede3-cbc, aes-*-wrap) is smaller.","solutions":["Use a supported dashed name: aes-128/192/256-cbc|ctr|gcm, chacha20, chacha20-poly1305, des-ede3-cbc, or the aes-*-wrap variants.","Fail fast at startup by test-creating the cipher (or listing crypto.getCiphers()) instead of failing at first encrypt.","Keep the algorithm in a single typed constant instead of assembling it from string parts."],"exampleFix":"// before\nconst cipher = crypto.createCipheriv('aes128-gcm', key, iv); // ERR_CRYPTO_UNKNOWN_CIPHER\n\n// after\nconst ALGO = 'aes-128-gcm';\nconst cipher = crypto.createCipheriv(ALGO, key, iv);","handlingStrategy":"validation","validationCode":"const SUPPORTED_CIPHERS = new Set([\n  'aes-128-cbc','aes-192-cbc','aes-256-cbc',\n  'aes-128-ctr','aes-192-ctr','aes-256-ctr',\n  'aes-128-gcm','aes-192-gcm','aes-256-gcm',\n  'chacha20','chacha20-poly1305','des-ede3-cbc',\n]);\nfunction assertCipherSupported(algo: string): void {\n  if (!SUPPORTED_CIPHERS.has(algo))\n    throw new Error(`Unsupported cipher algorithm: '${algo}'`);\n}","typeGuard":null,"tryCatchPattern":"try { cipher = crypto.createCipheriv(algo, key, iv); } catch (e) { if (e.code === 'ERR_CRYPTO_UNKNOWN_CIPHER') { cipher = crypto.createCipheriv('aes-256-gcm', key, iv); /* or fail config */ } else throw e; }","preventionTips":["Store algorithm names in typed constants, never assemble them from string fragments.","Validate config-loaded algorithm names at process startup, not at first encrypt.","When porting Node/OpenSSL code, cross-check each algorithm against the supported list."],"tags":["crypto","cipher","algorithm-name","node-compat"],"backgroundTag":"unknown-cipher-algorithm","analyzedSha":"9ad36f7a2cce60488e6ec52283efb32efddaf93a","analyzedAt":"2026-08-20T13:07:44.778Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}