{"record":{"id":"dbd15642ec5d7bb9","repo":"denoland/deno","slug":"err-crypto-invalid-keylen-dbd156","errorCode":"ERR_CRYPTO_INVALID_KEYLEN","errorMessage":"Invalid key length","messagePattern":"Invalid key length","errorType":"exception","errorClass":"ERR_CRYPTO_INVALID_KEYLEN","httpStatus":null,"severity":"error","filePath":"ext/node/polyfills/internal/crypto/hkdf.ts","lineNumber":97,"sourceCode":"\n    salt = toRawBytes(toBuf(salt));\n    info = toRawBytes(toBuf(info));\n\n    validateInteger(length, \"length\", 0, kMaxLength);\n\n    if (TypedArrayPrototypeGetByteLength(info) > 1024) {\n      throw new ERR_OUT_OF_RANGE(\n        \"info\",\n        \"must not contain more than 1024 bytes\",\n        TypedArrayPrototypeGetByteLength(info),\n      );\n    }\n\n    validateAlgorithm(hash);\n\n    const size = op_node_get_hash_size(hash);\n    if (typeof size === \"number\" && size * 255 < length) {\n      throw new ERR_CRYPTO_INVALID_KEYLEN();\n    }\n\n    return {\n      hash,\n      key,\n      salt,\n      info,\n      length,\n    };\n  },\n);\n\nfunction prepareKey(key: any) {\n  if (isKeyObject(key)) {\n    return key;\n  }\n\n  if (isAnyArrayBuffer(key)) {","sourceCodeStart":79,"sourceCodeEnd":115,"githubUrl":"https://github.com/denoland/deno/blob/9ad36f7a2cce60488e6ec52283efb32efddaf93a/ext/node/polyfills/internal/crypto/hkdf.ts#L79-L115","documentation":"HKDF (RFC 5869) can output at most 255 times the hash digest length, because HKDF-Expand runs at most 255 iterations of the HMAC loop. The polyfill enforces this in validateParameters (ext/node/polyfills/internal/crypto/hkdf.ts:95-98): if hashSize * 255 < length it throws ERR_CRYPTO_INVALID_KEYLEN ('Invalid key length') before any native op runs.","triggerScenarios":"crypto.hkdfSync('sha256', ikm, salt, info, 8161) (255*32 = 8160 for SHA-256); requesting 64 KiB or more of output material from hkdf; hkdf with sha1 (max 5100 bytes) or sha512 (max 16320 bytes) and a length above that bound.","commonSituations":"Deriving many subkeys or a whole file-encryption key bundle in one hkdf call; porting code from libraries that chunk HKDF output automatically; parameterizing output length from user input or config without an upper bound.","solutions":["Cap length at 255 * hashSize: 8160 for sha256, 5100 for sha1, 10200 for sha384, 16320 for sha512.","Derive a master key once, then derive independent subkeys with distinct short info labels.","If you need long random material, derive a 32-byte key and use it to seed a stream/XOF (e.g. ChaCha, shake256) instead.","Validate/clamp the length parameter at your API boundary before it reaches hkdf."],"exampleFix":"// before\ncrypto.hkdfSync('sha256', ikm, salt, info, 10000); // > 255*32 -> ERR_CRYPTO_INVALID_KEYLEN\n\n// after\nconst MAX = 255 * crypto.createHash('sha256').digest().length; // 8160\ncrypto.hkdfSync('sha256', ikm, salt, info, Math.min(10000, MAX));\n// or split into labeled subkeys:\nconst enc = crypto.hkdfSync('sha256', ikm, salt, Buffer.from('enc'), 32);\nconst mac = crypto.hkdfSync('sha256', ikm, salt, Buffer.from('mac'), 32);","handlingStrategy":"validation","validationCode":"const HKDF_MAX = { sha1: 5100, sha256: 8160, sha384: 10200, sha512: 16320 };\nfunction assertHkdfLength(digest, length) {\n  const max = 255 * crypto.createHash(digest).digest().length;\n  if (!(Number.isInteger(length) && length >= 0 && length <= max)) {\n    throw new RangeError(`hkdf length for ${digest} must be 0..${max}, got ${length}`);\n  }\n}\nassertHkdfLength('sha256', wanted);\ncrypto.hkdfSync('sha256', ikm, salt, info, wanted);","typeGuard":null,"tryCatchPattern":"try {\n  okm = crypto.hkdfSync(digest, ikm, salt, info, length);\n} catch (e) {\n  if (e.code === 'ERR_CRYPTO_INVALID_KEYLEN') {\n    throw new Error(`HKDF output capped at ${255 * hashBytes} bytes; derive subkeys with distinct info labels instead`);\n  }\n  throw e;\n}","preventionTips":["Derive fixed-size subkeys (e.g. 32 bytes each) with distinct info labels rather than one huge output.","Clamp any user- or config-supplied length against 255 * hashSize before calling hkdf.","Remember the caps: sha256 8160, sha512 16320, sha1 5100 bytes."],"tags":["crypto","hkdf","key-derivation","key-length","node-compat"],"backgroundTag":"hkdf-invalid-key-length","analyzedSha":"9ad36f7a2cce60488e6ec52283efb32efddaf93a","analyzedAt":"2026-08-20T13:07:44.778Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}