{"record":{"id":"dc04580f4e71f855","repo":"awslabs/llrt","slug":"unsupported-digest-algorithm-for-graviola","errorCode":null,"errorMessage":"Unsupported digest algorithm for Graviola","messagePattern":"Unsupported digest algorithm for Graviola","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"modules/llrt_crypto/src/provider/graviola.rs","lineNumber":77,"sourceCode":"    fn finalize(self) -> Vec<u8> {\n        match self {\n            GraviolaHmac::Sha256(h) => h.finish().as_ref().to_vec(),\n            GraviolaHmac::Sha384(h) => h.finish().as_ref().to_vec(),\n            GraviolaHmac::Sha512(h) => h.finish().as_ref().to_vec(),\n        }\n    }\n}\n\nimpl CryptoProvider for GraviolaProvider {\n    type Digest = GraviolaDigest;\n    type Hmac = GraviolaHmac;\n\n    fn digest(&self, algorithm: HashAlgorithm) -> Self::Digest {\n        match algorithm {\n            HashAlgorithm::Sha256 => GraviolaDigest::Sha256(Sha256::new()),\n            HashAlgorithm::Sha384 => GraviolaDigest::Sha384(Sha384::new()),\n            HashAlgorithm::Sha512 => GraviolaDigest::Sha512(Sha512::new()),\n            _ => panic!(\"Unsupported digest algorithm for Graviola\"),\n        }\n    }\n\n    fn hmac(&self, algorithm: HashAlgorithm, key: &[u8]) -> Self::Hmac {\n        match algorithm {\n            HashAlgorithm::Sha256 => GraviolaHmac::Sha256(Hmac::<Sha256>::new(key)),\n            HashAlgorithm::Sha384 => GraviolaHmac::Sha384(Hmac::<Sha384>::new(key)),\n            HashAlgorithm::Sha512 => GraviolaHmac::Sha512(Hmac::<Sha512>::new(key)),\n            _ => panic!(\"Unsupported HMAC algorithm for Graviola\"),\n        }\n    }\n\n    fn ecdsa_sign(\n        &self,\n        _curve: EllipticCurve,\n        _private_key_der: &[u8],\n        _digest: &[u8],\n    ) -> Result<Vec<u8>, CryptoError> {","sourceCodeStart":59,"sourceCodeEnd":95,"githubUrl":"https://github.com/awslabs/llrt/blob/742fc00b82cbeaab1c1b76f0d706c302a5cbc306/modules/llrt_crypto/src/provider/graviola.rs#L59-L95","documentation":"This panic occurs in the Graviola crypto provider's `digest` implementation when asked to create a hasher for an algorithm it does not implement. Graviola only supports SHA-256, SHA-384, and SHA-512; any other HashAlgorithm (e.g. MD5, SHA-1) falls into the catch-all `_` arm and panics. It is a provider-capability guard, not a runtime data error.","triggerScenarios":"Requesting a digest with HashAlgorithm::Md5 or Sha1 (or any variant not Sha256/Sha384/Sha512) while the Graviola provider backend is active.","commonSituations":"Using legacy algorithms like md5 or sha1 in the crypto module while the build selects the Graviola provider, or code paths that pick an algorithm from user input without checking provider support.","solutions":["Switch to a supported algorithm: SHA-256, SHA-384, or SHA-512.","Select a different crypto provider (Ring or RustCrypto) that supports the needed algorithm.","Add a capability check before calling digest so unsupported algorithms are rejected gracefully.","Enable/disable the relevant provider feature flags in Cargo so the active provider matches required algorithms."],"exampleFix":"// before\nlet d = Digest::new(HashAlgorithm::Md5); // panics with Graviola\n// after\nlet d = Digest::new(HashAlgorithm::Sha256);","handlingStrategy":"validation","validationCode":"const GRAVIOLA_DIGEST = new Set(['sha256', 'sha384', 'sha512']);\nif (!GRAVIOLA_DIGEST.has(algorithm)) throw new Error('Graviola provider does not support digest algorithm: ' + algorithm);","typeGuard":"function graviolaSupportsDigest(alg) {\n  return ['Sha256', 'Sha384', 'Sha512'].includes(alg);\n}","tryCatchPattern":"match result {\n    Err(CryptoError::PanicUnsupportedAlgorithm(a)) => fallback_to_rust_provider(a),\n    Ok(d) => d,\n}","preventionTips":["Keep an algorithm-capability table per provider and validate at startup.","Prefer SHA-256+ everywhere; forbid MD5/SHA-1 in new code.","Pick the provider via feature flags matching your algorithm requirements."],"tags":["crypto","panic","unsupported-algorithm"],"backgroundTag":"unsupported-enum-value","analyzedSha":"742fc00b82cbeaab1c1b76f0d706c302a5cbc306","analyzedAt":"2026-09-12T11:14:07.838Z","contentChangedAt":"2026-09-12T11:14:07.838Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}