{"record":{"id":"dce9f8df0bff1a15","repo":"ory/hydra","slug":"errunsupportedkeyalgorithm","errorCode":"ErrUnsupportedKeyAlgorithm","errorMessage":"%s","messagePattern":"%s","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"jwk/generate.go","lineNumber":24,"sourceCode":"import (\n\t\"crypto/x509\"\n\n\t\"github.com/go-jose/go-jose/v3\"\n\t\"github.com/gofrs/uuid\"\n\t\"github.com/pkg/errors\"\n\n\t\"github.com/ory/x/josex\"\n)\n\nfunc GenerateJWK(alg jose.SignatureAlgorithm, kid, use string) (*jose.JSONWebKeySet, error) {\n\tbits := 0\n\tif alg == jose.RS256 || alg == jose.RS384 || alg == jose.RS512 {\n\t\tbits = 4096\n\t}\n\n\t_, priv, err := josex.NewSigningKey(alg, bits)\n\tif err != nil {\n\t\treturn nil, errors.Wrapf(ErrUnsupportedKeyAlgorithm, \"%s\", err)\n\t}\n\n\tif len(kid) == 0 {\n\t\tkid = uuid.Must(uuid.NewV4()).String()\n\t}\n\n\tif len(use) == 0 {\n\t\tuse = \"sig\"\n\t}\n\n\treturn &jose.JSONWebKeySet{\n\t\tKeys: []jose.JSONWebKey{\n\t\t\t{\n\t\t\t\tAlgorithm:                   string(alg),\n\t\t\t\tKey:                         priv,\n\t\t\t\tUse:                         use,\n\t\t\t\tKeyID:                       kid,\n\t\t\t\tCertificates:                []*x509.Certificate{},","sourceCodeStart":6,"sourceCodeEnd":42,"githubUrl":"https://github.com/ory/hydra/blob/4174065ffb052799890f7480f5360a877a67ffc1/jwk/generate.go#L6-L42","documentation":"GenerateJWK builds a JSON Web Key for the requested signing algorithm. When josex.NewSigningKey cannot construct a private key for the given jose.SignatureAlgorithm (e.g. an algorithm that is not an RSA/ECDSA/EdDSA signing algorithm supported by the jose library), the error is wrapped as ErrUnsupportedKeyAlgorithm with the underlying message. It signals the caller passed an unsupported or non-signing algorithm, not a key-size problem.","triggerScenarios":"Calling jwk.GenerateJWK with an algorithm other than RS256/RS384/RS512/ES256/ES384/ES512/EdDSA-style signing algorithms that josex.NewSigningKey supports, such as HS256 (HMAC is not an asymmetric signing key) or an empty/invalid algorithm string.","commonSituations":"Configuring Hydra JWK generation with an algorithm read from config that defaults to or was misconfigured as HS256; passing a jose* constant that is an encryption algorithm (e.g. RSA-OAEP) instead of a signing algorithm; upgrading the library where a previously accepted algorithm was removed.","solutions":["Check the alg argument passed to GenerateJWK and use a supported signing algorithm (RS256/RS384/RS512, ES256/ES384/ES512, or EdDSA as supported by josex.NewSigningKey)","Fix the configuration value feeding the algorithm (e.g. hydra.strategies.jwt.jwks.algorithm or the key generation CLI flag) to a valid signing algorithm","Verify you are not passing a JWS 'alg' that maps to HMAC (HS*) — HMAC keys cannot be generated as JWK signing keys here","If upgrading, consult the jose library's supported algorithms for jwk.FromMap/NewSigningKey"],"exampleFix":"// before\nkey, err := jwk.GenerateJWK(context.Background(), jose.HS256, \"my-set\")\n// after\nkey, err := jwk.GenerateJWK(context.Background(), jose.RS256, \"my-set\")","handlingStrategy":"validation","validationCode":"func validAlg(alg jose.SignatureAlgorithm) bool {\n    switch alg {\n    case jose.RS256, jose.RS384, jose.RS512, jose.ES256, jose.ES384, jose.ES512, jose.EdDSA:\n        return true\n    }\n    return false\n}\nif !validAlg(alg) { return fmt.Errorf(\"algorithm %s unsupported for JWK generation\", alg) }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Only pass asymmetric signing algorithms (RS*/ES*/EdDSA) to GenerateJWK","Never pass HS* (HMAC) algorithms — they are not JWK signing keys here","Centralize the algorithm choice in one config constant validated at startup","Add a startup validation of the configured algorithm before serving traffic"],"tags":["jwk","crypto","unsupported-algorithm"],"backgroundTag":"unsupported-jwk-key-algorithm","analyzedSha":"4174065ffb052799890f7480f5360a877a67ffc1","analyzedAt":"2026-09-03T14:52:41.581Z","contentChangedAt":"2026-09-03T14:52:41.581Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}