{"record":{"id":"ef82da3efbc92c70","repo":"awslabs/llrt","slug":"hmac-md5-not-supported-by-ring-provider","errorCode":null,"errorMessage":"HMAC-MD5 not supported by Ring provider","messagePattern":"HMAC-MD5 not supported by Ring provider","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"modules/llrt_crypto/src/provider/ring.rs","lineNumber":165,"sourceCode":"    type Digest = RingDigestType;\n    type Hmac = RingHmacType;\n\n    fn digest(&self, algorithm: HashAlgorithm) -> Self::Digest {\n        match algorithm {\n            HashAlgorithm::Md5 => RingDigestType::Md5(RingMd5(Md5Hasher::new())),\n            HashAlgorithm::Sha1 => {\n                RingDigestType::Sha1(RingDigest::new(&digest::SHA1_FOR_LEGACY_USE_ONLY))\n            },\n            HashAlgorithm::Sha256 => RingDigestType::Sha256(RingDigest::new(&digest::SHA256)),\n            HashAlgorithm::Sha384 => RingDigestType::Sha384(RingDigest::new(&digest::SHA384)),\n            HashAlgorithm::Sha512 => RingDigestType::Sha512(RingDigest::new(&digest::SHA512)),\n        }\n    }\n\n    fn hmac(&self, algorithm: HashAlgorithm, key: &[u8]) -> Self::Hmac {\n        match algorithm {\n            HashAlgorithm::Md5 => {\n                panic!(\"HMAC-MD5 not supported by Ring provider\");\n            },\n            HashAlgorithm::Sha1 => RingHmacType::Sha1(RingHmacSha1(hmac::Context::with_key(\n                &hmac::Key::new(hmac::HMAC_SHA1_FOR_LEGACY_USE_ONLY, key),\n            ))),\n            HashAlgorithm::Sha256 => RingHmacType::Sha256(RingHmacSha256(hmac::Context::with_key(\n                &hmac::Key::new(hmac::HMAC_SHA256, key),\n            ))),\n            HashAlgorithm::Sha384 => RingHmacType::Sha384(RingHmacSha384(hmac::Context::with_key(\n                &hmac::Key::new(hmac::HMAC_SHA384, key),\n            ))),\n            HashAlgorithm::Sha512 => RingHmacType::Sha512(RingHmacSha512(hmac::Context::with_key(\n                &hmac::Key::new(hmac::HMAC_SHA512, key),\n            ))),\n        }\n    }\n\n    fn ecdsa_sign(\n        &self,","sourceCodeStart":147,"sourceCodeEnd":183,"githubUrl":"https://github.com/awslabs/llrt/blob/742fc00b82cbeaab1c1b76f0d706c302a5cbc306/modules/llrt_crypto/src/provider/ring.rs#L147-L183","documentation":"This panic is raised by the Ring provider's `hmac` method when HMAC-MD5 is requested. Ring intentionally does not expose MD5 HMAC (it is cryptographically broken), so the match arm for HashAlgorithm::Md5 explicitly panics rather than falling back. SHA-1 is allowed via the HMAC_SHA1_FOR_LEGACY_USE_ONLY constant, but MD5 has no equivalent.","triggerScenarios":"Calling Hmac::new(HashAlgorithm::Md5, key) (or the crypto module's createHmac('md5', key)) while the Ring provider is active.","commonSituations":"Porting Node.js scripts that use crypto.createHmac('md5', ...) — common for old payment/webhook signature schemes — onto this runtime with the Ring backend.","solutions":["Move to HMAC-SHA256 or another supported algorithm if the peer protocol allows.","Switch to the RustCrypto provider if HMAC-MD5 is absolutely required.","Compute HMAC-MD5 outside this runtime (pure JS implementation) as a workaround.","Reject md5 at configuration parsing time with a clear user-facing error."],"exampleFix":"// before\ncreateHmac('md5', key); // panics with Ring provider\n// after\ncreateHmac('sha256', key);","handlingStrategy":"validation","validationCode":"if (algorithm === 'md5') throw new Error('HMAC-MD5 is not supported by the Ring provider; use sha256 or a RustCrypto build');","typeGuard":"function ringSupportsHmac(alg) {\n  return alg !== 'md5';\n}","tryCatchPattern":"try {\n  mac = createHmac('md5', key);\n} catch (e) {\n  if (String(e).includes('HMAC-MD5 not supported')) mac = fallbackMd5Hmac(key);\n  else throw e;\n}","preventionTips":["Migrate legacy MD5 signature schemes to SHA-256.","Check provider support matrix before wiring configurable algorithms.","Reject 'md5' in configuration parsing with a clear error message."],"tags":["crypto","panic","hmac","md5"],"backgroundTag":"unsupported-operation","analyzedSha":"742fc00b82cbeaab1c1b76f0d706c302a5cbc306","analyzedAt":"2026-09-12T11:14:07.838Z","contentChangedAt":"2026-09-12T11:14:07.838Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}