{"record":{"id":"fd006b624866a839","repo":"awslabs/llrt","slug":"hmac-md5-not-supported","errorCode":null,"errorMessage":"HMAC-MD5 not supported","messagePattern":"HMAC-MD5 not supported","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"modules/llrt_crypto/src/provider/rust/mod.rs","lineNumber":161,"sourceCode":"pub struct RustCryptoProvider;\n\nimpl CryptoProvider for RustCryptoProvider {\n    type Digest = RustDigest;\n    type Hmac = RustHmac;\n\n    fn digest(&self, algorithm: HashAlgorithm) -> Self::Digest {\n        match algorithm {\n            HashAlgorithm::Md5 => RustDigest::Md5(md5::Md5::new()),\n            HashAlgorithm::Sha1 => RustDigest::Sha1(Sha1::new()),\n            HashAlgorithm::Sha256 => RustDigest::Sha256(Sha256::new()),\n            HashAlgorithm::Sha384 => RustDigest::Sha384(Sha384::new()),\n            HashAlgorithm::Sha512 => RustDigest::Sha512(Sha512::new()),\n        }\n    }\n\n    fn hmac(&self, algorithm: HashAlgorithm, key: &[u8]) -> Self::Hmac {\n        match algorithm {\n            HashAlgorithm::Md5 => panic!(\"HMAC-MD5 not supported\"),\n            HashAlgorithm::Sha1 => RustHmac::Sha1(HmacImpl::<Sha1>::new_from_slice(key).unwrap()),\n            HashAlgorithm::Sha256 => {\n                RustHmac::Sha256(HmacImpl::<Sha256>::new_from_slice(key).unwrap())\n            },\n            HashAlgorithm::Sha384 => {\n                RustHmac::Sha384(HmacImpl::<Sha384>::new_from_slice(key).unwrap())\n            },\n            HashAlgorithm::Sha512 => {\n                RustHmac::Sha512(HmacImpl::<Sha512>::new_from_slice(key).unwrap())\n            },\n        }\n    }\n\n    fn ecdsa_sign(\n        &self,\n        curve: EllipticCurve,\n        private_key_der: &[u8],\n        digest: &[u8],","sourceCodeStart":143,"sourceCodeEnd":179,"githubUrl":"https://github.com/awslabs/llrt/blob/742fc00b82cbeaab1c1b76f0d706c302a5cbc306/modules/llrt_crypto/src/provider/rust/mod.rs#L143-L179","documentation":"This panic in the RustCrypto provider's `hmac` method fires when HashAlgorithm::Md5 is requested. The Rust provider supports HMAC over SHA-1, SHA-256, SHA-384, and SHA-512 but deliberately omits MD5, panicking with 'HMAC-MD5 not supported'. Unlike the Ring provider's message, this one is generic about the reason.","triggerScenarios":"Requesting an HMAC with HashAlgorithm::Md5 while the RustCrypto (rust) provider is the active backend.","commonSituations":"Legacy MD5-based signature schemes (old APIs, S3-style auth quirks) being ported to this runtime; the md5 algorithm string accepted elsewhere in the crypto module but rejected for HMAC.","solutions":["Use HMAC-SHA256 (or SHA-1 for legacy) instead of HMAC-MD5.","Add an MD5-capable HMAC implementation (e.g. enable the Md5 crate) or a pure-JS fallback.","Validate the algorithm before constructing the HMAC and return a proper error instead of panicking.","Check which provider your build uses and its supported algorithm matrix."],"exampleFix":"// before\ncreateHmac('md5', key); // panics\n// after\ncreateHmac('sha1', key); // supported (legacy) — or preferably 'sha256'","handlingStrategy":"validation","validationCode":"if (algorithm === 'md5') throw new Error('HMAC-MD5 not supported by the Rust provider; use sha1/sha256/sha384/sha512');","typeGuard":"function rustProviderSupportsHmac(alg) {\n  return ['sha1', 'sha256', 'sha384', 'sha512'].includes(alg);\n}","tryCatchPattern":"match rust_hmac(alg, key) {\n    Err(HmacError::UnsupportedMd5) => use_pure_js_md5_hmac(key),\n    Ok(h) => h,\n}","preventionTips":["Enumerate supported algorithms ('sha1','sha256','sha384','sha512') and validate input against the list.","Treat MD5 as forbidden unless a legacy protocol requires it; route those to a fallback implementation.","Test each configured algorithm in CI."],"tags":["crypto","panic","hmac","md5"],"backgroundTag":"unsupported-enum-value","analyzedSha":"742fc00b82cbeaab1c1b76f0d706c302a5cbc306","analyzedAt":"2026-09-12T11:14:07.838Z","contentChangedAt":"2026-09-12T11:14:07.838Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}