Invalid key for this operation, its RSA-PSS parameter saltLe

Error message

Invalid key for this operation, its RSA-PSS parameter saltLength does not meet the requirements of "alg" ${algorithm}.

What it means

Beyond hash parameters, RSA-PSS keys carry a saltLength. The PS* algorithm's salt length is bits(algorithm)/8 (e.g. PS256 -> 32 bytes); if the key's saltLength is defined and larger than that, jsonwebtoken rejects the key because the resulting signature would not conform to the algorithm's expected salt length.

Source

Thrown at lib/validateAsymmetricKey.js:60

      const keyCurve = key.asymmetricKeyDetails.namedCurve;
      const allowedCurve = allowedCurves[algorithm];

      if (keyCurve !== allowedCurve) {
        throw new Error(`"alg" parameter "${algorithm}" requires curve "${allowedCurve}".`);
      }
      break;

    case 'rsa-pss':
      if (RSA_PSS_KEY_DETAILS_SUPPORTED) {
        const length = parseInt(algorithm.slice(-3), 10);
        const { hashAlgorithm, mgf1HashAlgorithm, saltLength } = key.asymmetricKeyDetails;

        if (hashAlgorithm !== `sha${length}` || mgf1HashAlgorithm !== hashAlgorithm) {
          throw new Error(`Invalid key for this operation, its RSA-PSS parameters do not meet the requirements of "alg" ${algorithm}.`);
        }

        if (saltLength !== undefined && saltLength > length >> 3) {
          throw new Error(`Invalid key for this operation, its RSA-PSS parameter saltLength does not meet the requirements of "alg" ${algorithm}.`)
        }
      }
      break;
    }
  }
}

View on GitHub (pinned to b924272f29)

Solutions

Regenerate the PSS key with salt length <= the algorithm's byte length (e.g. rsa_pss_keygen_saltlen:32 for PS256)
Or select the PS* algorithm whose salt length (alg bits / 8) accommodates the key's saltLength
Set options to a matching salt length or fall back to RS256 with a standard RSA key

Example fix

// before
openssl genpkey -algorithm RSA-PSS -pkeyopt rsa_pss_keygen_saltlen:62 -out key.pem  # used with PS256
// after
openssl genpkey -algorithm RSA-PSS -pkeyopt rsa_pss_keygen_saltlen:32 -out key.pem

Defensive patterns

Strategy: validation

Validate before calling

function pssSaltLengthOk(alg, key) {
  if (!/^PS/.test(alg)) return true;
  const bytes = parseInt(alg.slice(2), 10) >> 3;
  const s = key.asymmetricKeyDetails?.saltLength;
  return s === undefined || s <= bytes;
}
if (!pssSaltLengthOk(alg, key)) throw new Error('PSS saltLength ' + key.asymmetricKeyDetails.saltLength + ' exceeds ' + alg + ' requirement');

Type guard

function hasAcceptablePssSaltLength(alg, key) {
  const maxBytes = parseInt(alg.replace(/^PS/, ''), 10) >> 3;
  const s = key.asymmetricKeyDetails?.saltLength;
  return s === undefined || s <= maxBytes;
}

Try / catch

try {
  return jwt.sign(payload, pssKey, { algorithm: alg });
} catch (err) {
  if (/saltLength does not meet/.test(err.message)) {
    // degrade to RS256 with the PKCS#1 variant of the key or regenerate
    throw new Error('Regenerate PSS key with saltLength <= ' + (parseInt(alg.slice(2), 10) >> 3));
  }
  throw err;
}

Prevention

Set rsa_pss_keygen_saltlen explicitly to the algorithm's byte length when generating keys
Verify saltLength on imported HSM/KMS keys before use
Avoid mixing salt lengths across signing and verifying environments
Document the PS* variant per key in your key inventory

When it happens

Trigger: Signing/verifying with PS256/PS384/PS512 using an RSA-PSS KeyObject whose asymmetricKeyDetails.saltLength exceeds length>>3 (e.g. a key with saltLength 64 used with PS256), on Node versions exposing RSA-PSS key details.

Common situations: Keys generated by OpenSSL or HSM tooling with a custom/optimal salt length (often equal to hash length or larger) then used with a different PS* variant; HSM/KMS-exported PSS keys with enforced salt lengths.

Related errors

AI-assisted analysis of auth0/node-jsonwebtoken@b924272f29 (2026-09-02). Data as JSON: /api/errors/522073b24bc25073. Report an issue: GitHub.