awslabs/llrt · critical

HMAC-MD5 not supported by Ring provider

Error message

HMAC-MD5 not supported by Ring provider

What it means

This panic is raised by the Ring provider's `hmac` method when HMAC-MD5 is requested. Ring intentionally does not expose MD5 HMAC (it is cryptographically broken), so the match arm for HashAlgorithm::Md5 explicitly panics rather than falling back. SHA-1 is allowed via the HMAC_SHA1_FOR_LEGACY_USE_ONLY constant, but MD5 has no equivalent.

Solutions

1. Move to HMAC-SHA256 or another supported algorithm if the peer protocol allows.
2. Switch to the RustCrypto provider if HMAC-MD5 is absolutely required.
3. Compute HMAC-MD5 outside this runtime (pure JS implementation) as a workaround.
4. Reject md5 at configuration parsing time with a clear user-facing error.

Example fix

// before
createHmac('md5', key); // panics with Ring provider
// after
createHmac('sha256', key);

if (algorithm === 'md5') throw new Error('HMAC-MD5 is not supported by the Ring provider; use sha256 or a RustCrypto build');

function ringSupportsHmac(alg) {
  return alg !== 'md5';
}

try {
  mac = createHmac('md5', key);
} catch (e) {
  if (String(e).includes('HMAC-MD5 not supported')) mac = fallbackMd5Hmac(key);
  else throw e;
}

When it happens

Trigger: Calling Hmac::new(HashAlgorithm::Md5, key) (or the crypto module's createHmac('md5', key)) while the Ring provider is active.

Common situations: Porting Node.js scripts that use crypto.createHmac('md5', ...) — common for old payment/webhook signature schemes — onto this runtime with the Ring backend.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

• HMAC-MD5 not supported
• Unsupported HMAC algorithm for Graviola
• Unsupported digest algorithm for Graviola

AI-assisted analysis of awslabs/llrt@742fc00b82 (2026-09-12). Data as JSON: /api/errors/ef82da3efbc92c70. Report an issue: GitHub.

Appendix: source

Thrown at modules/llrt_crypto/src/provider/ring.rs:165

    type Digest = RingDigestType;
    type Hmac = RingHmacType;

    fn digest(&self, algorithm: HashAlgorithm) -> Self::Digest {
        match algorithm {
            HashAlgorithm::Md5 => RingDigestType::Md5(RingMd5(Md5Hasher::new())),
            HashAlgorithm::Sha1 => {
                RingDigestType::Sha1(RingDigest::new(&digest::SHA1_FOR_LEGACY_USE_ONLY))
            },
            HashAlgorithm::Sha256 => RingDigestType::Sha256(RingDigest::new(&digest::SHA256)),
            HashAlgorithm::Sha384 => RingDigestType::Sha384(RingDigest::new(&digest::SHA384)),
            HashAlgorithm::Sha512 => RingDigestType::Sha512(RingDigest::new(&digest::SHA512)),
        }
    }

    fn hmac(&self, algorithm: HashAlgorithm, key: &[u8]) -> Self::Hmac {
        match algorithm {
            HashAlgorithm::Md5 => {
                panic!("HMAC-MD5 not supported by Ring provider");
            },
            HashAlgorithm::Sha1 => RingHmacType::Sha1(RingHmacSha1(hmac::Context::with_key(
                &hmac::Key::new(hmac::HMAC_SHA1_FOR_LEGACY_USE_ONLY, key),
            ))),
            HashAlgorithm::Sha256 => RingHmacType::Sha256(RingHmacSha256(hmac::Context::with_key(
                &hmac::Key::new(hmac::HMAC_SHA256, key),
            ))),
            HashAlgorithm::Sha384 => RingHmacType::Sha384(RingHmacSha384(hmac::Context::with_key(
                &hmac::Key::new(hmac::HMAC_SHA384, key),
            ))),
            HashAlgorithm::Sha512 => RingHmacType::Sha512(RingHmacSha512(hmac::Context::with_key(
                &hmac::Key::new(hmac::HMAC_SHA512, key),
            ))),
        }
    }

    fn ecdsa_sign(
        &self,

View on GitHub (pinned to 742fc00b82)