awslabs/llrt · critical

Unsupported digest algorithm for Graviola

Error message

Unsupported digest algorithm for Graviola

What it means

This panic occurs in the Graviola crypto provider's `digest` implementation when asked to create a hasher for an algorithm it does not implement. Graviola only supports SHA-256, SHA-384, and SHA-512; any other HashAlgorithm (e.g. MD5, SHA-1) falls into the catch-all `_` arm and panics. It is a provider-capability guard, not a runtime data error.

Solutions

1. Switch to a supported algorithm: SHA-256, SHA-384, or SHA-512.
2. Select a different crypto provider (Ring or RustCrypto) that supports the needed algorithm.
3. Add a capability check before calling digest so unsupported algorithms are rejected gracefully.
4. Enable/disable the relevant provider feature flags in Cargo so the active provider matches required algorithms.

Example fix

// before
let d = Digest::new(HashAlgorithm::Md5); // panics with Graviola
// after
let d = Digest::new(HashAlgorithm::Sha256);

const GRAVIOLA_DIGEST = new Set(['sha256', 'sha384', 'sha512']);
if (!GRAVIOLA_DIGEST.has(algorithm)) throw new Error('Graviola provider does not support digest algorithm: ' + algorithm);

function graviolaSupportsDigest(alg) {
  return ['Sha256', 'Sha384', 'Sha512'].includes(alg);
}

match result {
    Err(CryptoError::PanicUnsupportedAlgorithm(a)) => fallback_to_rust_provider(a),
    Ok(d) => d,
}

When it happens

Trigger: Requesting a digest with HashAlgorithm::Md5 or Sha1 (or any variant not Sha256/Sha384/Sha512) while the Graviola provider backend is active.

Common situations: Using legacy algorithms like md5 or sha1 in the crypto module while the build selects the Graviola provider, or code paths that pick an algorithm from user input without checking provider support.

Related errors

• Unsupported HMAC algorithm for Graviola
• HMAC-MD5 not supported by Ring provider
• HMAC-MD5 not supported

AI-assisted analysis of awslabs/llrt@742fc00b82 (2026-09-12). Data as JSON: /api/errors/dc04580f4e71f855. Report an issue: GitHub.

Appendix: source

Thrown at modules/llrt_crypto/src/provider/graviola.rs:77

    fn finalize(self) -> Vec<u8> {
        match self {
            GraviolaHmac::Sha256(h) => h.finish().as_ref().to_vec(),
            GraviolaHmac::Sha384(h) => h.finish().as_ref().to_vec(),
            GraviolaHmac::Sha512(h) => h.finish().as_ref().to_vec(),
        }
    }
}

impl CryptoProvider for GraviolaProvider {
    type Digest = GraviolaDigest;
    type Hmac = GraviolaHmac;

    fn digest(&self, algorithm: HashAlgorithm) -> Self::Digest {
        match algorithm {
            HashAlgorithm::Sha256 => GraviolaDigest::Sha256(Sha256::new()),
            HashAlgorithm::Sha384 => GraviolaDigest::Sha384(Sha384::new()),
            HashAlgorithm::Sha512 => GraviolaDigest::Sha512(Sha512::new()),
            _ => panic!("Unsupported digest algorithm for Graviola"),
        }
    }

    fn hmac(&self, algorithm: HashAlgorithm, key: &[u8]) -> Self::Hmac {
        match algorithm {
            HashAlgorithm::Sha256 => GraviolaHmac::Sha256(Hmac::<Sha256>::new(key)),
            HashAlgorithm::Sha384 => GraviolaHmac::Sha384(Hmac::<Sha384>::new(key)),
            HashAlgorithm::Sha512 => GraviolaHmac::Sha512(Hmac::<Sha512>::new(key)),
            _ => panic!("Unsupported HMAC algorithm for Graviola"),
        }
    }

    fn ecdsa_sign(
        &self,
        _curve: EllipticCurve,
        _private_key_der: &[u8],
        _digest: &[u8],
    ) -> Result<Vec<u8>, CryptoError> {

View on GitHub (pinned to 742fc00b82)