What causes "Unsupported HMAC algorithm for Graviola" in awslabs/llrt?

Use HMAC-SHA256/384/512 instead.

Unsupported HMAC algorithm for Graviola

Error message

Unsupported HMAC algorithm for Graviola

What it means

This panic comes from the Graviola provider's `hmac` implementation when given a HashAlgorithm it cannot instantiate. Only HMAC-SHA256, HMAC-SHA384, and HMAC-SHA512 are implemented; every other variant (MD5, SHA-1, etc.) hits the `_` arm and panics. It mirrors the digest limitation but for keyed MAC operations.

Solutions

Use HMAC-SHA256/384/512 instead.
Switch to the Ring or RustCrypto provider which supports more HMAC algorithms.
Validate the configured HMAC algorithm against provider support at startup.
Change provider feature flags in Cargo.toml to match the algorithms you need.

Example fix

// before
let h = Hmac::new(HashAlgorithm::Sha1, key); // panics with Graviola
// after
let h = Hmac::new(HashAlgorithm::Sha256, key);

Defensive patterns

Strategy: validation

Validate before calling

const GRAVIOLA_HMAC = new Set(['sha256', 'sha384', 'sha512']);
if (!GRAVIOLA_HMAC.has(algorithm)) throw new Error('Graviola provider does not support HMAC algorithm: ' + algorithm);

Type guard

function graviolaSupportsHmac(alg) {
  return ['Sha256', 'Sha384', 'Sha512'].includes(alg);
}

Try / catch

match hmac_result {
    Err(CryptoError::UnsupportedHmac(a)) => switch_to_rustcrypto_provider(a),
    Ok(h) => h,
}

Prevention

Standardize on HMAC-SHA256 for new integrations.
Document provider limitations where algorithms are configurable.
Add a startup self-test that exercises configured algorithms before serving traffic.

When it happens

Trigger: Creating an HMAC with HashAlgorithm::Md5 or Sha1 while the Graviola provider is the active backend.

Common situations: Interoperating with legacy systems that require HMAC-MD5/HMAC-SHA1 while the deployment uses the Graviola provider, or algorithm selected from configuration without validating against provider capabilities.

Related errors

AI-assisted analysis of awslabs/llrt@742fc00b82 (2026-09-12). Data as JSON: /api/errors/6150f60412715581. Report an issue: GitHub.

Appendix: source

Thrown at modules/llrt_crypto/src/provider/graviola.rs:86

impl CryptoProvider for GraviolaProvider {
    type Digest = GraviolaDigest;
    type Hmac = GraviolaHmac;

    fn digest(&self, algorithm: HashAlgorithm) -> Self::Digest {
        match algorithm {
            HashAlgorithm::Sha256 => GraviolaDigest::Sha256(Sha256::new()),
            HashAlgorithm::Sha384 => GraviolaDigest::Sha384(Sha384::new()),
            HashAlgorithm::Sha512 => GraviolaDigest::Sha512(Sha512::new()),
            _ => panic!("Unsupported digest algorithm for Graviola"),
        }
    }

    fn hmac(&self, algorithm: HashAlgorithm, key: &[u8]) -> Self::Hmac {
        match algorithm {
            HashAlgorithm::Sha256 => GraviolaHmac::Sha256(Hmac::<Sha256>::new(key)),
            HashAlgorithm::Sha384 => GraviolaHmac::Sha384(Hmac::<Sha384>::new(key)),
            HashAlgorithm::Sha512 => GraviolaHmac::Sha512(Hmac::<Sha512>::new(key)),
            _ => panic!("Unsupported HMAC algorithm for Graviola"),
        }
    }

    fn ecdsa_sign(
        &self,
        _curve: EllipticCurve,
        _private_key_der: &[u8],
        _digest: &[u8],
    ) -> Result<Vec<u8>, CryptoError> {
        Err(CryptoError::UnsupportedAlgorithm)
    }

    fn ecdsa_verify(
        &self,
        _curve: EllipticCurve,
        _public_key_sec1: &[u8],
        _signature: &[u8],
        _digest: &[u8],

View on GitHub (pinned to 742fc00b82)