denoland/deno · error · TypeError

Context parameter is unsupported

Error message

Context parameter is unsupported

What it means

For ed448 keys, one-shot crypto.sign() reads an optional context property from the key options object. RFC 8032 defines an 8.4.4 context string for Ed448, but Deno's Rust signing op implements Ed448 without context support, so a non-empty Uint8Array context throws this TypeError. An absent, non-Uint8Array, or empty context is ignored.

Source

Thrown at ext/node/polyfills/internal/crypto/sig.ts:425

    let result: Buffer;
    const keyType = op_node_get_asymmetric_key_type(handle);
    if (keyType === "ed25519") {
      if (algorithm != null && algorithm !== "sha512") {
        throw new TypeError("Only 'sha512' is supported for Ed25519 keys");
      }
      result = new FastBuffer(64);
      op_node_sign_ed25519(handle, dataBytes, result);
    } else if (keyType === "ed448") {
      const keyOpts = typeof key === "object" && key !== null &&
          !(ObjectPrototypeIsPrototypeOf(KeyObject.prototype, key))
        ? key as Record<string, unknown>
        : null;
      const ctx = keyOpts?.context;
      if (
        ObjectPrototypeIsPrototypeOf(Uint8ArrayPrototype, ctx) &&
        ctx.length > 0
      ) {
        throw new TypeError("Context parameter is unsupported");
      }
      result = new FastBuffer(114);
      op_node_sign_ed448(handle, dataBytes, result);
    } else {
      let digest = algorithm;
      if (digest == null) {
        if (keyType === "rsa-pss") {
          const details = op_node_get_asymmetric_key_details(handle);
          if (details.hashAlgorithm) {
            digest = details.hashAlgorithm;
          }
        }
        if (digest == null) {
          throw new TypeError(
            "Algorithm must be specified when using non-Ed25519 keys",
          );
        }
      }

View on GitHub (pinned to 9ad36f7a2c)

Solutions

1. Omit the context option or pass an empty Uint8Array.
2. If context binding is required, switch schemes — e.g. HMAC/domain-separate the message first, or use RSA-PSS — since Deno's op cannot produce context-bound Ed448 signatures.
3. Detect the condition early and reject the request rather than producing an incompatible signature.

Example fix

// before
crypto.sign(null, data, { key: ed448Pem, context: Buffer.from("ctx") }); // throws

// after
crypto.sign(null, data, { key: ed448Pem }); // no context

if (keyOpts?.context instanceof Uint8Array && keyOpts.context.length > 0) {
  throw new Error("Ed448 signing with a non-empty context is not supported in this runtime");
}
const sig = crypto.sign(null, data, { key: ed448Pem });

const hasNonEmptyContext = (opts) =>
  opts?.context instanceof Uint8Array && opts.context.length > 0;

try {
  sig = crypto.sign(null, data, keyOpts);
} catch (e) {
  if (e instanceof TypeError && /Context parameter is unsupported/.test(e.message)) {
    throw new Error("re-sign without Ed448 context or use a context-capable runtime");
  }
  throw e;
}

When it happens

Trigger: crypto.sign(null, data, { key: ed448Pem, context: Buffer.from("my-app") }) — any Uint8Array context with length > 0 on an ed448 key.

Common situations: Porting OpenSSL or other-runtime Ed448ctx/Ed448ph signing code to Deno; interop with protocols that bind signatures to an application context string; otherwise rare because ed448 adoption is low.

Related errors

• ERR_CRYPTO_CUSTOM_ENGINE_NOT_SUPPORTED
• ERR_CRYPTO_INVALID_KEY_OBJECT_TYPE
• ERR_INVALID_ARG_VALUE
• Invalid digest: ${algorithm}
• ERR_CRYPTO_SIGN_KEY_REQUIRED

AI-assisted analysis of denoland/deno@9ad36f7a2c (2026-08-20). Data as JSON: /api/errors/adf467c1d4cc763f. Report an issue: GitHub.