denoland/deno · error · TypeError

ERR_CRYPTO_INVALID_DIGEST

ERR_CRYPTO_INVALID_DIGEST

Error message

Invalid digest: ${algorithm}

What it means

getHashBlockSize() backs the Hmac constructor (crypto.createHmac(digest, key)): it looks the digest up in a fixed block-size table (sha*, sha3*, blake2*, md5, ...) used to pad/HMAC keys. A digest missing from the table throws ERR_CRYPTO_INVALID_DIGEST. Note this is a coded error, unlike the plain "Invalid digest" Error from the Sign/Verify constructors.

Source

Thrown at ext/node/polyfills/internal/crypto/util.ts:346

  dss1: 64,
  sha224: 64,
  sha256: 64,
  sha384: 128,
  sha512: 128,
  "sha512-224": 128,
  "sha512-256": 128,
  "sha3-224": 144,
  "sha3-256": 136,
  "sha3-384": 104,
  "sha3-512": 72,
  blake2b512: 128,
  blake2s256: 64,
};

function getHashBlockSize(algorithm: string): number {
  const blockSize = hashBlockSizes[algorithm];
  if (blockSize === undefined) {
    throw new ERR_CRYPTO_INVALID_DIGEST(algorithm);
  }
  return blockSize;
}

function getCipherInfo(
  nameOrNid: string | number,
  options?: { keyLength?: number; ivLength?: number },
) {
  if (typeof nameOrNid !== "string" && typeof nameOrNid !== "number") {
    throw new ERR_INVALID_ARG_TYPE(
      "nameOrNid",
      ["string", "number"],
      nameOrNid,
    );
  }

  if (typeof nameOrNid === "number") {
    validateInt32(nameOrNid, "nameOrNid");

View on GitHub (pinned to 9ad36f7a2c)

Solutions

1. Use canonical names: "md5", "sha1", "sha256", "sha384", "sha512", "sha3-*", "blake2b512", "blake2s256".
2. Validate first: crypto.getHashes().includes(digest.toLowerCase()).
3. Normalize config values by stripping hyphens and lowercasing before use.

Example fix

// before
const h = crypto.createHmac("SHA-256", secret); // lowercases to "sha-256" -> ERR_CRYPTO_INVALID_DIGEST

// after
const h = crypto.createHmac("sha256", secret);

const digest = configuredHmacAlg.toLowerCase().replace(/-/g, "");
if (!crypto.getHashes().includes(digest)) {
  throw new Error(`HMAC digest "${configuredHmacAlg}" unsupported; see crypto.getHashes()`);
}
const h = crypto.createHmac(digest, secret);

const isHmacDigest = (name) =>
  typeof name === "string" && crypto.getHashes().includes(name.toLowerCase().replace(/-/g, ""));

try {
  hmac = crypto.createHmac(digest, secret);
} catch (e) {
  if (e?.code === "ERR_CRYPTO_INVALID_DIGEST") {
    throw new Error(`digest "${digest}" has no block size (unsupported for HMAC)`);
  }
  throw e;
}

When it happens

Trigger: crypto.createHmac("sha-256", key) (hyphenated name); createHmac("md4", key); createHmac("sm3"/"ripemd160", key) — any name whose lowercase form has no block-size entry. The digest is lowercased first, so "SHA256" works but "SHA-256" does not.

Common situations: Algorithm strings copied from JOSE/JWS headers ("SHA-256") or OpenSSL docs; typo'd digest names; switching from createHash() (which supports a wider alias set) to createHmac().

Related errors

• Usages cannot be empty when importing a secret key.
• HmacImportParams.length cannot be 0
• Invalid digest: ${algorithm}
• Algorithm must be specified when using non-Ed25519 keys
• no default digest

AI-assisted analysis of denoland/deno@9ad36f7a2c (2026-08-20). Data as JSON: /api/errors/ec64812f7d44743a. Report an issue: GitHub.