denoland/deno · error · ERR_CRYPTO_UNKNOWN_DH_GROUP

ERR_CRYPTO_UNKNOWN_DH_GROUP

ERR_CRYPTO_UNKNOWN_DH_GROUP

Error message

Unknown DH group

What it means

DiffieHellmanGroupImpl (diffiehellman.ts:1296) — used by crypto.getDiffieHellmanGroup and crypto.createDiffieHellmanGroup — only recognizes the MODP groups listed in DH_GROUP_NAMES: modp1, modp2, modp5, modp14, modp15, modp16, modp17, modp18. Any other name throws ERR_CRYPTO_UNKNOWN_DH_GROUP before any DH object is built.

Source

Thrown at ext/node/polyfills/internal/crypto/diffiehellman.ts:1296

      0xFFFFFFFF,
    ],
    generator: 2,
  },
};

DiffieHellman.prototype = DiffieHellmanImpl.prototype;

function DiffieHellmanGroup(name: string) {
  return new DiffieHellmanGroupImpl(name);
}

class DiffieHellmanGroupImpl {
  verifyError!: number;
  #diffiehellman: DiffieHellmanImpl;

  constructor(name: string) {
    if (!ArrayPrototypeIncludes(DH_GROUP_NAMES, name)) {
      throw new ERR_CRYPTO_UNKNOWN_DH_GROUP();
    }
    const words = DH_GROUPS[name].prime;
    const buf = Buffer.alloc(words.length * 4);
    for (let i = 0; i < words.length; i++) {
      buf.writeUInt32BE(words[i], i * 4);
    }
    this.#diffiehellman = new DiffieHellmanImpl(
      buf,
      DH_GROUPS[name].generator,
    );
    this.verifyError = 0;
  }

  computeSecret(
    otherPublicKey: ArrayBufferView | string,
    inputEncoding?: any,
    outputEncoding?: any,
  ): Buffer | string {

View on GitHub (pinned to 9ad36f7a2c)

Solutions

1. Use one of: modp1, modp2, modp5, modp14, modp15, modp16, modp17, modp18
2. Map bit sizes to names: 1024 -> modp2, 2048 -> modp14, 3072 -> modp15, 4096 -> modp16
3. For non-MODP groups, build DH from raw prime bytes with createDiffieHellman(primeBuf, 2)

Example fix

// before
const dh = getDiffieHellmanGroup('modp2048'); // ERR_CRYPTO_UNKNOWN_DH_GROUP

// after
const dh = getDiffieHellmanGroup('modp14'); // 2048-bit MODP group

const DH_GROUPS_OK = new Set(['modp1', 'modp2', 'modp5', 'modp14', 'modp15', 'modp16', 'modp17', 'modp18']);
if (!DH_GROUPS_OK.has(name)) throw new RangeError(`unknown DH group ${name}; use one of ${[...DH_GROUPS_OK].join(', ')}`);

const isKnownDhGroup = (n) => ['modp1', 'modp2', 'modp5', 'modp14', 'modp15', 'modp16', 'modp17', 'modp18'].includes(n);

When it happens

Trigger: getDiffieHellmanGroup('modp2048') or 'modp1024' — bit-size aliases do not exist (2048-bit is modp14, 1024-bit is modp2); 'modp0', 'modp3' and other gaps in the list; case variants like 'MODP14'; SSH-style names like 'group14' or RFC-only ids.

Common situations: Copying group identifiers from SSH/IPsec/TLS docs that use bit sizes or different naming; assuming aliases exist because other libraries accept them; typo'd group names from config.

Related errors

• ERR_INVALID_ARG_TYPE
• ERR_OSSL_DH_MODULUS_TOO_SMALL
• ERR_OSSL_DH_BAD_GENERATOR
• ERR_CRYPTO_INVALID_KEYLEN
• Invalid key type

AI-assisted analysis of denoland/deno@9ad36f7a2c (2026-08-20). Data as JSON: /api/errors/bf3b21413ccd61d0. Report an issue: GitHub.