denoland/deno · error · TypeError

ERR_MISSING_OPTION

ERR_MISSING_OPTION

Error message

At least one of the group, prime, or primeLength options is required

What it means

generateKeyPair('dh', options) requires exactly one source of DH parameters: options.group (predefined MODP group), options.prime (custom prime buffer), or options.primeLength (size for a generated prime). If none is present, the polyfill throws ERR_MISSING_OPTION: 'At least one of the group, prime, or primeLength options is required'.

Source

Thrown at ext/node/polyfills/internal/crypto/keygen.ts:602

        }

        if (mode === kSync) {
          return op_node_generate_dh_group_key(group);
        } else {
          return op_node_generate_dh_group_key_async(group);
        }
      }

      if (prime != null) {
        if (primeLength != null) {
          throw new ERR_INCOMPATIBLE_OPTION_PAIR("prime", "primeLength");
        }

        validateBuffer(prime, "options.prime");
      } else if (primeLength != null) {
        validateInt32(primeLength, "options.primeLength", 0);
      } else {
        throw new ERR_MISSING_OPTION(
          "At least one of the group, prime, or primeLength options",
        );
      }

      if (generator != null) {
        validateInt32(generator, "options.generator", 0);
      }

      const g = generator == null ? 2 : generator;

      if (mode === kSync) {
        return op_node_generate_dh_key(prime, primeLength ?? 0, g);
      } else {
        return op_node_generate_dh_key_async(
          prime,
          primeLength ?? 0,
          g,
        );

View on GitHub (pinned to 9ad36f7a2c)

Solutions

Add one of group, prime, or primeLength to the options object
Log or assert the options object right before the call during development
If options are built dynamically, default to group: 'modp14' or primeLength: 2048 when nothing else is set

Example fix

// before
crypto.generateKeyPair('dh', { generator: 2 });
// after
crypto.generateKeyPair('dh', { group: 'modp14' });

Defensive patterns

Strategy: validation

Validate before calling

if (dhOptions.group == null && dhOptions.prime == null && dhOptions.primeLength == null) {
  dhOptions.primeLength = 2048; // or throw, per policy
}
crypto.generateKeyPairSync('dh', dhOptions);

Type guard

function hasDhParameterSource(o) {
  return o.group != null || o.prime != null || o.primeLength != null;
}

Try / catch

try {
  crypto.generateKeyPairSync('dh', opts);
} catch (e) {
  if (e.code === 'ERR_MISSING_OPTION' && e.message.includes('primeLength')) {
    opts.group = 'modp14';
    return crypto.generateKeyPairSync('dh', opts);
  }
  throw e;
}

Prevention

Type DH options so at least one parameter source is required (discriminated union)
Unit-test option assembly code with empty inputs
Log the final options object at debug level before crypto calls

When it happens

Trigger: crypto.generateKeyPair('dh', {}) — or an options object containing only auxiliary keys like generator/modulusLength-style extras, with all three parameter sources missing.

Common situations: Options assembled conditionally where every branch skips the parameters; typo'd key names ('primeLen', 'groupname'); passing the options object in the wrong argument position (e.g. into the callback slot); believing generator alone is enough.

Related errors

AI-assisted analysis of denoland/deno@9ad36f7a2c (2026-08-20). Data as JSON: /api/errors/17179c3b4968d004. Report an issue: GitHub.