denoland/deno · error · NodeError

ERR_OSSL_DH_BAD_GENERATOR

ERR_OSSL_DH_BAD_GENERATOR

Error message

bad generator

What it means

A numeric generator for DiffieHellman is range-checked at diffiehellman.ts:200: it must be an int32 strictly between 0 and 0x7fffffff. Values <= 0 or >= 2147483647 throw ERR_OSSL_DH_BAD_GENERATOR ('bad generator'); NaN/negative also trip validateInt32 first.

Source

Thrown at ext/node/polyfills/internal/crypto/diffiehellman.ts:200

          "modulus too small",
        );
      }

      this.#prime = Buffer.from(
        TypedArrayPrototypeGetBuffer(
          op_node_gen_prime(this.#primeLength, false, null, null),
        ),
      );
    }

    if (!generator) {
      generator = DH_GENERATOR;
    }

    if (typeof generator === "number") {
      validateInt32(generator, "generator");
      if (generator <= 0 || generator >= 0x7fffffff) {
        throw new NodeError("ERR_OSSL_DH_BAD_GENERATOR", "bad generator");
      }
      // Store with minimal byte representation, matching Node.js/OpenSSL behavior
      if (generator <= 0xff) {
        this.#generator = Buffer.alloc(1);
        this.#generator.writeUint8(generator);
      } else if (generator <= 0xffff) {
        this.#generator = Buffer.alloc(2);
        this.#generator.writeUint16BE(generator);
      } else {
        this.#generator = Buffer.alloc(4);
        this.#generator.writeUint32BE(generator);
      }
    } else if (typeof generator === "string") {
      generator = toBuf(generator, genEncoding as string);
      this.#generator = generator;
    } else if (
      !isArrayBufferView(generator) && !isAnyArrayBuffer(generator)
    ) {

View on GitHub (pinned to 9ad36f7a2c)

Solutions

1. Use generator 2 (or 5) — the implementation's generator check ultimately only accepts those two values anyway
2. Validate the number is an integer in (0, 0x7fffffff) before constructing
3. Fix config parsing that yields 0 or negative generators

Example fix

// before
new DiffieHellman(2048, 0); // bad generator

// after
new DiffieHellman(2048, 2);

function assertDhGenerator(g) {
  if (typeof g === 'number' && (!Number.isInteger(g) || g <= 0 || g >= 0x7fffffff)) {
    throw new RangeError('generator must be an integer in (0, 2^31 - 1)');
  }
}

When it happens

Trigger: new DiffieHellman(2048, 0); generator -1; generator 2147483647 (0x7fffffff itself is rejected); generator NaN from a failed parse.

Common situations: Generator config defaulting to 0; sign errors producing negatives; code that treats 0x7fffffff as a safe sentinel value.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• ERR_INVALID_ARG_TYPE
• ERR_OSSL_DH_MODULUS_TOO_SMALL
• ERR_CRYPTO_INVALID_KEYLEN
• ERR_CRYPTO_UNKNOWN_DH_GROUP
• Invalid key type

AI-assisted analysis of denoland/deno@9ad36f7a2c (2026-08-20). Data as JSON: /api/errors/b75abc3c05e747e4. Report an issue: GitHub.