denoland/deno · error · DOMException

KmacImportParams.length cannot be 0

Error message

KmacImportParams.length cannot be 0

What it means

Thrown by SecretKeyObject.toCryptoKey() when the algorithm object for 'KMAC128'/'KMAC256' carries length === 0. KmacImportParams.length is the output/key length in bits and zero is invalid. The check is skipped when the property is absent, so hitting it means a zero value was explicitly supplied, usually via computation.

Source

Thrown at ext/node/polyfills/internal/crypto/keys.ts:820

        );
      }
      const alg = algorithm as { length?: number };
      if (alg.length !== undefined && alg.length === 0) {
        throw new DOMException(
          "HmacImportParams.length cannot be 0",
          "DataError",
        );
      }
    } else if (algName === "KMAC128" || algName === "KMAC256") {
      if (usages.length === 0) {
        throw new DOMException(
          "Usages cannot be empty when importing a secret key.",
          "SyntaxError",
        );
      }
      const alg = algorithm as { length?: number };
      if (alg.length !== undefined && alg.length === 0) {
        throw new DOMException(
          "KmacImportParams.length cannot be 0",
          "DataError",
        );
      }
    } else {
      if (usages.length === 0) {
        throw new DOMException(
          "Usages cannot be empty when importing a secret key.",
          "SyntaxError",
        );
      }
    }

    return importCryptoKeySync(
      "raw",
      rawData,
      algorithm,
      extractable,

View on GitHub (pinned to 9ad36f7a2c)

Solutions

1. Omit length to use the algorithm default
2. Pass the intended length in bits (e.g., 256)
3. Guard: only set length when it is a positive number

Example fix

// before
const params = { name: 'KMAC256', length: outLen };

// after
const params = { name: 'KMAC256' };
if (outLen > 0) params.length = outLen;

const params: Record<string, unknown> = { name: 'KMAC256' };
if (Number.isFinite(length) && length! > 0) params.length = length;
const key = secretKeyObject.toCryptoKey(params, false, usages);

const isValidKmacLength = (n: unknown): n is number =>
  typeof n === 'number' && Number.isInteger(n) && n > 0;

try {
  key = secretKeyObject.toCryptoKey(params, false, usages);
} catch (e) {
  if (e instanceof DOMException && e.name === 'DataError' && /length cannot be 0/.test(e.message)) {
    const { length: _drop, ...rest } = params as any;
    key = secretKeyObject.toCryptoKey(rest, false, usages);
  } else throw e;
}

When it happens

Trigger: createSecretKey(secret).toCryptoKey({ name: 'KMAC128', length: 0 }, false, ['sign']).

Common situations: length sourced from a config field defaulting to 0; arithmetic that produces 0 for some inputs (empty input length, disabled option); unit confusion between bytes and bits.

Related errors

• HmacImportParams.length cannot be 0
• ERR_CRYPTO_INVALID_KEYLEN
• Zero-length key is not supported
• PBKDF2 keys are not extractable
• Unsupported key usage for a PBKDF2 key

AI-assisted analysis of denoland/deno@9ad36f7a2c (2026-08-20). Data as JSON: /api/errors/41b27a54e9d1c735. Report an issue: GitHub.