denoland/deno · error · DOMException

KmacImportParams.length cannot be 0

Error message

KmacImportParams.length cannot be 0

What it means

Thrown by SecretKeyObject.toCryptoKey() when the algorithm object for 'KMAC128'/'KMAC256' carries length === 0. KmacImportParams.length is the output/key length in bits and zero is invalid. The check is skipped when the property is absent, so hitting it means a zero value was explicitly supplied, usually via computation.

Solutions

1. Omit length to use the algorithm default
2. Pass the intended length in bits (e.g., 256)
3. Guard: only set length when it is a positive number

Example fix

// before
const params = { name: 'KMAC256', length: outLen };

// after
const params = { name: 'KMAC256' };
if (outLen > 0) params.length = outLen;

const params: Record<string, unknown> = { name: 'KMAC256' };
if (Number.isFinite(length) && length! > 0) params.length = length;
const key = secretKeyObject.toCryptoKey(params, false, usages);

const isValidKmacLength = (n: unknown): n is number =>
  typeof n === 'number' && Number.isInteger(n) && n > 0;

try {
  key = secretKeyObject.toCryptoKey(params, false, usages);
} catch (e) {
  if (e instanceof DOMException && e.name === 'DataError' && /length cannot be 0/.test(e.message)) {
    const { length: _drop, ...rest } = params as any;
    key = secretKeyObject.toCryptoKey(rest, false, usages);
  } else throw e;
}

When it happens

Trigger: createSecretKey(secret).toCryptoKey({ name: 'KMAC128', length: 0 }, false, ['sign']).

Common situations: length sourced from a config field defaulting to 0; arithmetic that produces 0 for some inputs (empty input length, disabled option); unit confusion between bytes and bits.

Related errors

• HmacImportParams.length cannot be 0
• ERR_CRYPTO_INVALID_KEYLEN
• HKDF keys are not extractable
• PBKDF2 keys are not extractable
• Unsupported key usage for a PBKDF2 key

AI-assisted analysis of denoland/deno@9ad36f7a2c (2026-08-20). Data as JSON: /api/errors/41b27a54e9d1c735. Report an issue: GitHub.

Appendix: source

Thrown at ext/node/polyfills/internal/crypto/keys.ts:820

        );
      }
      const alg = algorithm as { length?: number };
      if (alg.length !== undefined && alg.length === 0) {
        throw new DOMException(
          "HmacImportParams.length cannot be 0",
          "DataError",
        );
      }
    } else if (algName === "KMAC128" || algName === "KMAC256") {
      if (usages.length === 0) {
        throw new DOMException(
          "Usages cannot be empty when importing a secret key.",
          "SyntaxError",
        );
      }
      const alg = algorithm as { length?: number };
      if (alg.length !== undefined && alg.length === 0) {
        throw new DOMException(
          "KmacImportParams.length cannot be 0",
          "DataError",
        );
      }
    } else {
      if (usages.length === 0) {
        throw new DOMException(
          "Usages cannot be empty when importing a secret key.",
          "SyntaxError",
        );
      }
    }

    return importCryptoKeySync(
      "raw",
      rawData,
      algorithm,
      extractable,

View on GitHub (pinned to 9ad36f7a2c)