dgraph-io/dgraph · error

error finding sha length for algo %v

Error message

error finding sha length for algo %v

What it means

checkAclKeyLength validates HMAC (HS*) keys by extracting the SHA size from the algorithm name (e.g. HS256 -> 256) via strconv.Atoi. If the suffix is not a valid integer, the conversion fails and this wrapped error is returned.

Source

Thrown at x/acl_enc_keys.go:137

		pk, err := jwt.ParseEdPrivateKeyFromPEM(key)
		if err != nil {
			return nil, nil, errors.Wrapf(err, "error parsing ACL key as EdDSA private key")
		}
		return pk.(crypto.Signer), pk.(ed25519.PrivateKey).Public(), nil

	default:
		return nil, nil, errors.Errorf("unsupported signing algorithm: %v", alg.Alg())
	}
}

func checkAclKeyLength(alg jwt.SigningMethod, key Sensitive) error {
	if !strings.HasPrefix(alg.Alg(), "HS") {
		return nil
	}

	sl, err := strconv.Atoi(strings.TrimPrefix(alg.Alg(), "HS"))
	if err != nil {
		return errors.Wrapf(err, "error finding sha length for algo %v", alg.Alg())
	}

	// SHA length has to be smaller or equal to the key length
	if sl > len(key)*8 {
		return errors.Errorf("ACL key length [%v <= %v] bits for JWT algorithm [%v]", len(key)*8, sl, alg.Alg())
	}
	return nil
}

func RegisterAclAndEncFlags(flag *pflag.FlagSet) {
	registerAclFlag(flag)
	registerEncFlag(flag)
	registerVaultFlag(flag, true, true)
}

func RegisterEncFlag(flag *pflag.FlagSet) {
	registerEncFlag(flag)
	registerVaultFlag(flag, false, true)

View on GitHub (pinned to 759e242be6)

Solutions

1. Use a standard HMAC algorithm: HS256, HS384, or HS512
2. Remove custom jwt.SigningMethod registrations that use an HS prefix with a non-numeric suffix
3. Verify the jwt-alg flag value has no typos or trailing characters

Example fix

// before
jwt-alg=HSXYZ
// after
jwt-alg=HS256

if strings.HasPrefix(algStr, "HS") {
    n, err := strconv.Atoi(strings.TrimPrefix(algStr, "HS"))
    if err != nil || (n != 256 && n != 384 && n != 512) {
        return fmt.Errorf("alg %q invalid; use HS256/HS384/HS512", algStr)
    }
}

if _, err := x.GetEncAclKeys(flag, encKey); err != nil {
    if strings.Contains(err.Error(), "error finding sha length") {
        log.Fatalf("HS algorithm suffix must be numeric: HS256/384/512")
    }
    return err
}

When it happens

Trigger: checkAclKeyLength receiving a signing method whose Alg() starts with 'HS' but whose remainder does not parse as a number — e.g. a custom or corrupted signing method name like 'HSABC' or 'HS'.

Common situations: Very rare with stock golang-jwt methods; seen when a custom HS-prefixed signing method is registered or when algorithm strings are tampered with.

Related errors

• Unsupported JWT signing algorithm for ACL: %v
• ACL key length [%v <= %v] bits for JWT algorithm [%v]
• Authorize guardian of the galaxy, extracting jwt token, erro
• required field missing in Dgraph.Authorization:%s
• claims in jwt token is not map claims

AI-assisted analysis of dgraph-io/dgraph@759e242be6 (2026-09-01). Data as JSON: /api/errors/36711169a34e8713. Report an issue: GitHub.