dotnet/wpf · error · InvalidOperationException

SR.UnsupportedHashAlgorithm

Error message

SR.UnsupportedHashAlgorithm

What it means

During PackageDigitalSignatureManager.Sign, the requested hash algorithm name is resolved via GetHashAlgorithm; if it returns null the algorithm is unsupported and an InvalidOperationException(SR.UnsupportedHashAlgorithm) is thrown. OPC signing only supports a fixed set of hash algorithms on the current platform.

Solutions

  1. Use a supported hash algorithm name (e.g. "SHA1"/"SHA256" per OPC support) when calling Sign.
  2. Check the algorithm in advance by instantiating HashAlgorithm.Create(name) and validating it is non-null before signing.
  3. If FIPS mode blocks the algorithm, enable the corresponding FIPS-certified provider or switch to a FIPS-approved algorithm (e.g. SHA256).
  4. Validate configuration-supplied algorithm names against a whitelist at startup.

Example fix

// before
dsm.HashAlgorithm = "SHA384"; // not resolvable on this machine
dsm.Sign(parts);
// after
dsm.HashAlgorithm = "SHA256"; // supported
dsm.Sign(parts);
Defensive patterns

Strategy: validation

Validate before calling

bool hashSupported = false;
using (var h = HashAlgorithm.Create(hashAlgorithmName)) { hashSupported = h != null; }

Try / catch

try { dsm.Sign(parts); }
catch (InvalidOperationException ex) when (ex.Message.Contains("HashAlgorithm")) { /* fall back to a supported algorithm */ }

Prevention

When it happens

Trigger: Calling PackageDigitalSignatureManager.Sign with a hashAlgorithmName string that GetHashAlgorithm cannot map to a HashAlgorithm instance on the running machine (e.g. "SHA256" on a platform/FIPS mode without the provider, or a typo/unsupported name like "SHA3").

Common situations: Signing on FIPS-compliant machines where certain algorithm implementations are disabled; targeting .NET runtimes or OS versions lacking the requested CSP; user-supplied algorithm names from configuration files.

Related errors

AI-assisted analysis of dotnet/wpf@81131a70a4 (2026-09-14). Data as JSON: /api/errors/c0e4683e6d520e0a. Report an issue: GitHub.

Appendix: source

Thrown at src/Microsoft.DotNet.Wpf/src/WindowsBase/MS/Internal/IO/Packaging/XmlDigitalSignatureProcessor.cs:773

                    _signedXml.SignedInfo.SignatureMethod = SelectSignatureMethod(key);
                }

                // Track if we are matching the signature method in order to retry on failure
                bool usingMatchingSignatureMethod = _signedXml.SignedInfo.SignatureMethod != null;

                // put it in the XML
                if (embedCertificate)
                {
                    _signedXml.KeyInfo = GenerateKeyInfo(key, signer);
                }

                // Package object tag
                // convert from string to class and ensure we dispose
                using (HashAlgorithm hashAlgorithm = GetHashAlgorithm(_hashAlgorithmName))
                {
                    // inform caller if hash algorithm is unknown
                    if (hashAlgorithm == null)
                        throw new InvalidOperationException(SR.UnsupportedHashAlgorithm);

                    _signedXml.AddObject(GenerateObjectTag(hashAlgorithm, parts, relationshipSelectors, signatureId));
                }

                // add reference from SignedInfo to Package object tag
                Reference objectReference = new Reference(XTable.Get(XTable.ID.OpcLinkAttrValue))
                {
                    Type = XTable.Get(XTable.ID.W3CSignatureNamespaceRoot) + "Object",
                    DigestMethod = _hashAlgorithmName
                };
                _signedXml.AddReference(objectReference);

                // add any custom object tags
                AddCustomObjectTags(signatureObjects, objectReferences);

                // compute the signature
                SignedXml xmlSig = _signedXml;

View on GitHub (pinned to 81131a70a4)