dotnet/wpf · error · ArgumentException

Unsupported hash algorithm specified.

Error message

Unsupported hash algorithm specified.

What it means

PackageDigitalSignatureManager.HashAlgorithm setter rejects a hash algorithm string it cannot use. After null-checking, the setter throws ArgumentException (SR.UnsupportedHashAlgorithm) when the assigned string is empty; WPF maps only a fixed set of XML-DSig algorithm URIs to underlying implementations, so anything outside that set is unsupported.

Solutions

1. Assign a full XML-DSig algorithm URI such as SignedXml.XmlDsigSHA256Url instead of a friendly name
2. Verify the string is non-empty before assignment
3. Use the System.Security.Cryptography.Xml.SignedXml algorithm URL constants to guarantee exact spelling
4. Wrap the assignment in a try/catch when the algorithm string comes from external configuration

Example fix

// before
manager.HashAlgorithm = "SHA256"; // or manager.HashAlgorithm = algoNameFromConfig; // may be empty
// after
if (!string.IsNullOrEmpty(algoNameFromConfig))
    manager.HashAlgorithm = algoNameFromConfig; // must be a valid XmlDsig URI
else
    manager.HashAlgorithm = SignedXml.XmlDsigSHA256Url;

if (string.IsNullOrEmpty(algoString) || !algoString.StartsWith("http://www.w3.org/"))
    throw new ArgumentException("HashAlgorithm must be a non-empty XML-DSig algorithm URI.");

bool IsValidHashAlgorithm(string s) => !string.IsNullOrEmpty(s) && s.StartsWith("http://");

try { manager.HashAlgorithm = value; }
catch (ArgumentException ex) { log.Error("Unsupported hash algorithm", ex); manager.HashAlgorithm = SignedXml.XmlDsigSHA256Url; }

When it happens

Trigger: Assigning an empty string ("") to PackageDigitalSignatureManager.HashAlgorithm, or assigning a string that is not one of the recognized XML digital signature algorithm URIs (e.g. XmlDsigSHA256Url etc.).

Common situations: Copy-pasting algorithm names like 'SHA256' or 'sha-256' instead of the full XML-DSig URI (http://www.w3.org/2001/04/xmlenc#sha256); building the string dynamically and producing ""; targeting FIPS/NIST variants whose URI strings differ.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• Can only countersign parts with Digital Signature…
• Duplicates not allowed - signature part already exists.
• Must specify an item to sign.
• Parameter cannot be a zero-length string.
• SR.TransformStackValid

AI-assisted analysis of dotnet/wpf@81131a70a4 (2026-09-14). Data as JSON: /api/errors/9d2ad6340ad1b051. Report an issue: GitHub.

Appendix: source

Thrown at src/Microsoft.DotNet.Wpf/src/WindowsBase/System/IO/Packaging/PackageDigitalSignatureManager.cs:204

        }

        /// <summary>
        /// Hashalgorithm to use when creating/verifying signatures
        /// </summary>
        /// <value></value>
        /// <remarks>defaults to SHA1</remarks>
        public String HashAlgorithm
        {
            get
            {
                return _hashAlgorithmString;
            }
            set
            {
                ArgumentNullException.ThrowIfNull(value);

                if (value.Length == 0)
                    throw new ArgumentException(SR.UnsupportedHashAlgorithm, nameof(value));

                _hashAlgorithmString = value;
            }
        }

        /// <summary>
        /// How to embed certificates when Signing
        /// </summary>
        /// <value></value>
        public CertificateEmbeddingOption CertificateOption
        {
            get
            {
                return _certificateEmbeddingOption;
            }
            set
            {
                if ((value < CertificateEmbeddingOption.InCertificatePart) || (value > CertificateEmbeddingOption.NotEmbedded))

View on GitHub (pinned to 81131a70a4)