golang/go · error

ecdsa: requested hash function unavailable:

Error message

ecdsa: requested hash function unavailable: 

What it means

Thrown by signFIPSDeterministic when hashFunc.Available() returns false. This means the requested crypto.Hash algorithm is not compiled into the binary — typically because the hash package has not been imported (and thus linked) yet. In Go, hash implementations are registered via init() in their packages, so an unimported hash package is not available.

Source

Thrown at src/crypto/ecdsa/ecdsa.go:464

		return signFIPSDeterministic(ecdsa.P224(), h, priv, hash)
	case elliptic.P256().Params():
		return signFIPSDeterministic(ecdsa.P256(), h, priv, hash)
	case elliptic.P384().Params():
		return signFIPSDeterministic(ecdsa.P384(), h, priv, hash)
	case elliptic.P521().Params():
		return signFIPSDeterministic(ecdsa.P521(), h, priv, hash)
	default:
		return nil, errors.New("ecdsa: curve not supported by deterministic signatures")
	}
}

func signFIPSDeterministic[P ecdsa.Point[P]](c *ecdsa.Curve[P], hashFunc crypto.Hash, priv *PrivateKey, hash []byte) ([]byte, error) {
	k, err := privateKeyToFIPS(c, priv)
	if err != nil {
		return nil, err
	}
	if !hashFunc.Available() {
		return nil, errors.New("ecdsa: requested hash function unavailable: " + hashFunc.String())
	}
	h := fips140hash.UnwrapNew(hashFunc.New)
	if fips140only.Enforced() && !fips140only.ApprovedHash(h()) {
		return nil, errors.New("crypto/ecdsa: use of hash functions other than SHA-2 or SHA-3 is not allowed in FIPS 140-only mode")
	}
	sig, err := ecdsa.SignDeterministic(c, h, k, hash)
	if err != nil {
		return nil, err
	}
	return encodeSignature(sig.R, sig.S)
}

func encodeSignature(r, s []byte) ([]byte, error) {
	var b cryptobyte.Builder
	b.AddASN1(asn1.SEQUENCE, func(b *cryptobyte.Builder) {
		addASN1IntBytes(b, r)
		addASN1IntBytes(b, s)
	})

View on GitHub (pinned to b6b368adc5)

Solutions

1. Import the hash package to ensure it's linked: add 'import _ "crypto/sha3"' if using SHA-3 hashes.
2. Switch to a hash that is already available (SHA-256 and SHA-512 from crypto/sha256/crypto/sha512 are commonly linked).
3. Check hashFunc.Available() before calling Sign and provide a clear error message to the user.

Example fix

// before
import "crypto"
// SHA-3 not imported anywhere
sig, err := priv.Sign(nil, digest, crypto.SHA3_256)

// after
import (
    "crypto"
    _ "crypto/sha3" // ensure SHA-3 is linked
)
sig, err := priv.Sign(nil, digest, crypto.SHA3_256)

func validateHashAvailable(h crypto.Hash) error {
    if !h.Available() {
        return fmt.Errorf("hash %s is not linked — import its package", h)
    }
    return nil
}

func isHashAvailable(h crypto.Hash) bool {
    return h.Available()
}

sig, err := priv.Sign(nil, digest, h)
if err != nil && strings.Contains(err.Error(), "unavailable") {
    return fmt.Errorf("hash %s not linked; add 'import _ "%s"' to your code: %w",
        h, hashPackageFor(h), err)
}

When it happens

Trigger: Calling deterministic Sign with opts.HashFunc() set to a crypto.Hash constant whose implementation package hasn't been imported anywhere in the binary. For example, using crypto.SHA3_256 without importing crypto/sha3 anywhere, or using a hash like crypto.MD5 whose package was excluded via build tags.

Common situations: Using SHA-3 hashes without importing crypto/sha3; using BLAKE2 hashes without importing the blake2 package; tree-shaking or build configurations that exclude hash packages; cross-compilation that misses hash implementations.

Related errors

• crypto/ecdsa: use of hash functions other than SHA-2 or SHA-
• ecdsa: Sign must be called with a hash, not with crypto.Hash
• ecdsa: hash length does not match hash function
• ecdsa: hash cannot be empty
• ecdsa: Sign called with nil random and nil opts

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/b5e58f1db24797cd. Report an issue: GitHub.