golang/go · error

unsupported KDF %04x

Error message

unsupported KDF %04x

What it means

`hpke.NewKDF(id uint16)` resolves a Key Derivation Function from the HPKE IANA registry. Five IDs are supported: 0x0001 (HKDF-SHA256), 0x0002 (HKDF-SHA384), 0x0003 (HKDF-SHA512), 0x0010 (SHAKE128), 0x0011 (SHAKE256). Any other ID returns this error. The ID typically arrives from the HPKE mode/suite selection off the wire.

Source

Thrown at src/crypto/hpke/kdf.go:46

// NewKDF returns the KDF implementation for the given KDF ID.
//
// Applications are encouraged to use specific implementations like [HKDFSHA256]
// instead, unless runtime agility is required.
func NewKDF(id uint16) (KDF, error) {
	switch id {
	case 0x0001: // HKDF-SHA256
		return HKDFSHA256(), nil
	case 0x0002: // HKDF-SHA384
		return HKDFSHA384(), nil
	case 0x0003: // HKDF-SHA512
		return HKDFSHA512(), nil
	case 0x0010: // SHAKE128
		return SHAKE128(), nil
	case 0x0011: // SHAKE256
		return SHAKE256(), nil
	default:
		return nil, fmt.Errorf("unsupported KDF %04x", id)
	}
}

// HKDFSHA256 returns an HKDF-SHA256 KDF implementation.
func HKDFSHA256() KDF { return hkdfSHA256 }

// HKDFSHA384 returns an HKDF-SHA384 KDF implementation.
func HKDFSHA384() KDF { return hkdfSHA384 }

// HKDFSHA512 returns an HKDF-SHA512 KDF implementation.
func HKDFSHA512() KDF { return hkdfSHA512 }

type hkdfKDF struct {
	hash func() hash.Hash
	id   uint16
	nH   int
}

View on GitHub (pinned to b6b368adc5)

Solutions

1. Verify the incoming KDF ID is one of {0x0001,0x0002,0x0003,0x0010,0x0011} before calling NewKDF.
2. Update x/crypto to a version supporting the KDF you need.
3. Pin both peers to a known-good suite (e.g. HKDF-SHA256).

Example fix

// before
k, err := hpke.NewKDF(rawKDFID) // rawKDFID from corrupt/untrusted header
// after
switch rawKDFID {
case 0x0001, 0x0002, 0x0003, 0x0010, 0x0011:
    k, err = hpke.NewKDF(rawKDFID)
default:
    return fmt.Errorf("unsupported KDF %04x", rawKDFID)
}

supportedKDF := map[uint16]bool{0x0001:true,0x0002:true,0x0003:true,0x0010:true,0x0011:true}
if !supportedKDF[id] {
    return fmt.Errorf("KDF %04x not supported", id)
}

func isSupportedKDF(id uint16) bool {
    switch id {
    case 0x0001, 0x0002, 0x0003, 0x0010, 0x0011:
        return true
    }
    return false
}

When it happens

Trigger: Peer advertises a KDF ID outside the supported set; corrupt suite bytes; interop with a profile that uses a KDF not yet in this x/crypto version; misuse where a raw SHA-256 algorithm ID is passed instead of the HPKE KDF ID.

Common situations: Newer HPKE draft adding a KDF not in the local build; mis-mapping between a TLS/hash registry ID and the HPKE KDF registry ID; fuzz test cycling every uint16.

Related errors

• unsupported AEAD %04x
• invalid key size
• pbkdf2: keyLength must be larger than 0
• pbkdf2: keyLength too long
• globalThis.crypto is not available, polyfill required (crypt

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/026508576ef06c39. Report an issue: GitHub.