hyperledger/fabric · error

hash family not recognized [%s]

Error message

hash family not recognized [%s]

What it means

getHashOpt maps a hash-family string (SHA2 or SHA3, as set in the MSP config's crypto configuration) to a BCCSP hash option. If the hash family is anything else it returns nil and this error. It is thrown when a signingidentity or verifier was built with a hash family BCCSP's msp layer does not support.

Source

Thrown at msp/identities.go:233

	// We serialize identities by prepending the MSPID and appending the ASN.1 DER content of the cert
	sId := &msp.SerializedIdentity{Mspid: id.id.Mspid, IdBytes: pemBytes}
	idBytes, err := proto.Marshal(sId)
	if err != nil {
		return nil, errors.Wrapf(err, "could not marshal a SerializedIdentity structure for identity %s", id.id)
	}

	return idBytes, nil
}

func (id *identity) getHashOpt(hashFamily string) (bccsp.HashOpts, error) {
	switch hashFamily {
	case bccsp.SHA2:
		return bccsp.GetHashOpt(bccsp.SHA256)
	case bccsp.SHA3:
		return bccsp.GetHashOpt(bccsp.SHA3_256)
	}
	return nil, errors.Errorf("hash family not recognized [%s]", hashFamily)
}

type signingidentity struct {
	// we embed everything from a base identity
	identity

	// signer corresponds to the object that can produce signatures from this identity
	signer crypto.Signer
}

func newSigningIdentity(cert *x509.Certificate, pk bccsp.Key, signer crypto.Signer, msp *bccspmsp) (SigningIdentity, error) {
	// mspIdentityLogger.Infof("Creating signing identity instance for ID %s", id)
	mspId, err := newIdentity(cert, pk, msp)
	if err != nil {
		return nil, err
	}
	return &signingidentity{
		identity: identity{

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Set the MSP config crypto spec SignatureHashFamily to exactly "SHA2" (or "SHA3") in config.yaml
2. Regenerate the MSP directory with cryptogen or the Fabric CA instead of hand-editing crypto config
3. If you need a different hash, change it at the BCCSP provider level, not the MSP hash family field

Example fix

// before (config.yaml)
crypto:
  hash: SHA512
// after
crypto:
  hash: SHA2

func validHashFamily(h string) bool { return h == "SHA2" || h == "SHA3" }
if !validHashFamily(cfg.CryptoConfig.SignatureHashFamily) {
    return fmt.Errorf("unsupported hash family %q; use SHA2 or SHA3", cfg.CryptoConfig.SignatureHashFamily)
}

id, err := signingIdentity.Sign(msg)
if err != nil && strings.Contains(err.Error(), "hash family not recognized") {
    // reconfigure MSP with SHA2/SHA3 before retrying
}

When it happens

Trigger: Calling Verify or Sign on an identity whose MSP was configured with CryptoConfig/SignatureHashFamily set to something other than "SHA2" or "SHA3" (case-sensitive).

Common situations: Hand-edited or generated config.yaml with a typo like "sha256", "SHA", or "SHA512" in the signature hash family field; config produced by a tool writing unsupported values.

Related errors

• could not decode bccsp type
• Could not sign the ccpackage, err %s
• could not serialize the signing identity: %v
• failed marshaling FabricMSPConfig
• failed to create orderer org

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/330231dc73f455c1. Report an issue: GitHub.