ory/hydra · error

jwksx: key size must be a multiple of 8 for algorithm "%s" b

Error message

jwksx: key size must be a multiple of 8 for algorithm "%s" but got: %d

What it means

Returned by jwksx generate for HS256/HS384/HS512 when the requested key size in bits is not divisible by 8, so it cannot be converted to a whole number of bytes for the HMAC secret. The configured bitsize for the symmetric signing key is at fault.

Source

Thrown at oryx/jwksx/generator.go:118

		key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
		return key, errors.Wrapf(err, "jwks: unable to generate key")
	case jose.ES384:
		// NB: The cryptographic operations do not use constant-time algorithms.
		key, err := ecdsa.GenerateKey(elliptic.P384(), rand.Reader)
		return key, errors.Wrapf(err, "jwks: unable to generate key")
	case jose.ES512:
		// NB: The cryptographic operations do not use constant-time algorithms.
		key, err := ecdsa.GenerateKey(elliptic.P521(), rand.Reader)
		return key, errors.Wrapf(err, "jwks: unable to generate key")
	case jose.EdDSA:
		_, key, err := ed25519.GenerateKey(rand.Reader)
		return key, errors.Wrapf(err, "jwks: unable to generate key")
	case jose.RS256, jose.RS384, jose.RS512, jose.PS256, jose.PS384, jose.PS512:
		key, err := rsa.GenerateKey(rand.Reader, bits)
		return key, errors.Wrapf(err, "jwks: unable to generate key")
	case jose.HS256, jose.HS384, jose.HS512:
		if bits%8 != 0 {
			return nil, errors.Errorf(`jwksx: key size must be a multiple of 8 for algorithm "%s" but got: %d`, alg, bits)
		}

		key := make([]byte, bits/8)
		if _, err := io.ReadFull(rand.Reader, key); err != nil {
			return nil, errors.Wrapf(err, "jwks: unable to generate key")
		}
		return key, nil
	default:
		return nil, errors.Errorf(`jwksx: available algorithms are "%+v" but unknown algorithm was requested: "%s"`, GenerateSigningKeysAvailableAlgorithms(), alg)
	}
}

View on GitHub (pinned to 4174065ffb)

Solutions

1. Set the HS256/384/512 key length to a multiple of 8 bits (a whole number of bytes)
2. Use a standard size such as 256 or 512 bits for the HMAC key
3. Validate key sizes in configuration before key generation

When it happens

Trigger: Thrown at oryx/jwksx/generator.go:118 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ory/hydra@4174065ffb (2026-09-03). Data as JSON: /api/errors/02e282a64440270e. Report an issue: GitHub.