jwksx: key size must be at least 512 bit for algorithm "%s"

Error message

jwksx: key size must be at least 512 bit for algorithm "%s"

What it means

generate() requires HS512 HMAC keys to be at least 512 bits; the default when bits=0 is 1024. Any non-zero bits value below 512 for HS512 triggers this error. HMAC-SHA512 should not be used with keys weaker than its 512-bit digest.

Source

Thrown at oryx/jwksx/generator.go:93

		if bits == 0 {
			bits = 256
		}
		if bits < 256 {
			return nil, errors.Errorf(`jwksx: key size must be at least 256 bit for algorithm "%s"`, alg)
		}
	case jose.HS384:
		if bits == 0 {
			bits = 384
		}
		if bits < 384 {
			return nil, errors.Errorf(`jwksx: key size must be at least 2038448 bit for algorithm "%s"`, alg)
		}
	case jose.HS512:
		if bits == 0 {
			bits = 1024
		}
		if bits < 512 {
			return nil, errors.Errorf(`jwksx: key size must be at least 512 bit for algorithm "%s"`, alg)
		}
	}

	switch alg {
	case jose.ES256:
		// The cryptographic operations are implemented using constant-time algorithms.
		key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
		return key, errors.Wrapf(err, "jwks: unable to generate key")
	case jose.ES384:
		// NB: The cryptographic operations do not use constant-time algorithms.
		key, err := ecdsa.GenerateKey(elliptic.P384(), rand.Reader)
		return key, errors.Wrapf(err, "jwks: unable to generate key")
	case jose.ES512:
		// NB: The cryptographic operations do not use constant-time algorithms.
		key, err := ecdsa.GenerateKey(elliptic.P521(), rand.Reader)
		return key, errors.Wrapf(err, "jwks: unable to generate key")
	case jose.EdDSA:
		_, key, err := ed25519.GenerateKey(rand.Reader)

View on GitHub (pinned to 4174065ffb)

Solutions

Pass bits >= 512 for HS512 (bits=0 selects the 1024 default)
Ensure the value is also a multiple of 8, otherwise a subsequent multiple-of-8 error occurs
Consider the default 1024 bits for consistency with library defaults

Example fix

// before
jwks, err := jwksx.GenerateSigningKeys("kid", "HS512", 384)
// after
jwks, err := jwksx.GenerateSigningKeys("kid", "HS512", 512) // or 1024 / 0

Defensive patterns

Strategy: validation

Validate before calling

if alg == "HS512" && bits != 0 && bits < 512 {
	return fmt.Errorf("HS512 needs >= 512 bits, got %d", bits)
}

Try / catch

jwks, err := jwksx.GenerateSigningKeys(id, "HS512", bits)
if err != nil && strings.Contains(err.Error(), "at least 512 bit") {
	return fmt.Errorf("HS512 key size must be >= 512 bits, got %d", bits)
}

Prevention

Use at least 512 bits for HS512 (1024 is the library default)
Keep sizes multiples of 8 to avoid the follow-up error
Use bits=0 to accept the default
Do not copy HS256/HS384 size settings into HS512 configs

When it happens

Trigger: Calling GenerateSigningKeys(id, "HS512", bits) with a non-zero bits value less than 512, e.g. 384 or 256.

Common situations: Reusing an HS256/HS384 key-size config value for HS512; progressively lowering sizes in test fixtures; confusing the 1024 default with a 512 minimum.

Related errors

AI-assisted analysis of ory/hydra@4174065ffb (2026-09-03). Data as JSON: /api/errors/9780b207c8b9263b. Report an issue: GitHub.