ory/hydra · error

unknown algorithm %s for encryption key

Error message

unknown algorithm %s for encryption key

What it means

Returned by NewEncryptionKey when the requested JWE algorithm is not one of the symmetric/asymmetric key-generation cases handled above (RSA, ECDSA, ECDH-ES families, etc.). The algorithm string is unsupported for key generation, typically a typo or an algorithm that requires externally supplied keys.

Source

Thrown at oryx/josex/generate.go:119

	case jose.ECDH_ES, jose.ECDH_ES_A128KW, jose.ECDH_ES_A192KW, jose.ECDH_ES_A256KW:
		var crv elliptic.Curve
		switch bits {
		case 0, 256:
			crv = elliptic.P256()
		case 384:
			crv = elliptic.P384()
		case 521:
			crv = elliptic.P521()
		default:
			return nil, nil, errors.New("invalid elliptic curve key size, use one of 256, 384, or 521")
		}
		key, err := ecdsa.GenerateKey(crv, rand.Reader)
		if err != nil {
			return nil, nil, err
		}
		return key.Public(), key, err
	default:
		return nil, nil, fmt.Errorf("unknown algorithm %s for encryption key", alg)
	}
}

View on GitHub (pinned to 4174065ffb)

Solutions

1. Use a supported encryption alg: RSA1_5, RSA-OAEP, RSA-OAEP-256, ECDH-ES, ECDH-ES+A128KW, ECDH-ES+A192KW, ECDH-ES+A256KW
2. For dir/A*GCM algorithms, generate/provide a symmetric key rather than calling NewEncryptionKey
3. Check you are not passing a SignatureAlgorithm where a KeyAlgorithm is expected

Example fix

// before
pub, priv, err := josex.NewEncryptionKey(jose.KeyAlgorithm("dir"), 0)
// after
pub, priv, err := josex.NewEncryptionKey(jose.RSA_OAEP_256, 2048)

var supportedEncAlgs = map[jose.KeyAlgorithm]bool{
    jose.RSA1_5: true, jose.RSA_OAEP: true, jose.RSA_OAEP_256: true,
    jose.ECDH_ES: true, jose.ECDH_ES_A128KW: true, jose.ECDH_ES_A192KW: true, jose.ECDH_ES_A256KW: true,
}
func checkEncryptionAlg(alg jose.KeyAlgorithm) error {
    if !supportedEncAlgs[alg] {
        return fmt.Errorf("alg %q not supported for encryption key generation", alg)
    }
    return nil
}

func isKeyEncryptionAlg(alg string) bool {
    switch alg {
    case "RSA1_5", "RSA-OAEP", "RSA-OAEP-256", "ECDH-ES", "ECDH-ES+A128KW", "ECDH-ES+A192KW", "ECDH-ES+A256KW":
        return true
    }
    return false
}

pub, priv, err := josex.NewEncryptionKey(alg, bits)
if err != nil {
    return fmt.Errorf("config error: cannot generate encryption key: %w", err)
}

When it happens

Trigger: Calling josex.NewEncryptionKey with a signature algorithm like ES256, an unsupported/typo'd alg string, or a PBES2/A128GCM key-management value; passing bits incompatible with an ECDH curve is a sibling error, but a truly unknown alg hits this message.

Common situations: Mixing up signature and encryption algorithm constants in config; using dir or A*GCM key-wrap algorithms which need a symmetric key, not a generated keypair; typos in YAML/JSON JWK generation settings.

Related errors

• unknown algorithm %s for signing key
• invalid elliptic curve key size, this algorithm does not sup
• invalid key size for RSA key, 2048 or more is required
• invalid elliptic curve key size, use one of 256, 384, or 521
• invalid JWK key

AI-assisted analysis of ory/hydra@4174065ffb (2026-09-03). Data as JSON: /api/errors/2566c4b1275a609c. Report an issue: GitHub.