Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

HMAC with SHA-512/224 and SHA-512/256 is broken

Open
#38 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
48/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Stale
Tech stack
javascript
Domain
cryptography

Research direction

Locate the code that derives the HMAC block size by comparing hash-name strings, then read the linked pbkdf2 issue for the reported behavior. Verify the SHA-512/224 and SHA-512/256 cases against the existing HMAC behavior; done means both variants use their correct block size without regressing sha512 or sha384.

Written by the indexing model from the issue text.

Description

It is the same issue as https://github.com/browserify/pbkdf2/issues/82#issuecomment-3395223144 where the block size is derived by comparing against the strings "sha512" and "sha384" which means "sha512-224" and "sha512-256" get the default. This code was imported into Deno where I first spotted it there as https://github.com/denoland/deno/issues/31765.

Dominant language
JavaScript
Stars
60
Forks
22
No merged PRs in 30d

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from browserify/createHmac

All issues in browserify/createHmac

Similar issues

More JavaScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.