@@ -23,6 +23,7 @@ const {
   SafeMap,
   SafeSet,
   StringPrototypeCharCodeAt,
+  StringPrototypeStartsWith,
   StringPrototypeToUpperCase,
   Symbol,
   TypedArrayPrototypeGetBuffer,
@@ -833,7 +834,12 @@ function normalizeAlgorithm(algorithm, op) {
           getBufferSourceBytes(idlValue),
         );
       } else if (idlType === 'HashAlgorithmIdentifier') {
-        normalizedAlgorithm[member] = normalizeAlgorithm(idlValue, 'digest');
+        const hash = normalizeAlgorithm(idlValue, 'digest');
+        if (!StringPrototypeStartsWith(hash.name, 'SHA')) {
+          throw lazyDOMException(
+            `Only SHA hashes are supported in ${desiredType}`, 'NotSupportedError');
+        }
+        normalizedAlgorithm[member] = hash;
       } else if (idlType === 'AlgorithmIdentifier') {
         // This extension point is not used by any supported algorithm (yet?)
         throw lazyDOMException('Not implemented.', 'NotSupportedError');
 
@@ -7,7 +7,6 @@ const {
   ObjectPrototypeHasOwnProperty,
   StringPrototypeCharCodeAt,
   StringPrototypeSplit,
-  StringPrototypeStartsWith,
   StringPrototypeToLowerCase,
 } = primordials;
 
@@ -68,18 +67,6 @@ function namedCurveValidator(V, dict) {
 
 const converters = { __proto__: null, ...webidl };
 
-/**
- * @param {string | object} V - The hash algorithm identifier (string or object).
- * @param {string} label - The dictionary name for the error message.
- */
-function ensureSHA(V, label) {
-  const name = typeof V === 'string' ? V : V.name;
-  if (typeof name !== 'string' ||
-      !StringPrototypeStartsWith(StringPrototypeToLowerCase(name), 'sha'))
-    throw lazyDOMException(
-      `Only SHA hashes are supported in ${label}`, 'NotSupportedError');
-}
-
 converters.AlgorithmIdentifier = (V, opts) => {
   // Union for (object or DOMString)
   if (type(V) === 'Object') {
@@ -224,7 +211,6 @@ converters.RsaHashedKeyGenParams = createDictionaryConverter(
       {
         key: 'hash',
         converter: converters.HashAlgorithmIdentifier,
-        validator: (V, dict) => ensureSHA(V, 'RsaHashedKeyGenParams'),
         required: true,
       },
     ],
@@ -237,7 +223,6 @@ converters.RsaHashedImportParams = createDictionaryConverter(
       {
         key: 'hash',
         converter: converters.HashAlgorithmIdentifier,
-        validator: (V, dict) => ensureSHA(V, 'RsaHashedImportParams'),
         required: true,
       },
     ],
@@ -366,7 +351,6 @@ converters.EcdsaParams = createDictionaryConverter(
       {
         key: 'hash',
         converter: converters.HashAlgorithmIdentifier,
-        validator: (V, dict) => ensureSHA(V, 'EcdsaParams'),
         required: true,
       },
     ],
@@ -392,7 +376,6 @@ for (let i = 0; i < kHmacDictionaries.length; i++) {
         {
           key: 'hash',
           converter: converters.HashAlgorithmIdentifier,
-          validator: (V, dict) => ensureSHA(V, name),
           required: true,
         },
         {
@@ -456,7 +439,6 @@ converters.HkdfParams = createDictionaryConverter(
       {
         key: 'hash',
         converter: converters.HashAlgorithmIdentifier,
-        validator: (V, dict) => ensureSHA(V, 'HkdfParams'),
         required: true,
       },
       {
@@ -524,7 +506,6 @@ converters.Pbkdf2Params = createDictionaryConverter(
       {
         key: 'hash',
         converter: converters.HashAlgorithmIdentifier,
-        validator: (V, dict) => ensureSHA(V, 'Pbkdf2Params'),
         required: true,
       },
     ],
 
@@ -0,0 +1,47 @@
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('assert');
+const { subtle } = globalThis.crypto;
+
+(async () => {
+  const data = new Uint8Array(32);
+  let reads = 0;
+  const key = await subtle.importKey('raw', data, {
+    name: 'HMAC',
+    hash: {
+      get name() {
+        reads++;
+        return reads === 1 ? 'SHA-384' : 'SHA-256';
+      },
+    },
+  }, false, ['sign']);
+  assert.strictEqual(reads, 1);
+  assert.strictEqual(key.algorithm.hash.name, 'SHA-384');
+  assert.strictEqual((await subtle.sign('HMAC', key, data)).byteLength, 48);
+
+  const converted = await subtle.importKey('raw', data, {
+    name: 'HMAC',
+    hash: { name: { toString() { return 'SHA-256'; } } },
+  }, false, ['sign']);
+  assert.strictEqual(converted.algorithm.hash.name, 'SHA-256');
+
+  await assert.rejects(subtle.importKey('raw', data, {
+    name: 'HMAC', hash: {},
+  }, false, ['sign']), TypeError);
+  const cshakeAvailable = SubtleCrypto.supports('digest', {
+    name: 'cSHAKE128', outputLength: 256,
+  });
+  await assert.rejects(subtle.importKey('raw', data, {
+    name: 'HMAC', hash: 'cSHAKE128',
+  }, false, ['sign']), cshakeAvailable ? TypeError : { name: 'NotSupportedError' });
+  await assert.rejects(subtle.importKey('raw', data, {
+    name: 'HMAC', hash: 'MD5', length: -1,
+  }, false, ['sign']), TypeError);
+  await assert.rejects(subtle.importKey('raw', data, {
+    name: 'HMAC', hash: { name: 'cSHAKE128', outputLength: 256 },
+  }, false, ['sign']), { name: 'NotSupportedError' });
+})().then(common.mustCall());