AlexxIT/go2rtc · error

failed to decode PEM block

Error message

failed to decode PEM block

What it means

Tuya EncryptPassword guard: pem.Decode returned nil for the constructed '-----BEGIN PUBLIC KEY-----' wrapper around the provided pbKey string. The server-supplied key blob is not valid PEM/base64 DER, so the RSA key cannot be parsed and password encryption fails.

Solutions

1. Check pbKey for copy corruption/truncation (it should be base64 DER SPKI)
2. Strip whitespace/newlines incorrectly inserted into the key
3. Fetch a fresh key from the Tuya endpoint if the cached one is stale

When it happens

Trigger: Thrown at pkg/tuya/helper.go:28 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

AI-assisted analysis of AlexxIT/go2rtc@c245815e75 (2026-09-07). Data as JSON: /api/errors/66efe384538b5b92. Report an issue: GitHub.

Appendix: source

Thrown at pkg/tuya/helper.go:28

	"errors"
	"net/http"
	"net/http/cookiejar"
	"regexp"
	"time"

	"golang.org/x/net/publicsuffix"
)

func EncryptPassword(password, pbKey string) (string, error) {
	// Hash password with MD5
	hasher := md5.New()
	hasher.Write([]byte(password))
	hashedPassword := hex.EncodeToString(hasher.Sum(nil))

	// Decode PEM public key
	block, _ := pem.Decode([]byte("-----BEGIN PUBLIC KEY-----\n" + pbKey + "\n-----END PUBLIC KEY-----"))
	if block == nil {
		return "", errors.New("failed to decode PEM block")
	}

	pubKey, err := x509.ParsePKIXPublicKey(block.Bytes)
	if err != nil {
		return "", err
	}

	rsaPubKey, ok := pubKey.(*rsa.PublicKey)
	if !ok {
		return "", errors.New("not an RSA public key")
	}

	// Encrypt with RSA
	encrypted, err := rsa.EncryptPKCS1v15(cryptoRand.Reader, rsaPubKey, []byte(hashedPassword))
	if err != nil {
		return "", err
	}

View on GitHub (pinned to c245815e75)