AlexxIT/go2rtc · error

not an RSA public key

Error message

not an RSA public key

What it means

Tuya EncryptPassword type guard: the PKIX public key parsed successfully but is not *rsa.PublicKey (e.g. ECDSA or Ed25519). The password-encryption path requires RSA PKCS1v15, so a non-RSA key blob from the server/API response cannot be used.

Solutions

1. Verify the API returned an RSA public key as Tuya normally does
2. Check for endpoint/firmware variants that issue ECC keys and handle or avoid them
3. Type-assert and branch on the key algorithm at the call site

When it happens

Trigger: Thrown at pkg/tuya/helper.go:38 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of AlexxIT/go2rtc@c245815e75 (2026-09-07). Data as JSON: /api/errors/8d3012e63a4957eb. Report an issue: GitHub.

Appendix: source

Thrown at pkg/tuya/helper.go:38

	// Hash password with MD5
	hasher := md5.New()
	hasher.Write([]byte(password))
	hashedPassword := hex.EncodeToString(hasher.Sum(nil))

	// Decode PEM public key
	block, _ := pem.Decode([]byte("-----BEGIN PUBLIC KEY-----\n" + pbKey + "\n-----END PUBLIC KEY-----"))
	if block == nil {
		return "", errors.New("failed to decode PEM block")
	}

	pubKey, err := x509.ParsePKIXPublicKey(block.Bytes)
	if err != nil {
		return "", err
	}

	rsaPubKey, ok := pubKey.(*rsa.PublicKey)
	if !ok {
		return "", errors.New("not an RSA public key")
	}

	// Encrypt with RSA
	encrypted, err := rsa.EncryptPKCS1v15(cryptoRand.Reader, rsaPubKey, []byte(hashedPassword))
	if err != nil {
		return "", err
	}

	// Convert to hex string
	return hex.EncodeToString(encrypted), nil
}

func IsEmailAddress(input string) bool {
	emailRegex := regexp.MustCompile(`^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$`)
	return emailRegex.MatchString(input)
}

func CreateHTTPClientWithSession() *http.Client {

View on GitHub (pinned to c245815e75)