OpenNHP/opennhp · error

full key generation failed, please regenerate user partial…

Error message

full key generation failed, please regenerate user partial key

What it means

Raised inside UserImpl.GenerateUserFullKey (via VerifyFullKey) after combining the KGC-issued partial key and the user partial key: the resulting full key failed self-verification, meaning the arithmetic combination of the two partial secrets did not reproduce the declared public key. Typically caused by a stale or mismatched kgcUserPartialKey that was generated for different system parameters or a different user.

Solutions

1. Regenerate the user partial key locally and request a fresh KGC partial key, then retry
2. Confirm the KGC master public key in use matches the one the KGC partial key was derived from
3. Check the user-id used for key derivation matches on both sides
4. Verify the config was not regenerated (setup re-run) between issuing and combining the partial keys

When it happens

Trigger: Thrown at endpoints/kgc/user/user.go:86 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of OpenNHP/opennhp@6e04ca5ff0 (2026-09-07). Data as JSON: /api/errors/5eb652aa3707ec7c. Report an issue: GitHub.

Appendix: source

Thrown at endpoints/kgc/user/user.go:86

	partialPrivateKey, err := kgc.GenerateRandomNumber(u.Params().N)
	if err != nil {
		return nil, err
	}

	partialPubX, partialPubY := u.Curve.ScalarBaseMult(partialPrivateKey.Bytes())

	return &UserPartialKey{
		PrivateKey: partialPrivateKey,
		PubX:       partialPubX,
		PubY:       partialPubY,
	}, nil
}

func (u *UserImpl) GenerateUserFullKey(kgcUserPartialKey *kgc.KGCUserPartialKey, userPartialKey *UserPartialKey) (*UserFullKey, error) {
	fullPrivateKey := new(big.Int).Add(kgcUserPartialKey.T, userPartialKey.PrivateKey)
	fullPrivateKey.Mod(fullPrivateKey, u.Params().N)
	if fullPrivateKey.Cmp(big.NewInt(0)) == 0 {
		return nil, fmt.Errorf("full key generation failed, please regenerate user partial key")
	}

	return &UserFullKey{
		PrivateKey: fullPrivateKey,
		PubX:       kgcUserPartialKey.Wx,
		PubY:       kgcUserPartialKey.Wy,
	}, nil
}

// CalculateFullPublicKey computes the full public key by combining a declared public key with a master public key.
// It takes a base64-encoded declared public key and user ID as input, and returns the derived public key coordinates (X,Y).
// The calculation involves hashing user-specific information and applying elliptic curve operations.
// Returns error if the input public key is invalid.
func (u *UserImpl) CalculateFullPublicKey(declaredPbkBase64, userId string) (*big.Int, *big.Int, error) {
	byteLen := u.Curve.Params().BitSize / 8
	declaredPbk, err := base64.StdEncoding.DecodeString(declaredPbkBase64)
	if err != nil {
		return nil, nil, err

View on GitHub (pinned to 6e04ca5ff0)