OpenNHP/opennhp · error

invalid input key

Error message

invalid input key

What it means

The nhp-serverd `pubkey --both` command failed to construct ECDH objects for the supplied private key. `core.ECDHFromKey` returned nil for either the SM2 or the Curve25519 instance, so the command cannot derive public keys and aborts with "invalid input key". When --json is set the error is emitted as JSON on stdout instead of a CLI error.

Solutions

1. Verify the argument is the exact base64-encoded 32-byte private key (no quotes, whitespace, or trailing newline) and re-run the command.
2. Base64-decode the key locally and confirm it is 32 bytes and not all zeros before retrying.
3. If the secret is unrecoverable, regenerate a fresh key pair with `nhp-serverd keygen` and rotate peers in lockstep.
4. Check with `--json` off to see the raw error rather than a JSON envelope.

Example fix

// before: whitespace-mangled key from config
nhp-serverd pubkey --both "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXog"
// after: exact base64 private key, no padding/space issues
nhp-serverd pubkey --both "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXo="

raw, err := base64.StdEncoding.DecodeString(keyArg)
if err != nil || len(raw) != 32 {
    return fmt.Errorf("private key must be base64 of exactly 32 bytes")
}
if bytes.Equal(raw, make([]byte, 32)) {
    return fmt.Errorf("private key must not be all zeros")
}

func isValidPrivKeyArg(s string) bool {
    b, err := base64.StdEncoding.DecodeString(s)
    return err == nil && len(b) == 32 && !bytes.Equal(b, make([]byte, 32))
}

if out, err := runPubkeyCmd("--both", keyArg); err != nil {
    log.Warn("pubkey derivation failed: %v", err) // includes "invalid input key"
}

When it happens

Trigger: Running `nhp-serverd pubkey --both <base64key>` where the base64 decodes but the resulting bytes are not a valid private scalar for SM2 and/or Curve25519 (e.g. zero scalar, wrong length after padding, or a key rejected by the crypto backend).

Common situations: Backfilling public keys for a legacy secret per generate-nhp-keys.sh but the stored base64 was truncated, contains whitespace/padding variants, or is a public (not private) key pasted by mistake.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• invalid input key
• invalid input key
• AuthServiceId is required
• ztdo path or output is empty
• invalid --data-source-type, allowed values are online…

AI-assisted analysis of OpenNHP/opennhp@6e04ca5ff0 (2026-09-07). Data as JSON: /api/errors/7d3fdd10d49cc423. Report an issue: GitHub.

Appendix: source

Thrown at endpoints/server/main/main.go:138

		},
		Action: func(c *cli.Context) error {
			emitErr := func(err error) error {
				if c.Bool("json") {
					json.NewEncoder(os.Stdout).Encode(map[string]string{"error": err.Error()})
					return nil
				}
				return err
			}
			privBytes, err := base64.StdEncoding.DecodeString(c.Args().First())
			if err != nil {
				return emitErr(fmt.Errorf("decode private key: %w", err))
			}

			if c.Bool("both") {
				sm2 := core.ECDHFromKey(core.ECC_SM2, privBytes)
				curve := core.ECDHFromKey(core.ECC_CURVE25519, privBytes)
				if sm2 == nil || curve == nil {
					return emitErr(fmt.Errorf("invalid input key"))
				}
				if c.Bool("json") {
					json.NewEncoder(os.Stdout).Encode(map[string]string{
						"sm2PublicKey":        sm2.PublicKeyBase64(),
						"curve25519PublicKey": curve.PublicKeyBase64(),
					})
				} else {
					fmt.Println("SM2 public key:       ", sm2.PublicKeyBase64())
					fmt.Println("Curve25519 public key:", curve.PublicKeyBase64())
				}
				return nil
			}

			eccType := core.ECC_SM2
			if c.Bool("curve") {
				eccType = core.ECC_CURVE25519
			}
			e := core.ECDHFromKey(eccType, privBytes)

View on GitHub (pinned to 6e04ca5ff0)