OpenNHP/opennhp · error

invalid input key

Error message

invalid input key

What it means

The `keygen`/key-import command builds an ECDH key object from a provided private key via core.ECDHFromKey. If the key bytes are invalid for the selected curve (SM2 or Curve25519), ECDHFromKey returns nil and the command reports "invalid input key", emitting JSON when --json is set.

Solutions

1. Regenerate the key with `nhp-agent keygen --curve` (or `--sm2`) instead of importing a hand-copied one.
2. Match the flag to the key type: only pass --curve for Curve25519 keys; drop it for SM2 keys.
3. Trim whitespace and confirm the key's encoding/length matches the curve (32 bytes for Curve25519).
4. Check the JSON output's "error" field and re-encode the key correctly before retrying.

Example fix

// before
./nhp-agent keygen --curve   # but key is SM2 -> ECDHFromKey returns nil

// after
./nhp-agent keygen           # SM2 key without --curve, or use a Curve25519 key with --curve

keyBytes, err := base64.StdEncoding.DecodeString(privKeyStr)
if err != nil || len(keyBytes) != 32 {
    return fmt.Errorf("private key must be base64 32-byte scalar")
}

e := core.ECDHFromKey(eccType, privKey)
if e == nil {
    return fmt.Errorf("invalid %s private key", eccTypeName(eccType))
}

When it happens

Trigger: Running the keygen/import command (c.Bool("curve") selects ECC_CURVE25519, otherwise ECC_SM2) with privKey that is empty, wrong length, not base64/hex decodable, or not a valid scalar for the chosen curve.

Common situations: Pasting an SM2 private key while passing --curve (mismatched key vs curve); copying a truncated key from a terminal; supplying a public key where a private key is expected; whitespace/newlines embedded in the key string.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• AuthServiceId is required
• invalid input key
• decode private key
• invalid input key
• missing remote peer public key

AI-assisted analysis of OpenNHP/opennhp@6e04ca5ff0 (2026-09-07). Data as JSON: /api/errors/ecee011135d2a94c. Report an issue: GitHub.

Appendix: source

Thrown at endpoints/agent/main/main.go:105

		},
		Action: func(c *cli.Context) error {
			privKey, err := base64.StdEncoding.DecodeString(c.Args().First())
			if err != nil {
				if c.Bool("json") {
					json.NewEncoder(os.Stdout).Encode(map[string]interface{}{
						"error": err.Error(),
					})
					return nil
				}
				return err
			}
			eccType := core.ECC_SM2
			if c.Bool("curve") {
				eccType = core.ECC_CURVE25519
			}
			e := core.ECDHFromKey(eccType, privKey)
			if e == nil {
				err := fmt.Errorf("invalid input key")
				if c.Bool("json") {
					json.NewEncoder(os.Stdout).Encode(map[string]interface{}{
						"error": err.Error(),
					})
					return nil
				}
				return err
			}
			pub := e.PublicKeyBase64()
			if c.Bool("json") {
				json.NewEncoder(os.Stdout).Encode(map[string]string{
					"publicKey": pub,
				})
			} else {
				fmt.Println("Public key: ", pub)
			}
			return nil
		},

View on GitHub (pinned to 6e04ca5ff0)