OpenNHP/opennhp · error

TEE public key is not found for specified token

Error message

TEE public key is not found for specified token

What it means

GetTeePubKeyByToken looks up a previously stored TEE RSA public key by the token presented in the GetResource request. The lookup is guarded by a read lock over the in-memory teePubKeys map; if the token is absent, this error is returned.

Solutions

1. Run the attestation flow (POST /attest) to obtain and store a valid token before calling GetResource
2. Persist or re-establish TEE pubkeys if the server restarts mid-session
3. Verify the client sends the exact token string returned by attestation
4. Check for load-balancing to a different instance that lacks the in-memory token

Example fix

// before
res, err := GetResource(token, "default/repo/key")
// after
if err := client.Attest(); err != nil { return err } // stores tee pubkey under new token
res, err := GetResource(token, "default/repo/key")

if token == "" {
    return errors.New("no attestation token; run attest first")
}
pk, err := GetTeePubKeyByToken(token)

func hasToken(tok string) bool { return tok != "" }

pk, err := GetTeePubKeyByToken(token)
if err != nil {
    if strings.Contains(err.Error(), "not found") {
        // re-attest to refresh the in-memory token store, then retry
        if aerr := client.Attest(); aerr != nil { return aerr }
        pk, err = GetTeePubKeyByToken(token)
    }
    if err != nil { return err }
}

When it happens

Trigger: GetResource is called with a token that was never stored (attestation never ran for it), the process restarted losing the in-memory map, or the token string is corrupted/truncated in transit.

Common situations: Client skips the attestation step and jumps straight to fetching resources; server restart between attestation and resource fetch; client sends an old/expired token after redeploy.

Related errors

• unsupported key type, expect RSA
• JWT signing key is not initialized
• invalid n
• invalid e
• invalid public key length: got

AI-assisted analysis of OpenNHP/opennhp@6e04ca5ff0 (2026-09-07). Data as JSON: /api/errors/94a15aa5d1c8693b. Report an issue: GitHub.

Appendix: source

Thrown at endpoints/server/kbs/attest/attest.go:160

	publicKey := jwtSigningKey.PublicKey
	token.Header["jwk"] = map[string]any{
		"alg": "ES256",
		"crv": "P-256",
		"kty": "EC",
		"x":   base64.RawURLEncoding.EncodeToString(publicKey.X.Bytes()),
		"y":   base64.RawURLEncoding.EncodeToString(publicKey.Y.Bytes()),
	}

	return token.SignedString(jwtSigningKey)
}

func GetTeePubKeyByToken(token string) (*rsa.PublicKey, error) {
	teePubKeys.RLock()
	defer teePubKeys.RUnlock()

	pubKey, exists := teePubKeys.data[token]
	if !exists {
		return nil, errors.New("TEE public key is not found for specified token")

	}
	return pubKey, nil
}

View on GitHub (pinned to 6e04ca5ff0)