TechnitiumSoftware/DnsServer · error · ArgumentException

The ECDSA ({(keyType == DnssecPrivateKeyType.KeySigningKey ?

Error message

The ECDSA ({(keyType == DnssecPrivateKeyType.KeySigningKey ? "KSK" : "ZSK")}) private key must have key size of 256 bits.

What it means

Thrown by DnssecPrivateKey.Create (PEM overload) for DnssecAlgorithm.ECDSAP256SHA256 when the imported ECDsa key's KeySize is not exactly 256 bits. The P-256 curve fixes the size, so a mismatch means the PEM is for the wrong curve (e.g. P-384) and the signature would be invalid for this algorithm.

Source

Thrown at DnsServerCore/Dns/Dnssec/DnssecPrivateKey.cs:244

                case DnssecAlgorithm.RSASHA256:
                case DnssecAlgorithm.RSASHA512:
                    using (RSA rsa = RSA.Create())
                    {
                        rsa.ImportFromPem(pemPrivateKey);

                        if ((rsa.KeySize < 1024) || (rsa.KeySize > 4096))
                            throw new ArgumentOutOfRangeException(nameof(pemPrivateKey), $"Valid RSA ({(keyType == DnssecPrivateKeyType.KeySigningKey ? "KSK" : "ZSK")}) private key size range is between 1024-4096 bits.");

                        return new DnssecRsaPrivateKey(algorithm, keyType, rsa.KeySize, rsa.ExportParameters(true));
                    }

                case DnssecAlgorithm.ECDSAP256SHA256:
                    using (ECDsa ecdsa = ECDsa.Create())
                    {
                        ecdsa.ImportFromPem(pemPrivateKey);

                        if (ecdsa.KeySize != 256)
                            throw new ArgumentException($"The ECDSA ({(keyType == DnssecPrivateKeyType.KeySigningKey ? "KSK" : "ZSK")}) private key must have key size of 256 bits.", nameof(pemPrivateKey));

                        return new DnssecEcdsaPrivateKey(algorithm, keyType, ecdsa.ExportParameters(true));
                    }

                case DnssecAlgorithm.ECDSAP384SHA384:
                    using (ECDsa ecdsa = ECDsa.Create())
                    {
                        ecdsa.ImportFromPem(pemPrivateKey);

                        if (ecdsa.KeySize != 384)
                            throw new ArgumentException($"The ECDSA ({(keyType == DnssecPrivateKeyType.KeySigningKey ? "KSK" : "ZSK")}) private key must have key size of 384 bits.", nameof(pemPrivateKey));

                        return new DnssecEcdsaPrivateKey(algorithm, keyType, ecdsa.ExportParameters(true));
                    }

                case DnssecAlgorithm.ED25519:
                    using (PemReader pemReader = new PemReader(new StringReader(pemPrivateKey)))
                    {

View on GitHub (pinned to d0484b6c1e)

Solutions

Regenerate a P-256 key: openssl ecparam -name prime256v1 -genkey -noout -out key.pem.
If the PEM is genuinely P-384, use DnssecAlgorithm.ECDSAP384SHA384 instead.
Match the DnssecAlgorithm to the curve the PEM was generated on.

Example fix

// before: pem is a P-384 key
var key = DnssecPrivateKey.Create(DnssecAlgorithm.ECDSAP256SHA256, kt, p384Pem); // throws

// after
var key = DnssecPrivateKey.Create(DnssecAlgorithm.ECDSAP384SHA384, kt, p384Pem);

Defensive patterns

Strategy: validation

Validate before calling

using var ecdsa = ECDsa.Create();
ecdsa.ImportFromPem(pem);
if (ecdsa.KeySize != 256)
    throw new InvalidOperationException($"ECDSA key is {ecdsa.KeySize} bits; ECDSAP256SHA256 requires 256 (P-256).");
var key = DnssecPrivateKey.Create(DnssecAlgorithm.ECDSAP256SHA256, keyType, pem);

Type guard

static bool PemIsP256(string pem)
{
    try { using var e = ECDsa.Create(); e.ImportFromPem(pem); return e.KeySize == 256; }
    catch { return false; }
}

Try / catch

try { return DnssecPrivateKey.Create(DnssecAlgorithm.ECDSAP256SHA256, keyType, pem); }
catch (ArgumentException ex) when (ex.ParamName == nameof(pem))
{ throw new InvalidOperationException("PEM is not a P-256 key; check the curve or use ECDSAP384SHA384.", ex); }

Prevention

Generate keys on prime256v1 for the P-256 algorithm.
Match the DnssecAlgorithm to the curve that produced the PEM.
Label key files with their curve to avoid mismatches.

When it happens

Trigger: Calling Create(ECDSAP256SHA256, keyType, pem) where the PEM decodes to a non-P-256 EC key (e.g. a P-384 or secp256k1 key).

Common situations: Selecting the wrong algorithm for the PEM; reusing a P-384 key for a P-256 algorithm; PEM generated with a non-nist curve.

Related errors

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/fd5ea65618bc5f47. Report an issue: GitHub.