TechnitiumSoftware/DnsServer · error · ArgumentException

The EdDSA ({(keyType == DnssecPrivateKeyType.KeySigningKey ?

Error message

The EdDSA ({(keyType == DnssecPrivateKeyType.KeySigningKey ? "KSK" : "ZSK")}) private key must be for Ed448 curve.

What it means

Thrown by DnssecPrivateKey.Create (PEM overload) for DnssecAlgorithm.ED448 when the PEM does not decode to an Ed448PrivateKeyParameters object. Symmetric to the ED25519 case: the wrong curve or key type fails the pattern match.

Source

Thrown at DnsServerCore/Dns/Dnssec/DnssecPrivateKey.cs:273

                            throw new ArgumentException($"The ECDSA ({(keyType == DnssecPrivateKeyType.KeySigningKey ? "KSK" : "ZSK")}) private key must have key size of 384 bits.", nameof(pemPrivateKey));

                        return new DnssecEcdsaPrivateKey(algorithm, keyType, ecdsa.ExportParameters(true));
                    }

                case DnssecAlgorithm.ED25519:
                    using (PemReader pemReader = new PemReader(new StringReader(pemPrivateKey)))
                    {
                        if (pemReader.ReadObject() is not Ed25519PrivateKeyParameters privateKey)
                            throw new ArgumentException($"The EdDSA ({(keyType == DnssecPrivateKeyType.KeySigningKey ? "KSK" : "ZSK")}) private key must be for Ed25519 curve.", nameof(pemPrivateKey));

                        return new DnssecEddsaPrivateKey(keyType, privateKey);
                    }

                case DnssecAlgorithm.ED448:
                    using (PemReader pemReader = new PemReader(new StringReader(pemPrivateKey)))
                    {
                        if (pemReader.ReadObject() is not Ed448PrivateKeyParameters privateKey)
                            throw new ArgumentException($"The EdDSA ({(keyType == DnssecPrivateKeyType.KeySigningKey ? "KSK" : "ZSK")}) private key must be for Ed448 curve.", nameof(pemPrivateKey));

                        return new DnssecEddsaPrivateKey(keyType, privateKey);
                    }

                default:
                    throw new NotSupportedException("DNSSEC algorithm is not supported: " + algorithm.ToString());
            }
        }

        public static DnssecPrivateKey ReadFrom(BinaryReader bR)
        {
            if (Encoding.ASCII.GetString(bR.BaseStream.ReadExactly(2)) != "DK")
                throw new InvalidDataException("DNSSEC private key format is invalid.");

            int version = bR.ReadByte();
            switch (version)
            {
                case 1:

View on GitHub (pinned to d0484b6c1e)

Solutions

Generate an Ed448 key (requires an Ed448-capable OpenSSL build): openssl genpkey -algorithm Ed448 -out key.pem.
If the PEM is actually Ed25519, call Create with DnssecAlgorithm.ED25519.
Verify the PEM decodes to Ed448PrivateKeyParameters before assignment.

Example fix

// before: pem is an Ed25519 key
var key = DnssecPrivateKey.Create(DnssecAlgorithm.ED448, kt, ed25519Pem); // throws

// after
var key = DnssecPrivateKey.Create(DnssecAlgorithm.ED25519, kt, ed25519Pem);

Defensive patterns

Strategy: validation

Validate before calling

using var pr = new PemReader(new StringReader(pem));
if (pr.ReadObject() is not Ed448PrivateKeyParameters)
    throw new InvalidOperationException("PEM is not an Ed448 private key.");
var key = DnssecPrivateKey.Create(DnssecAlgorithm.ED448, keyType, pem);

Type guard

static bool PemIsEd448(string pem)
{
    try { using var pr = new PemReader(new StringReader(pem)); return pr.ReadObject() is Ed448PrivateKeyParameters; }
    catch { return false; }
}

Try / catch

try { return DnssecPrivateKey.Create(DnssecAlgorithm.ED448, keyType, pem); }
catch (ArgumentException ex) when (ex.ParamName == nameof(pem))
{ throw new InvalidOperationException("PEM is not Ed448; verify the key or use ED25519.", ex); }

Prevention

Generate Ed448 keys only with Ed448-capable OpenSSL builds.
Keep Ed25519 and Ed448 key files clearly separated.
Validate the PEM object type before calling Create.

When it happens

Trigger: Calling Create(ED448, keyType, pem) where pem is an Ed25519 key, an EC key, or otherwise not a valid Ed448 private key PEM.

Common situations: Using an Ed25519 PEM with the ED448 algorithm; Ed448 tooling being rare so the wrong file is grabbed; malformed PEM.

Related errors

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/f78030fb9f378546. Report an issue: GitHub.