TechnitiumSoftware/DnsServer · error · ArgumentException

The EdDSA ({(keyType == DnssecPrivateKeyType.KeySigningKey ?

Error message

The EdDSA ({(keyType == DnssecPrivateKeyType.KeySigningKey ? "KSK" : "ZSK")}) private key must be for Ed25519 curve.

What it means

Thrown by DnssecPrivateKey.Create (PEM overload) for DnssecAlgorithm.ED25519 when the PEM does not decode to an Ed25519PrivateKeyParameters object. The library uses BouncyCastle's PemReader, so a PEM for the wrong curve (Ed448) or a non-EdDSA PEM fails the type pattern match.

Source

Thrown at DnsServerCore/Dns/Dnssec/DnssecPrivateKey.cs:264

                        return new DnssecEcdsaPrivateKey(algorithm, keyType, ecdsa.ExportParameters(true));
                    }

                case DnssecAlgorithm.ECDSAP384SHA384:
                    using (ECDsa ecdsa = ECDsa.Create())
                    {
                        ecdsa.ImportFromPem(pemPrivateKey);

                        if (ecdsa.KeySize != 384)
                            throw new ArgumentException($"The ECDSA ({(keyType == DnssecPrivateKeyType.KeySigningKey ? "KSK" : "ZSK")}) private key must have key size of 384 bits.", nameof(pemPrivateKey));

                        return new DnssecEcdsaPrivateKey(algorithm, keyType, ecdsa.ExportParameters(true));
                    }

                case DnssecAlgorithm.ED25519:
                    using (PemReader pemReader = new PemReader(new StringReader(pemPrivateKey)))
                    {
                        if (pemReader.ReadObject() is not Ed25519PrivateKeyParameters privateKey)
                            throw new ArgumentException($"The EdDSA ({(keyType == DnssecPrivateKeyType.KeySigningKey ? "KSK" : "ZSK")}) private key must be for Ed25519 curve.", nameof(pemPrivateKey));

                        return new DnssecEddsaPrivateKey(keyType, privateKey);
                    }

                case DnssecAlgorithm.ED448:
                    using (PemReader pemReader = new PemReader(new StringReader(pemPrivateKey)))
                    {
                        if (pemReader.ReadObject() is not Ed448PrivateKeyParameters privateKey)
                            throw new ArgumentException($"The EdDSA ({(keyType == DnssecPrivateKeyType.KeySigningKey ? "KSK" : "ZSK")}) private key must be for Ed448 curve.", nameof(pemPrivateKey));

                        return new DnssecEddsaPrivateKey(keyType, privateKey);
                    }

                default:
                    throw new NotSupportedException("DNSSEC algorithm is not supported: " + algorithm.ToString());
            }
        }

View on GitHub (pinned to d0484b6c1e)

Solutions

Generate an Ed25519 key: openssl genpkey -algorithm Ed25519 -out key.pem.
If the PEM is actually Ed448, call Create with DnssecAlgorithm.ED448.
Confirm the PEM BEGIN line matches the expected key type (e.g. BEGIN PRIVATE KEY with Ed25519 OID).

Example fix

// before: pem is an Ed448 key
var key = DnssecPrivateKey.Create(DnssecAlgorithm.ED25519, kt, ed448Pem); // throws

// after
var key = DnssecPrivateKey.Create(DnssecAlgorithm.ED448, kt, ed448Pem);

Defensive patterns

Strategy: validation

Validate before calling

using var pr = new PemReader(new StringReader(pem));
if (pr.ReadObject() is not Ed25519PrivateKeyParameters)
    throw new InvalidOperationException("PEM is not an Ed25519 private key.");
var key = DnssecPrivateKey.Create(DnssecAlgorithm.ED25519, keyType, pem);

Type guard

static bool PemIsEd25519(string pem)
{
    try { using var pr = new PemReader(new StringReader(pem)); return pr.ReadObject() is Ed25519PrivateKeyParameters; }
    catch { return false; }
}

Try / catch

try { return DnssecPrivateKey.Create(DnssecAlgorithm.ED25519, keyType, pem); }
catch (ArgumentException ex) when (ex.ParamName == nameof(pem))
{ throw new InvalidOperationException("PEM is not Ed25519; verify the key or use ED448.", ex); }

Prevention

Generate Ed25519 keys with: openssl genpkey -algorithm Ed25519.
Don't interchange Ed25519 and Ed448 PEMs.
Validate the PEM object type before calling Create.

When it happens

Trigger: Calling Create(ED25519, keyType, pem) where pem is an Ed448 key, an EC key, or not a valid Ed25519 private key PEM.

Common situations: Mixing up Ed25519 and Ed448 key files; loading an EC/RSA PEM into the EdDSA branch; truncated or malformed PEM.

Related errors

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/121c2ddf5fc08549. Report an issue: GitHub.