{"record":{"id":"00fcdf6efe44e6a1","repo":"ipfs/kubo","slug":"invalid-ec-private-key-length","errorCode":null,"errorMessage":"invalid EC private key length","messagePattern":"invalid EC private key length","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/commands/keystore.go","lineNumber":1074,"sourceCode":"\t\treturn false\n\t}\n\treturn curve.Equal(oidNamedCurveSecp256k1)\n}\n\nfunc parseSecp256k1PrivateKey(der []byte) (*secp256k1.PrivateKey, error) {\n\tvar wrapper pkcs8Key\n\tif _, err := asn1.Unmarshal(der, &wrapper); err != nil {\n\t\treturn nil, err\n\t}\n\tvar ec ecPrivateKey\n\tif _, err := asn1.Unmarshal(wrapper.PrivateKey, &ec); err != nil {\n\t\treturn nil, fmt.Errorf(\"invalid EC private key: %w\", err)\n\t}\n\tif ec.Version != 1 {\n\t\treturn nil, fmt.Errorf(\"unsupported EC private key version %d\", ec.Version)\n\t}\n\tif len(ec.PrivateKey) > 32 {\n\t\treturn nil, errors.New(\"invalid EC private key length\")\n\t}\n\tvar buf [32]byte\n\tcopy(buf[32-len(ec.PrivateKey):], ec.PrivateKey)\n\tvar scalar secp256k1.ModNScalar\n\tif overflow := scalar.SetBytes(&buf); overflow != 0 || scalar.IsZero() {\n\t\treturn nil, errors.New(\"EC private key not in the valid range for secp256k1\")\n\t}\n\treturn secp256k1.NewPrivateKey(&scalar), nil\n}\n","sourceCodeStart":1056,"sourceCodeEnd":1084,"githubUrl":"https://github.com/ipfs/kubo/blob/329838acdfafae224582930457efe80aa217afc0/core/commands/keystore.go#L1056-L1084","documentation":"Structural validation in parseSecp256k1PrivateKey during PEM/PKCS8 import: the ECPrivateKey ASN.1 structure parsed successfully but its privateKey OCTET STRING is longer than the 32 bytes a secp256k1 scalar requires. This means the DER claims secp256k1 (by OID) but carries an oversized secret — the input key file is malformed or not actually a secp256k1 key.","triggerScenarios":"Thrown at core/commands/keystore.go:1074 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Regenerate or re-export the key with a correct secp256k1 PEM encoder","Confirm the file was not truncated or hand-edited","Use the correct --format for the file's actual encoding"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"329838acdfafae224582930457efe80aa217afc0","analyzedAt":"2026-09-03T18:30:52.135Z","contentChangedAt":"2026-09-03T18:30:52.135Z","schemaVersion":2},"datasetVersion":"2026-09-11T00:17:11.886Z"}