{"record":{"id":"02822a815035dca0","repo":"OpenNHP/opennhp","slug":"invalid-input-key-02822a","errorCode":null,"errorMessage":"invalid input key","messagePattern":"invalid input key","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"endpoints/db/main/main.go","lineNumber":183,"sourceCode":"\t\t},\n\t\tAction: func(c *cli.Context) error {\n\t\t\tprivKey, err := base64.StdEncoding.DecodeString(c.Args().First())\n\t\t\tif err != nil {\n\t\t\t\tif c.Bool(\"json\") {\n\t\t\t\t\tjson.NewEncoder(os.Stdout).Encode(map[string]interface{}{\n\t\t\t\t\t\t\"error\": err.Error(),\n\t\t\t\t\t})\n\t\t\t\t\treturn nil\n\t\t\t\t}\n\t\t\t\treturn err\n\t\t\t}\n\t\t\tcipherType := core.ECC_SM2\n\t\t\tif c.Bool(\"curve\") {\n\t\t\t\tcipherType = core.ECC_CURVE25519\n\t\t\t}\n\t\t\te := core.ECDHFromKey(cipherType, privKey)\n\t\t\tif e == nil {\n\t\t\t\terr := fmt.Errorf(\"invalid input key\")\n\t\t\t\tif c.Bool(\"json\") {\n\t\t\t\t\tjson.NewEncoder(os.Stdout).Encode(map[string]interface{}{\n\t\t\t\t\t\t\"error\": err.Error(),\n\t\t\t\t\t})\n\t\t\t\t\treturn nil\n\t\t\t\t}\n\t\t\t\treturn err\n\t\t\t}\n\t\t\tpub := e.PublicKeyBase64()\n\t\t\tif c.Bool(\"json\") {\n\t\t\t\tjson.NewEncoder(os.Stdout).Encode(map[string]string{\n\t\t\t\t\t\"publicKey\": pub,\n\t\t\t\t})\n\t\t\t} else {\n\t\t\t\tfmt.Println(\"Public key: \", pub)\n\t\t\t}\n\t\t\treturn nil\n\t\t},","sourceCodeStart":165,"sourceCodeEnd":201,"githubUrl":"https://github.com/OpenNHP/opennhp/blob/6e04ca5ff03222a699c24205cd4bf8fee9af7ffe/endpoints/db/main/main.go#L165-L201","documentation":"The `nhp-device pubkey` command decodes the first positional argument as a base64 private key and passes the raw bytes to core.ECDHFromKey for the chosen cipher (SM2 by default, Curve25519 with --curve). ECDHFromKey returns nil when the bytes are not a valid private key scalar for that curve, and the command reports 'invalid input key'.","triggerScenarios":"Running `nhp-device pubkey <base64-key>` where the decoded bytes are the wrong length or otherwise invalid for the selected ECC type — e.g. a Curve25519 key passed with default SM2 mode, a truncated key, a public key pasted instead of a private key, or whitespace/corruption in the base64.","commonSituations":"Copying a key between cipher schemes (mixing --curve and --sm2 output); pasting a public key where a private key is expected; shell mangling of the argument; hand-crafted test keys that are not valid scalars.","solutions":["Regenerate the key with `nhp-device keygen --curve` or `--sm2` and pass its privateKey output verbatim","Match the cipher flag to the key's origin: use --curve only for Curve25519 keys, omit it (SM2) only for SM2 keys","Confirm you are passing the private key, not the public key, as the positional argument","Quote the key argument so shells do not split or alter it"],"exampleFix":"// before\nnhp-device pubkey <curve25519-privkey>          # parsed as SM2, fails\n// after\nnhp-device pubkey --curve <curve25519-privkey>","handlingStrategy":"validation","validationCode":"const buf = Buffer.from(keyArg, 'base64');\nif (buf.length === 0 || buf.toString('base64') !== keyArg.replace(/\\s/g,'')) {\n  throw new Error('argument is not valid standard base64 key material');\n}\n// length must match the cipher: e.g. 32 bytes for Curve25519","typeGuard":"const looksLikeBase64Key = (s) => typeof s === 'string' && /^[A-Za-z0-9+/]+={0,2}$/.test(s.trim()) && Buffer.from(s, 'base64').length > 0;","tryCatchPattern":"try {\n  execSync(`nhp-device pubkey ${cipherFlag} ${key}`);\n} catch (e) {\n  if (String(e.stderr).includes('invalid input key')) {\n    // regenerate or re-select the cipher flag before retrying\n  }\n}","preventionTips":["Always take keys verbatim from `nhp-device keygen --json` output","Track which cipher (--curve/--sm2) each key belongs to","Never pass public keys to the pubkey command; it expects a private key","Quote key arguments in shell scripts"],"tags":["cli","cryptography","keys"],"backgroundTag":"invalid-argument-format","analyzedSha":"6e04ca5ff03222a699c24205cd4bf8fee9af7ffe","analyzedAt":"2026-09-07T15:44:59.941Z","contentChangedAt":"2026-09-07T15:44:59.941Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}