{"record":{"id":"02a6b0cd25d66cae","repo":"shwenzhang/AndResGuard","slug":"private-key-is-not-a-dsa-or-rsa-key","errorCode":null,"errorMessage":"private key is not a DSA or RSA key","messagePattern":"private key is not a DSA or RSA key","errorType":"exception","errorClass":"java.lang.RuntimeException","httpStatus":null,"severity":"error","filePath":"AndResGuard-core/src/main/java/com/tencent/mm/androlib/ResourceApkBuilder.java","lineNumber":186,"sourceCode":"  private String getSignatureAlgorithm(String hash) throws Exception {\n    String signatureAlgorithm;\n    KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());\n    FileInputStream fileIn = new FileInputStream(config.mSignatureFile);\n    keyStore.load(fileIn, config.mStorePass.toCharArray());\n    Key key = keyStore.getKey(config.mStoreAlias, config.mKeyPass.toCharArray());\n    if (key == null) {\n      throw new RuntimeException(\"Can't get private key, please check if storepass storealias and keypass are correct\");\n    }\n    String keyAlgorithm = key.getAlgorithm();\n    hash = formatHashAlgorithName(hash);\n    if (keyAlgorithm.equalsIgnoreCase(\"DSA\")) {\n      keyAlgorithm = \"DSA\";\n    } else if (keyAlgorithm.equalsIgnoreCase(\"RSA\")) {\n      keyAlgorithm = \"RSA\";\n    } else if (keyAlgorithm.equalsIgnoreCase(\"EC\")) {\n      keyAlgorithm = \"ECDSA\";\n    } else {\n      throw new RuntimeException(\"private key is not a DSA or RSA key\");\n    }\n    signatureAlgorithm = String.format(\"%swith%s\", hash, keyAlgorithm);\n    return signatureAlgorithm;\n  }\n\n  private String formatHashAlgorithName(String hash) {\n    return hash.replace(\"-\", \"\");\n  }\n\n  private void signApkV1(File unSignedApk, File signedApk) throws IOException, InterruptedException {\n    if (config.mUseSignAPK) {\n      System.out.printf(\"signing apk: %s\\n\", signedApk.getName());\n      if (signedApk.exists()) {\n        signedApk.delete();\n      }\n      signWithV1sign(unSignedApk, signedApk);\n      if (!signedApk.exists()) {\n        throw new IOException(\"Can't Generate signed APK. Plz check your v1sign info is correct.\");","sourceCodeStart":168,"sourceCodeEnd":204,"githubUrl":"https://github.com/shwenzhang/AndResGuard/blob/e4df245d82f27d9a2d0dd108260a3510cbaba849/AndResGuard-core/src/main/java/com/tencent/mm/androlib/ResourceApkBuilder.java#L168-L204","documentation":"This RuntimeException is thrown by getSignatureAlgorithm when the private key loaded from the keystore has an algorithm other than DSA, RSA, or EC. The library builds a jarsigner signature algorithm string (e.g. 'SHA1withRSA') from the key algorithm and only supports those three; any other key type (or an unrecognizable algorithm name) makes it impossible to construct a valid v1 signing algorithm, so it fails fast.","triggerScenarios":"Calling buildApkWithV1sign with a keystore whose alias resolves to a private key whose getAlgorithm() is not DSA/RSA/EC — e.g. an Elliptic Curve key stored under a non-standard name, a HSM/PKCS11 key, or a key with an unusual algorithm identifier.","commonSituations":"Signing with a modern keystore generated with exotic key algorithms (e.g. Ed25519, X25519, or P-384 keys reported under names other than 'EC'); using a hardware-backed or PKCS12 entry whose algorithm string differs from what the JCE reports; switching to a new release keystore that is not RSA.","solutions":["Regenerate or export the signing key as RSA (keytool -genkeypair -keyalg RSA) and update the keystore used by AndResGuard","Switch to v2/v3 signing (buildApkWithV2V3Sign path), which uses apksigner and does not depend on this algorithm whitelist","Check the actual algorithm of the alias with keytool -list -keystore your.keystore and confirm it is RSA/DSA/EC","If the key is EC but reported under another name, patch/rebuild with support for that algorithm string"],"exampleFix":"// before: EC key named 'ECDSA' or Ed25519 key in keystore\n// after: regenerate an RSA key\nkeytool -genkeypair -v -keystore release.keystore -alias appkey \\\n  -keyalg RSA -keysize 2048 -validity 10000","handlingStrategy":"validation","validationCode":"KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());\ntry (FileInputStream in = new FileInputStream(sigFile)) { ks.load(in, storePass.toCharArray()); }\nKey key = ks.getKey(alias, keyPass.toCharArray());\nString alg = key == null ? null : key.getAlgorithm();\nboolean ok = alg != null && (alg.equalsIgnoreCase(\"RSA\") || alg.equalsIgnoreCase(\"DSA\") || alg.equalsIgnoreCase(\"EC\"));\nif (!ok) throw new IllegalStateException(\"Keystore alias '\" + alias + \"' key algorithm not supported for v1 signing: \" + alg);","typeGuard":"boolean isSupportedSigningKey(java.security.Key k) {\n  if (k == null) return false;\n  String a = k.getAlgorithm();\n  return \"RSA\".equalsIgnoreCase(a) || \"DSA\".equalsIgnoreCase(a) || \"EC\".equalsIgnoreCase(a);\n}","tryCatchPattern":null,"preventionTips":["Generate release keys with -keyalg RSA (default, most compatible)","Inspect keystore aliases with keytool -list before wiring up signing config","Prefer v2/v3 signing (apksigner) for modern keys; use v1 only with RSA/DSA keys"],"tags":["java","signing","keystore","apk"],"backgroundTag":"invalid-config-value","analyzedSha":"e4df245d82f27d9a2d0dd108260a3510cbaba849","analyzedAt":"2026-09-12T17:49:07.798Z","contentChangedAt":"2026-09-12T17:49:07.798Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}