{"record":{"id":"0a55ebb708ff41e3","repo":"shwenzhang/AndResGuard","slug":"not-an-rsa-ec-or-dsa-private-key","errorCode":null,"errorMessage":"Not an RSA, EC, or DSA private key","messagePattern":"Not an RSA, EC, or DSA private key","errorType":"exception","errorClass":"InvalidKeySpecException","httpStatus":null,"severity":"error","filePath":"AndResGuard-core/src/main/java/apksigner/ApkSignerTool.java","lineNumber":611,"sourceCode":"        throw lastKeySpecException;\n      }\n    }\n\n    private static PrivateKey loadPkcs8EncodedPrivateKey(PKCS8EncodedKeySpec spec)\n        throws InvalidKeySpecException, NoSuchAlgorithmException {\n      try {\n        return KeyFactory.getInstance(\"RSA\").generatePrivate(spec);\n      } catch (InvalidKeySpecException expected) {\n      }\n      try {\n        return KeyFactory.getInstance(\"EC\").generatePrivate(spec);\n      } catch (InvalidKeySpecException expected) {\n      }\n      try {\n        return KeyFactory.getInstance(\"DSA\").generatePrivate(spec);\n      } catch (InvalidKeySpecException expected) {\n      }\n      throw new InvalidKeySpecException(\"Not an RSA, EC, or DSA private key\");\n    }\n\n    private boolean isEmpty() {\n      return (name == null)\n             && (keystoreFile == null)\n             && (keystoreKeyAlias == null)\n             && (keystorePasswordSpec == null)\n             && (keyPasswordSpec == null)\n             && (keystoreType == null)\n             && (keystoreProviderName == null)\n             && (keystoreProviderClass == null)\n             && (keystoreProviderArg == null)\n             && (keyFile == null)\n             && (certFile == null)\n             && (v1SigFileBasename == null)\n             && (privateKey == null)\n             && (certs == null);\n    }","sourceCodeStart":593,"sourceCodeEnd":629,"githubUrl":"https://github.com/shwenzhang/AndResGuard/blob/e4df245d82f27d9a2d0dd108260a3510cbaba849/AndResGuard-core/src/main/java/apksigner/ApkSignerTool.java#L593-L629","documentation":"loadPkcs8EncodedPrivateKey tries to parse a decrypted PKCS#8 key spec using the RSA, EC, and DSA KeyFactory implementations in turn. If all three reject the spec with InvalidKeySpecException, it throws InvalidKeySpecException \"Not an RSA, EC, or DSA private key\". The decrypted key material is not a supported private-key algorithm for APK signing.","triggerScenarios":"Passing a --key file whose decrypted PKCS#8 content encodes an unsupported algorithm (e.g. Ed25519, or garbage/incorrect padding after a wrong decryption) so all three KeyFactory.generatePrivate calls fail.","commonSituations":"Using a modern key type like Ed25519 unsupported by the signer; providing a corrupted or truncated key file; supplying an RSA public key or certificate instead of a private key; a bad PKCS#8 conversion via openssl that produced a public key structure.","solutions":["Regenerate or export the signing key as RSA, EC, or DSA PKCS#8 (e.g. openssl pkcs8 -topk8 -nocrypt -in key.pem -out key.pk8).","Verify the key file is a PRIVATE KEY (PKCS#8), not a public key or certificate: openssl pkey -in key.pk8 -noout -text.","Confirm the key was fully decrypted (not still encrypted); check with `openssl pkcs8 -in key.pk8 -passin pass:...`.","Re-download/re-export the key if the file may be corrupted or truncated.","Switch to keystore-based signing (--ks) if the key algorithm cannot be converted."],"exampleFix":"// before\napksigner sign --key ed25519.key.pk8 --cert cert.x509.pem --out app.apk app-unsigned.apk\n// after\nopenssl pkcs8 -topk8 -nocrypt -in rsa_key.pem -out rsa_key.pk8\napksigner sign --key rsa_key.pk8 --cert cert.x509.pem --out app.apk app-unsigned.apk","handlingStrategy":"validation","validationCode":"java\n// Verify the key parses with a supported algorithm before signing\nbyte[] encoded = readFully(new File(keyFile));\ntry {\n    java.security.KeyFactory.getInstance(\"RSA\").generatePrivate(new PKCS8EncodedKeySpec(encoded));\n} catch (Exception e) {\n    throw new IllegalArgumentException(\"Key must be an RSA, EC, or DSA PKCS#8 private key\", e);\n}","typeGuard":"java\nboolean isSupportedPrivateKey(PrivateKey k) {\n    String alg = k.getAlgorithm();\n    return \"RSA\".equals(alg) || \"EC\".equals(alg) || \"DSA\".equals(alg);\n}","tryCatchPattern":"java\ntry {\n    signerBuilder.build().sign(outputFile);\n} catch (InvalidKeySpecException e) {\n    if (e.getMessage() != null && e.getMessage().contains(\"Not an RSA, EC, or DSA\")) {\n        System.err.println(\"Key file is not an RSA/EC/DSA PKCS#8 private key; re-export it.\");\n    } else {\n        throw e;\n    }\n}","preventionTips":["Generate signing keys as RSA (2048+) or EC; avoid Ed25519 and exotic algorithms for APK signing.","Sanity-check key files with `openssl pkey -in key.pk8 -noout -text` before use.","Ensure openssl conversion used `-topk8` so the output is PKCS#8 private-key format.","Checksum key files in pipelines to catch truncated/corrupted transfers."],"tags":["java","pkcs8","key-format","signing","unsupported-key"],"backgroundTag":"unsupported-operation","analyzedSha":"e4df245d82f27d9a2d0dd108260a3510cbaba849","analyzedAt":"2026-09-12T17:49:07.798Z","contentChangedAt":"2026-09-12T17:49:07.798Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}