{"record":{"id":"0d799b1610ecff4d","repo":"slackhq/nebula","slug":"unknown-public-key-length-d","errorCode":null,"errorMessage":"unknown public key length: %d","messagePattern":"unknown public key length: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkclient/pkclient_cgo.go","lineNumber":228,"sourceCode":"\t}\n\tc.pubKeyObj, err = c.findDeriveKey(c.id, c.label, false)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"pkcs11 module gave us a nil CKA_PUBLIC_KEY_INFO, and looking up the public key also failed: %w\", err)\n\t}\n\td, err = c.pubKeyObj.Attribute(pkcs11.CKA_EC_POINT)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"pkcs11 module gave us a nil CKA_PUBLIC_KEY_INFO, and reading CKA_EC_POINT also failed: %w\", err)\n\t}\n\tif d == nil || len(d) < 1 {\n\t\treturn nil, fmt.Errorf(\"pkcs11 module gave us a nil or empty CKA_EC_POINT\")\n\t}\n\tswitch len(d) {\n\tcase 65: //length of 0x04 + len(X) + len(Y)\n\t\treturn d, nil\n\tcase 67: //as above, DER-encoded IIRC?\n\t\treturn d[2:], nil\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"unknown public key length: %d\", len(d))\n\t}\n}\n","sourceCodeStart":210,"sourceCodeEnd":231,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/pkclient/pkclient_cgo.go#L210-L231","documentation":"GetPubKey accepts EC points of 65 bytes (raw uncompressed 0x04 || X || Y for P-256) or 67 bytes (same point with a 2-byte DER header, which it strips). Any other length means the token returned an unrecognized EC point encoding, so this error is thrown with the actual length.","triggerScenarios":"Calling GetPubKey when CKA_EC_POINT has a length other than 65 or 67 — e.g. a compressed point (33 bytes), a point with a DER BIT STRING wrapper of a different length, or trailing garbage added by the module.","commonSituations":"HSM configured for point compression; curves other than P-256 (e.g. P-384 producing 97-byte points) used with this client; vendor module wrapping the point in an unexpected encoding; corruption between token and client.","solutions":["Configure the HSM to emit uncompressed EC points (disable point compression).","Ensure the certificate/key uses the P-256 curve — other curves yield different point lengths.","Inspect the returned bytes and, if the module adds a fixed header, adjust provisioning rather than the client.","Regenerate the keypair with standard uncompressed encoding."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Only expect P-256 uncompressed points (65) or DER-wrapped (67)\nfunc expectP256Point(d []byte) error {\n  switch len(d) {\n  case 65, 67: return nil\n  default: return fmt.Errorf(\"token returned %d-byte EC point; configure uncompressed P-256\", len(d))\n  }\n}","typeGuard":null,"tryCatchPattern":"pub, err := client.GetPubKey()\nif err != nil {\n  var lenErr interface{ Error() string }\n  if errors.As(err, &lenErr) && strings.Contains(err.Error(), \"unknown public key length\") {\n    return fmt.Errorf(\"HSM point compression or non-P256 curve in use; fix token config: %w\", err)\n  }\n  return err\n}","preventionTips":["Disable EC point compression on the HSM.","Use only P-256 keys with this client (other curves produce different point lengths).","Provision keys with uncompressed public point encoding.","Catch this in staging by calling GetPubKey and validating len==65 before rollout."],"tags":["pkcs11","ec-point","encoding","curve"],"backgroundTag":"unexpected-ec-point-encoding","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}