{"record":{"id":"121c2ddf5fc08549","repo":"TechnitiumSoftware/DnsServer","slug":"the-eddsa-keytype-dnssecprivatekeytype-keysi","errorCode":null,"errorMessage":"The EdDSA ({(keyType == DnssecPrivateKeyType.KeySigningKey ? \"KSK\" : \"ZSK\")}) private key must be for Ed25519 curve.","messagePattern":"The EdDSA \\((.+?)\\) private key must be for Ed25519 curve\\.","errorType":"exception","errorClass":"ArgumentException","httpStatus":null,"severity":"error","filePath":"DnsServerCore/Dns/Dnssec/DnssecPrivateKey.cs","lineNumber":264,"sourceCode":"                        return new DnssecEcdsaPrivateKey(algorithm, keyType, ecdsa.ExportParameters(true));\n                    }\n\n                case DnssecAlgorithm.ECDSAP384SHA384:\n                    using (ECDsa ecdsa = ECDsa.Create())\n                    {\n                        ecdsa.ImportFromPem(pemPrivateKey);\n\n                        if (ecdsa.KeySize != 384)\n                            throw new ArgumentException($\"The ECDSA ({(keyType == DnssecPrivateKeyType.KeySigningKey ? \"KSK\" : \"ZSK\")}) private key must have key size of 384 bits.\", nameof(pemPrivateKey));\n\n                        return new DnssecEcdsaPrivateKey(algorithm, keyType, ecdsa.ExportParameters(true));\n                    }\n\n                case DnssecAlgorithm.ED25519:\n                    using (PemReader pemReader = new PemReader(new StringReader(pemPrivateKey)))\n                    {\n                        if (pemReader.ReadObject() is not Ed25519PrivateKeyParameters privateKey)\n                            throw new ArgumentException($\"The EdDSA ({(keyType == DnssecPrivateKeyType.KeySigningKey ? \"KSK\" : \"ZSK\")}) private key must be for Ed25519 curve.\", nameof(pemPrivateKey));\n\n                        return new DnssecEddsaPrivateKey(keyType, privateKey);\n                    }\n\n                case DnssecAlgorithm.ED448:\n                    using (PemReader pemReader = new PemReader(new StringReader(pemPrivateKey)))\n                    {\n                        if (pemReader.ReadObject() is not Ed448PrivateKeyParameters privateKey)\n                            throw new ArgumentException($\"The EdDSA ({(keyType == DnssecPrivateKeyType.KeySigningKey ? \"KSK\" : \"ZSK\")}) private key must be for Ed448 curve.\", nameof(pemPrivateKey));\n\n                        return new DnssecEddsaPrivateKey(keyType, privateKey);\n                    }\n\n                default:\n                    throw new NotSupportedException(\"DNSSEC algorithm is not supported: \" + algorithm.ToString());\n            }\n        }\n","sourceCodeStart":246,"sourceCodeEnd":282,"githubUrl":"https://github.com/TechnitiumSoftware/DnsServer/blob/d0484b6c1e7439cdc53d67d81e9c876cda2ad756/DnsServerCore/Dns/Dnssec/DnssecPrivateKey.cs#L246-L282","documentation":"Thrown by DnssecPrivateKey.Create (PEM overload) for DnssecAlgorithm.ED25519 when the PEM does not decode to an Ed25519PrivateKeyParameters object. The library uses BouncyCastle's PemReader, so a PEM for the wrong curve (Ed448) or a non-EdDSA PEM fails the type pattern match.","triggerScenarios":"Calling Create(ED25519, keyType, pem) where pem is an Ed448 key, an EC key, or not a valid Ed25519 private key PEM.","commonSituations":"Mixing up Ed25519 and Ed448 key files; loading an EC/RSA PEM into the EdDSA branch; truncated or malformed PEM.","solutions":["Generate an Ed25519 key: openssl genpkey -algorithm Ed25519 -out key.pem.","If the PEM is actually Ed448, call Create with DnssecAlgorithm.ED448.","Confirm the PEM BEGIN line matches the expected key type (e.g. BEGIN PRIVATE KEY with Ed25519 OID)."],"exampleFix":"// before: pem is an Ed448 key\nvar key = DnssecPrivateKey.Create(DnssecAlgorithm.ED25519, kt, ed448Pem); // throws\n\n// after\nvar key = DnssecPrivateKey.Create(DnssecAlgorithm.ED448, kt, ed448Pem);","handlingStrategy":"validation","validationCode":"using var pr = new PemReader(new StringReader(pem));\nif (pr.ReadObject() is not Ed25519PrivateKeyParameters)\n    throw new InvalidOperationException(\"PEM is not an Ed25519 private key.\");\nvar key = DnssecPrivateKey.Create(DnssecAlgorithm.ED25519, keyType, pem);","typeGuard":"static bool PemIsEd25519(string pem)\n{\n    try { using var pr = new PemReader(new StringReader(pem)); return pr.ReadObject() is Ed25519PrivateKeyParameters; }\n    catch { return false; }\n}","tryCatchPattern":"try { return DnssecPrivateKey.Create(DnssecAlgorithm.ED25519, keyType, pem); }\ncatch (ArgumentException ex) when (ex.ParamName == nameof(pem))\n{ throw new InvalidOperationException(\"PEM is not Ed25519; verify the key or use ED448.\", ex); }","preventionTips":["Generate Ed25519 keys with: openssl genpkey -algorithm Ed25519.","Don't interchange Ed25519 and Ed448 PEMs.","Validate the PEM object type before calling Create."],"tags":["dns","dnssec","crypto","eddsa","ed25519","pem"],"backgroundTag":null,"analyzedSha":"d0484b6c1e7439cdc53d67d81e9c876cda2ad756","analyzedAt":"2026-08-13T22:57:35.508Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}