{"record":{"id":"144eac6b44484ba6","repo":"gchq/CyberChef","slug":"couldn-t-verify-message-err","errorCode":null,"errorMessage":"Couldn't verify message: ${err}","messagePattern":"Couldn't verify message: (.+?)","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/operations/PGPDecryptAndVerify.mjs","lineNumber":118,"sourceCode":"                        }\n                        text += \"\\n\";\n                    }\n                    text += [\n                        `PGP key ID: ${km.get_pgp_short_key_id()}`,\n                        `PGP fingerprint: ${km.get_pgp_fingerprint().toString(\"hex\")}`,\n                        `Signed on ${new Date(ds.sig.when_generated() * 1000).toUTCString()}`,\n                        \"----------------------------------\\n\"\n                    ].join(\"\\n\");\n                    text += unboxedLiterals.toString();\n                    return text.trim();\n                } else {\n                    throw new OperationError(\"Could not identify a key manager.\");\n                }\n            } else {\n                throw new OperationError(\"The data does not appear to be signed.\");\n            }\n        } catch (err) {\n            throw new OperationError(`Couldn't verify message: ${err}`);\n        }\n    }\n\n}\n\nexport default PGPDecryptAndVerify;\n","sourceCodeStart":100,"sourceCodeEnd":125,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/operations/PGPDecryptAndVerify.mjs#L100-L125","documentation":"Outer catch around the entire unbox + verify block in PGPDecryptAndVerify (lines 79-119). It catches kbpgp.unbox failures AND the inner OperationErrors 'Could not identify a key manager' (529) and 'The data does not appear to be signed' (530), re-throwing all as 'Couldn't verify message: ${err}'. This is the message users actually see; the inner causes appear only inside the interpolated suffix.","triggerScenarios":"kbpgp.unbox rejects (corrupt message, decryption failure, no matching key); or one of the inner guards (no signature, no key manager) fires. Any of these surfaces as this wrapped error.","commonSituations":"Wrong or missing keys; unsigned data fed to a verify operation; malformed armoured input; signing key absent from the keyring; mismatched operation-to-message type.","solutions":["Read the interpolated err after the colon - it tells you which inner condition fired (no signature, no key manager, or a raw kbpgp error).","Ensure both the signer's public key and the recipient's private key are correct and supplied.","Confirm the input is an encrypted + signed message (not just encrypted or just signed).","Decrypt/verify locally with GnuPG to validate the message and keys first."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"if (!/-----BEGIN PGP PUBLIC KEY BLOCK-----/.test(publicKey)) throw new Error('Signer public key missing');\nif (!/-----BEGIN PGP PRIVATE KEY BLOCK-----/.test(privateKey)) throw new Error('Recipient private key missing');\nif (!/-----BEGIN PGP MESSAGE-----/.test(signedMessage)) throw new Error('Input is not an armoured PGP message');","typeGuard":null,"tryCatchPattern":"try {\n    out = await chef.PGPDecryptAndVerify(msg, [pub, priv, pass]);\n} catch (e) {\n    if (e instanceof OperationError && /Couldn't verify message/.test(e.message)) {\n        // e.message includes the inner cause - inspect the suffix\n    } else throw e;\n}","preventionTips":["Supply the correct signer public key and recipient private key.","Classify the message (encrypted / signed / both) before choosing the operation.","Remember the inner 'no signature' / 'no key manager' causes are wrapped here - read the suffix."],"tags":["pgp","kbpgp","signature","cryptography"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}