{"record":{"id":"1b57bd85aca72c32","repo":"jenkinsci/jenkins","slug":"unknown-public-key-type","errorCode":null,"errorMessage":"Unknown public key type: ","messagePattern":"Unknown public key type: ","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"core/src/main/java/hudson/cli/Connection.java","lineNumber":237,"sourceCode":"     *\n     * Cryptographic utility code.\n     */\n    public static byte[] fold(byte[] bytes, int size) {\n        byte[] r = new byte[size];\n        for (int i = Math.max(bytes.length, size) - 1; i >= 0; i--) {\n            r[i % r.length] ^= bytes[i % bytes.length];\n        }\n        return r;\n    }\n\n    private String detectKeyAlgorithm(KeyPair kp) {\n        return detectKeyAlgorithm(kp.getPublic());\n    }\n\n    private String detectKeyAlgorithm(PublicKey kp) {\n        if (kp instanceof RSAPublicKey)     return \"RSA\";\n        if (kp instanceof DSAPublicKey)     return \"DSA\";\n        throw new IllegalArgumentException(\"Unknown public key type: \" + kp);\n    }\n\n    /**\n     * Used in conjunction with {@link #verifyIdentity(byte[])} to prove\n     * that we actually own the private key of the given key pair.\n     */\n    public void proveIdentity(byte[] sharedSecret, KeyPair key) throws IOException, GeneralSecurityException {\n        String algorithm = detectKeyAlgorithm(key);\n        writeUTF(algorithm);\n        writeKey(key.getPublic());\n\n        Signature sig = Signature.getInstance(\"SHA1with\" + algorithm);\n        sig.initSign(key.getPrivate());\n        sig.update(key.getPublic().getEncoded());\n        sig.update(sharedSecret);\n        writeObject(sig.sign());\n    }\n","sourceCodeStart":219,"sourceCodeEnd":255,"githubUrl":"https://github.com/jenkinsci/jenkins/blob/2e228ff40b14dbc8b14ffbc6edf0e4383cf744fc/core/src/main/java/hudson/cli/Connection.java#L219-L255","documentation":"`Connection.detectKeyAlgorithm(PublicKey)` only recognizes RSA (`RSAPublicKey`) and DSA (`DSAPublicKey`) and throws IllegalArgumentException for any other key type. It is used by `proveIdentity`/`verifyIdentity` during CLI public-key authentication to pick the `SHA1with<algorithm>` Signature. Passing an EC, EdDSA, or other key pair is unsupported by this code path.","triggerScenarios":"Configuring Jenkins CLI SSH/public-key auth with a key pair whose public key is neither RSA nor DSA (e.g. an ECDSA `ECParameterSpec` key, or an Ed25519 key from newer OpenSSH), then connecting in a way that triggers proveIdentity. The algorithm detection fails before signing.","commonSituations":"Modern OpenSSH defaults generating Ed25519 keys; users copy those into Jenkins CLI auth; or a Java keypair generator defaulting to EC. RSA/DSA were the historically supported types.","solutions":["Generate and register an RSA key pair for Jenkins CLI authentication: `ssh-keygen -t rsa -b 4096` and add the public key to your Jenkins user.","If you must use the existing key, confirm its type; convert/regenerate as RSA or DSA since detectKeyAlgorithm supports only those.","Patch detectKeyAlgorithm (if you maintain a fork) to handle EC/EdDSA and the corresponding Signature algorithms."],"exampleFix":"// before: Ed25519/EC key -> 'Unknown public key type'\n//   ssh-keygen -t ed25519 -f ~/.ssh/jenkins_ed25519\n//   java -jar jenkins-cli.jar -ssh -user me -i ~/.ssh/jenkins_ed25519 help\n//\n// after: use RSA which detectKeyAlgorithm accepts\n//   ssh-keygen -t rsa -b 4096 -f ~/.ssh/jenkins_rsa\n//   # add ~/.ssh/jenkins_rsa.pub to Jenkins user > Configure > SSH Public Keys\n//   java -jar jenkins-cli.jar -ssh -user me -i ~/.ssh/jenkins_rsa help","handlingStrategy":"validation","validationCode":"// Only RSA/DSA keys are supported by Connection.detectKeyAlgorithm:\nPublicKey pub = keyPair.getPublic();\nif (!(pub instanceof RSAPublicKey) && !(pub instanceof DSAPublicKey)) {\n    throw new IllegalArgumentException(\n        \"Jenkins CLI auth requires an RSA or DSA key, got: \" + pub.getAlgorithm());\n}\n// proceed to proveIdentity(...)","typeGuard":"// Type guard narrowing to supported key types\npublic static boolean isSupportedCliKey(KeyPair kp) {\n    PublicKey p = kp.getPublic();\n    return p instanceof RSAPublicKey || p instanceof DSAPublicKey;\n}","tryCatchPattern":null,"preventionTips":["Use RSA (or DSA) keys for Jenkins CLI SSH/public-key authentication; avoid Ed25519/EC.","Document the RSA/DSA requirement wherever CLI auth keys are provisioned."],"tags":["jenkins","cli","security","cryptography","ssh","authentication"],"backgroundTag":null,"analyzedSha":"2e228ff40b14dbc8b14ffbc6edf0e4383cf744fc","analyzedAt":"2026-08-14T07:07:15.274Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}