{"record":{"id":"27616017a236d0f4","repo":"grafana/k6","slug":"curve-not-supported-for-converting-to-ecdsa-key","errorCode":null,"errorMessage":"curve not supported for converting to ECDSA key","messagePattern":"curve not supported for converting to ECDSA key","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/js/modules/k6/webcrypto/elliptic_curve.go","lineNumber":706,"sourceCode":"\t}\n\n\treturn &ecdsa.PrivateKey{\n\t\tPublicKey: *pk,\n\t\tD:         new(big.Int).SetBytes(k.Bytes()),\n\t}, nil\n}\n\nfunc convertPublicECDHtoECDSA(k *ecdh.PublicKey) (*ecdsa.PublicKey, error) {\n\tvar crv elliptic.Curve\n\tswitch k.Curve() {\n\tcase ecdh.P256():\n\t\tcrv = elliptic.P256()\n\tcase ecdh.P384():\n\t\tcrv = elliptic.P384()\n\tcase ecdh.P521():\n\t\tcrv = elliptic.P521()\n\tdefault:\n\t\treturn nil, errors.New(\"curve not supported for converting to ECDSA key\")\n\t}\n\n\tx, y := elliptic.Unmarshal(crv, k.Bytes()) //nolint:staticcheck // we need to use the Unmarshal function\n\tif x == nil {\n\t\treturn nil, fmt.Errorf(\"unable to convert ECDH public key to ECDSA public key, curve: %s\", crv.Params().Name)\n\t}\n\n\treturn &ecdsa.PublicKey{\n\t\tCurve: crv,\n\t\tX:     x,\n\t\tY:     y,\n\t}, nil\n}\n\nfunc ensureKeysUseSameCurve(k1, k2 CryptoKey) error {\n\tecAlg1, ok1 := k1.Algorithm.(EcKeyAlgorithm)\n\tecAlg2, ok2 := k2.Algorithm.(EcKeyAlgorithm)\n\tif !ok1 || !ok2 {","sourceCodeStart":688,"sourceCodeEnd":724,"githubUrl":"https://github.com/grafana/k6/blob/93accf6570dcd306ca5e99cc44c393ee3797761b/internal/js/modules/k6/webcrypto/elliptic_curve.go#L688-L724","documentation":"When an ECDH key is exported to JWK, k6 must internally represent it as an ECDSA-style key to fill the x/y/crv fields (exportECJWK in webcrypto/jwk.go:196). convertPublicECDHtoECDSA (internal/js/modules/k6/webcrypto/elliptic_curve.go:696) only maps the three NIST curves (P-256/P-384/P-521) from ecdh to elliptic; an ECDH key on any other curve (e.g. X25519) returns \"curve not supported for converting to ECDSA key\", wrapped as \"failed to convert ECDH key to ECDSA key: ...\".","triggerScenarios":"`crypto.subtle.exportKey('jwk', ecdhKey)` where the ECDH key uses a non-NIST curve such as X25519. Because k6's own generate/import paths only create NIST-curve ECDH keys (pickECDHCurve rejects others), this is primarily a defensive branch.","commonSituations":"Practically limited to custom builds, imported keys with unusual internal state, or future curve support gaps; stock k6 rejects non-NIST ECDH curves earlier with \"invalid ECDH curve\".","solutions":["Generate ECDH keys with namedCurve 'P-256'/'P-384'/'P-521' in k6","Re-import the key inside k6 from its raw/JWK form so it goes through k6's own validation","If it persists on stock k6, file an issue with the script and key (public parts only)"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"const SUPPORTED_ECDH_CURVES = ['P-256', 'P-384', 'P-521'];\nif (key.algorithm.name === 'ECDH' && !SUPPORTED_ECDH_CURVES.includes(key.algorithm.namedCurve)) {\n  throw new Error('cannot JWK-export an ECDH key on a non-NIST curve');\n}","typeGuard":"const isSupportedCurve = (c) => ['P-256', 'P-384', 'P-521'].includes(c);","tryCatchPattern":"try {\n  jwk = await crypto.subtle.exportKey('jwk', ecdhKey);\n} catch (e) {\n  if (String(e.message).includes('curve not supported')) throw new Error('regenerate the ECDH key on P-256/P-384/P-521 before JWK export');\n  throw e;\n}","preventionTips":["Generate all ECDH keys inside k6 with NIST named curves","Do not hand-construct ECDH CryptoKey state or import keys from unvalidated sources","Treat this error as near-internal: verify key provenance, then report if it persists"],"tags":["webcrypto","ecdh","jwk","export","internal"],"backgroundTag":null,"analyzedSha":"93accf6570dcd306ca5e99cc44c393ee3797761b","analyzedAt":"2026-08-15T21:23:27.118Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}