{"record":{"id":"33c08d628ae1bbc6","repo":"ipfs/kubo","slug":"unsupported-ec-private-key-version-d","errorCode":null,"errorMessage":"unsupported EC private key version %d","messagePattern":"unsupported EC private key version (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/commands/keystore.go","lineNumber":1071,"sourceCode":"\t}\n\tvar curve asn1.ObjectIdentifier\n\tif _, err := asn1.Unmarshal(wrapper.Algo.Parameters.FullBytes, &curve); err != nil {\n\t\treturn false\n\t}\n\treturn curve.Equal(oidNamedCurveSecp256k1)\n}\n\nfunc parseSecp256k1PrivateKey(der []byte) (*secp256k1.PrivateKey, error) {\n\tvar wrapper pkcs8Key\n\tif _, err := asn1.Unmarshal(der, &wrapper); err != nil {\n\t\treturn nil, err\n\t}\n\tvar ec ecPrivateKey\n\tif _, err := asn1.Unmarshal(wrapper.PrivateKey, &ec); err != nil {\n\t\treturn nil, fmt.Errorf(\"invalid EC private key: %w\", err)\n\t}\n\tif ec.Version != 1 {\n\t\treturn nil, fmt.Errorf(\"unsupported EC private key version %d\", ec.Version)\n\t}\n\tif len(ec.PrivateKey) > 32 {\n\t\treturn nil, errors.New(\"invalid EC private key length\")\n\t}\n\tvar buf [32]byte\n\tcopy(buf[32-len(ec.PrivateKey):], ec.PrivateKey)\n\tvar scalar secp256k1.ModNScalar\n\tif overflow := scalar.SetBytes(&buf); overflow != 0 || scalar.IsZero() {\n\t\treturn nil, errors.New(\"EC private key not in the valid range for secp256k1\")\n\t}\n\treturn secp256k1.NewPrivateKey(&scalar), nil\n}\n","sourceCodeStart":1053,"sourceCodeEnd":1084,"githubUrl":"https://github.com/ipfs/kubo/blob/329838acdfafae224582930457efe80aa217afc0/core/commands/keystore.go#L1053-L1084","documentation":"The ASN.1 ecPrivateKey structure carries a version field that must be 1 (ecPrivateKeyVersion) for secp256k1 keys. parseSecp256k1PrivateKey rejects any other version with \"unsupported EC private key version %d\", including the numeric version in the message. This guards against parsing structures that decode as ASN.1 but are not valid EC private keys.","triggerScenarios":"Importing a DER blob whose inner structure decodes as ecPrivateKey but with a version other than 1 — often a mis-parsed wrapper or a key from an exotic/nonstandard encoder.","commonSituations":"Keys exported by nonstandard tools; manually crafted ASN.1; wrong offset parsing of a compound structure that coincidentally decodes; very old or proprietary wallet export formats.","solutions":["Re-export the key in standard PKCS#8 (`openssl pkcs8 -topk8 -nocrypt -in key.pem`)","Verify the key with `openssl asn1parse -in key.pem` and confirm version INTEGER is 1","Ensure the curve is secp256k1 and the file is PEM/DER PKCS#8 as documented for `ipfs key import`"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"openssl asn1parse -in key.pem | grep 'INTEGER.*:01' || echo \"EC version field not 1 - re-export the key\"","typeGuard":null,"tryCatchPattern":"key, err := parseSecp256k1PrivateKey(der)\nif err != nil && strings.Contains(err.Error(), \"unsupported EC private key version\") {\n    // key came from a nonstandard encoder; re-export via openssl pkcs8\n}","preventionTips":["Only import keys produced by standard tooling (openssl, libp2p)","Reject key files from proprietary wallets unless re-exported to PKCS#8","Pin your key-export tooling/versions in scripts"],"tags":["crypto","asn1","secp256k1","key-import"],"backgroundTag":"invalid-private-key-format","analyzedSha":"329838acdfafae224582930457efe80aa217afc0","analyzedAt":"2026-09-03T18:30:52.135Z","contentChangedAt":"2026-09-03T18:30:52.135Z","schemaVersion":2},"datasetVersion":"2026-09-11T00:17:11.886Z"}