{"record":{"id":"37d7eac4ba898a1b","repo":"rustdesk/rustdesk-server","slug":"invalid-public-key-37d7ea","errorCode":null,"errorMessage":"Invalid Public key","messagePattern":"Invalid Public key","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/utils.rs","lineNumber":56,"sourceCode":"        bail!(\"Invalid secret key\");\n    }\n    let sk1 = sk1.unwrap();\n\n    let secret_key = sign::SecretKey::from_slice(sk1.as_slice());\n    if secret_key.is_none() {\n        bail!(\"Invalid Secret key\");\n    }\n    let secret_key = secret_key.unwrap();\n\n    let pk1 = base64::decode(pk);\n    if pk1.is_err() {\n        bail!(\"Invalid public key\");\n    }\n    let pk1 = pk1.unwrap();\n\n    let public_key = sign::PublicKey::from_slice(pk1.as_slice());\n    if public_key.is_none() {\n        bail!(\"Invalid Public key\");\n    }\n    let public_key = public_key.unwrap();\n\n    let random_data_to_test = b\"This is meh.\";\n    let signed_data = sign::sign(random_data_to_test, &secret_key);\n    let verified_data = sign::verify(&signed_data, &public_key);\n    if verified_data.is_err() {\n        bail!(\"Key pair is INVALID\");\n    }\n    let verified_data = verified_data.unwrap();\n\n    if random_data_to_test != &verified_data[..] {\n        bail!(\"Key pair is INVALID\");\n    }\n\n    Ok(())\n}\n","sourceCodeStart":38,"sourceCodeEnd":74,"githubUrl":"https://github.com/rustdesk/rustdesk-server/blob/a7736be5e40f85bfc141120dce587e836e5d4b80/src/utils.rs#L38-L74","documentation":"The decoded public key is passed to sign::PublicKey::from_slice; Ed25519 public keys must be exactly 32 bytes, so a wrong-length decoded buffer yields None and the code bails with \"Invalid Public key\". The input was valid base64 but not a valid Ed25519 public key.","triggerScenarios":"A base64 argument that decodes to a byte length other than 32 - e.g. a secret key (64 bytes) pasted into the public-key slot, or a truncated/padded-incorrect key.","commonSituations":"Swapping -k and -K arguments; using a keypair from a different algorithm; hand-truncating the key; key generated with different encoding (hex).","solutions":["Pass the PUBLIC key (decodes to exactly 32 bytes) to the public-key argument.","Check decoded length: `echo '<pk>' | base64 -d | wc -c` must print 32.","Use the matching pair from the same generated key file rather than mixing keys from different pairs."],"exampleFix":"// before: 64-byte secret key in the public slot\n-K '<64-byte-base64-secret-key>'\n// after: 32-byte public key\n-K '<32-byte-base64-public-key>'","handlingStrategy":"validation","validationCode":"let decoded = base64::decode(pk.trim())?;\nassert_eq!(decoded.len(), 32, \"Ed25519 public key must decode to 32 bytes, got {}\", decoded.len());","typeGuard":"fn is_public_key_b64(s: &str) -> bool { base64::decode(s).map(|b| b.len() == 32).unwrap_or(false) }","tryCatchPattern":null,"preventionTips":["Never paste a 64-byte secret key into the public-key slot; check decoded length is 32.","Keep keypair halves in paired files generated together.","Validate keys with a local length check before running the server tooling."],"tags":["base64","ed25519","key-validation","cryptography"],"backgroundTag":"invalid-argument-format","analyzedSha":"a7736be5e40f85bfc141120dce587e836e5d4b80","analyzedAt":"2026-09-09T21:56:29.933Z","contentChangedAt":"2026-09-09T21:56:29.933Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}