{"record":{"id":"390332b4b3434d18","repo":"TechnitiumSoftware/DnsServer","slug":"dnssec-private-key-version-not-supported-version","errorCode":null,"errorMessage":"DNSSEC private key version not supported: {version}","messagePattern":"DNSSEC private key version not supported: (.+?)","errorType":"exception","errorClass":"InvalidDataException","httpStatus":null,"severity":"error","filePath":"DnsServerCore/Dns/Dnssec/DnssecPrivateKey.cs","lineNumber":316,"sourceCode":"                        case DnssecAlgorithm.RSASHA1_NSEC3_SHA1:\n                        case DnssecAlgorithm.RSASHA256:\n                        case DnssecAlgorithm.RSASHA512:\n                            return new DnssecRsaPrivateKey(algorithm, bR, version);\n\n                        case DnssecAlgorithm.ECDSAP256SHA256:\n                        case DnssecAlgorithm.ECDSAP384SHA384:\n                            return new DnssecEcdsaPrivateKey(algorithm, bR, version);\n\n                        case DnssecAlgorithm.ED25519:\n                        case DnssecAlgorithm.ED448:\n                            return new DnssecEddsaPrivateKey(algorithm, bR, version);\n\n                        default:\n                            throw new NotSupportedException(\"DNSSEC algorithm is not supported: \" + algorithm.ToString());\n                    }\n\n                default:\n                    throw new InvalidDataException(\"DNSSEC private key version not supported: \" + version);\n            }\n        }\n\n        #endregion\n\n        #region protected\n\n        protected void InitDnsKey(DnssecPublicKey publicKey)\n        {\n            DnsDnsKeyFlag flags = DnsDnsKeyFlag.ZoneKey;\n\n            if (KeyType == DnssecPrivateKeyType.KeySigningKey)\n                flags |= DnsDnsKeyFlag.SecureEntryPoint;\n\n            if (_state == DnssecPrivateKeyState.Revoked)\n                flags |= DnsDnsKeyFlag.Revoke;\n\n            _dnsKey = new DnsDNSKEYRecordData(flags, 3, _algorithm, publicKey);","sourceCodeStart":298,"sourceCodeEnd":334,"githubUrl":"https://github.com/TechnitiumSoftware/DnsServer/blob/d0484b6c1e7439cdc53d67d81e9c876cda2ad756/DnsServerCore/Dns/Dnssec/DnssecPrivateKey.cs#L298-L334","documentation":"Thrown by the outer default branch of DnssecPrivateKey.ReadFrom when the version byte read after the magic is not 1 or 2. The format carries a version byte for forward compatibility; an unknown version means the file was written by a newer/incompatible version of the library and cannot be safely parsed by this one.","triggerScenarios":"ReadFrom on a key blob whose version byte (third byte) is anything other than 1 or 2.","commonSituations":"Downgrading: key file written by a newer library version that this older build doesn't recognize; corrupted version byte; file from an unrelated tool that happened to start with \"DK\".","solutions":["Upgrade this library to a version that understands the key file's version, or re-export the key on the current version.","Regenerate the DNSSEC key with the installed version and re-sign the zone.","Confirm the key file was produced by a compatible version of this library."],"exampleFix":"// before: key written by newer library (version 3)\nvar key = DnssecPrivateKey.ReadFrom(reader); // throws\n\n// after: regenerate with current version\nvar key = DnssecPrivateKey.Create(DnssecAlgorithm.ECDSAP256SHA256, kt);\n// then re-sign the zone and redistribute the new key","handlingStrategy":"validation","validationCode":"using var fs = File.OpenRead(path);\nusing var br = new BinaryReader(fs);\nbr.BaseStream.ReadExactly(stackalloc byte[2]); // skip \"DK\"\nint version = br.ReadByte();\nif (version is not (1 or 2))\n    throw new InvalidDataException($\"Key file version {version} is not supported by this build; upgrade or regenerate.\");\nbr.BaseStream.Seek(0, SeekOrigin.Begin);\nvar key = DnssecPrivateKey.ReadFrom(br);","typeGuard":"static bool IsSupportedKeyVersion(string path)\n{\n    try\n    {\n        using var fs = File.OpenRead(path);\n        using var br = new BinaryReader(fs);\n        br.BaseStream.ReadExactly(stackalloc byte[2]);\n        return br.ReadByte() is 1 or 2;\n    }\n    catch { return false; }\n}","tryCatchPattern":"try { return DnssecPrivateKey.ReadFrom(reader); }\ncatch (InvalidDataException ex) { throw new ConfigurationErrorsException(\"Key file version is unsupported; upgrade the library or regenerate the key.\", ex); }","preventionTips":["After a library upgrade, test that old key files still load before deploying.","Keep a note of which library version wrote each key file.","On downgrade scenarios, regenerate keys with the installed version."],"tags":["dns","dnssec","crypto","serialization","version","format"],"backgroundTag":null,"analyzedSha":"d0484b6c1e7439cdc53d67d81e9c876cda2ad756","analyzedAt":"2026-08-13T22:57:35.508Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}