{"record":{"id":"39e68968d381df89","repo":"gchq/CyberChef","slug":"provided-key-is-not-a-public-key","errorCode":null,"errorMessage":"Provided key is not a public key.","messagePattern":"Provided key is not a public key\\.","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/operations/ECDSAVerify.mjs","lineNumber":151,"sourceCode":"                    throw new OperationError('No \"r\" value in the signature JSON');\n                }\n                if (!inputJson.s) {\n                    throw new OperationError('No \"s\" value in the signature JSON');\n                }\n                signatureASN1Hex = r.KJUR.crypto.ECDSA.hexRSSigToASN1Sig(inputJson.r, inputJson.s);\n                break;\n            }\n        }\n\n        // verify signature\n        const internalAlgorithmName = mdAlgo.replace(\"-\", \"\") + \"withECDSA\";\n        const sig = new r.KJUR.crypto.Signature({ alg: internalAlgorithmName });\n        const key = r.KEYUTIL.getKey(keyPem);\n        if (key.type !== \"EC\") {\n            throw new OperationError(\"Provided key is not an EC key.\");\n        }\n        if (!key.isPublic) {\n            throw new OperationError(\"Provided key is not a public key.\");\n        }\n        sig.init(key);\n        const messageStr = Utils.convertToByteString(msg, msgFormat);\n        sig.updateString(messageStr);\n        const result = sig.verify(signatureASN1Hex);\n        return result ? \"Verified OK\" : \"Verification Failure\";\n    }\n}\n\nexport default ECDSAVerify;\n","sourceCodeStart":133,"sourceCodeEnd":162,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/operations/ECDSAVerify.mjs#L133-L162","documentation":"Thrown in ECDSAVerify.run when the EC key has !key.isPublic. The previous guard already ensured key.type === 'EC'; this one requires the public half for verification. A private EC key parses fine but has isPublic === false, so verification with it is rejected (the operation enforces public-key usage even though jsrsasign could technically verify with a private key).","triggerScenarios":"The user pasted an EC PRIVATE key into the public-key field. key.type === 'EC' passes, but isPublic is false.","commonSituations":"Mixing up private and public keys when verifying; pasting the signer's private key instead of the public key.","solutions":["Paste the EC PUBLIC key PEM (-----BEGIN PUBLIC KEY-----).","If you intend to sign, use ECDSA Sign with the private key instead.","Derive the public key from the private key if needed (openssl ec -pubout)."],"exampleFix":"// before: EC private key (isPublic === false)\nconst key = ecPrivateKeyPem;\n// after: EC public key\nconst key = ecPublicKeyPem; // key.isPublic === true","handlingStrategy":"validation","validationCode":"import r from \"jsrsasign\";\nconst key = r.KEYUTIL.getKey(keyPem);\nif (key.type === \"EC\" && !key.isPublic) throw new Error(\"provided EC key is private; verification needs the public key\");","typeGuard":"const isEcPublicKey = (k) => k && k.type === \"EC\" && k.isPublic === true;","tryCatchPattern":null,"preventionTips":["Use the public key for verify, the private key for sign; label them clearly.","Derive the public key from the private one (openssl ec -pubout) if only the private key is on hand."],"tags":["crypto","ecdsa","key-validation","jsrsasign","operation-error"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}