{"record":{"id":"3cfec82436064c85","repo":"jwtk/jjwt","slug":"familyname-keytype-keys-must-be-rsakey-insta","errorCode":null,"errorMessage":"${familyName} ${keyType} keys must be RSAKey instances.","messagePattern":"(.+?) (.+?) keys must be RSAKey instances\\.","errorType":"exception","errorClass":"InvalidKeyException","httpStatus":null,"severity":"error","filePath":"api/src/main/java/io/jsonwebtoken/SignatureAlgorithm.java","lineNumber":435,"sourceCode":"                ECKey ecKey = (ECKey) key;\n                int size = ecKey.getParams().getOrder().bitLength();\n                if (size < this.minKeyLength) {\n                    String msg = \"The \" + keyType(signing) + \" key's size (ECParameterSpec order) is \" + size +\n                            \" bits which is not secure enough for the \" + name() + \" algorithm.  The JWT \" +\n                            \"JWA Specification (RFC 7518, Section 3.4) states that keys used with \" +\n                            name() + \" MUST have a size >= \" + this.minKeyLength +\n                            \" bits.  Consider using the \" + Keys.class.getName() + \" class's \" +\n                            \"'keyPairFor(SignatureAlgorithm.\" + name() + \")' method to create a key pair guaranteed \" +\n                            \"to be secure enough for \" + name() + \".  See \" +\n                            \"https://tools.ietf.org/html/rfc7518#section-3.4 for more information.\";\n                    throw new WeakKeyException(msg);\n                }\n\n            } else { //RSA\n\n                if (!(key instanceof RSAKey)) {\n                    String msg = familyName + \" \" + keyType(signing) + \" keys must be RSAKey instances.\";\n                    throw new InvalidKeyException(msg);\n                }\n\n                RSAKey rsaKey = (RSAKey) key;\n                int size = rsaKey.getModulus().bitLength();\n                if (size < this.minKeyLength) {\n\n                    String section = name().startsWith(\"P\") ? \"3.5\" : \"3.3\";\n\n                    String msg = \"The \" + keyType(signing) + \" key's size is \" + size + \" bits which is not secure \" +\n                            \"enough for the \" + name() + \" algorithm.  The JWT JWA Specification (RFC 7518, Section \" +\n                            section + \") states that keys used with \" + name() + \" MUST have a size >= \" +\n                            this.minKeyLength + \" bits.  Consider using the \" + Keys.class.getName() + \" class's \" +\n                            \"'keyPairFor(SignatureAlgorithm.\" + name() + \")' method to create a key pair guaranteed \" +\n                            \"to be secure enough for \" + name() + \".  See \" +\n                            \"https://tools.ietf.org/html/rfc7518#section-\" + section + \" for more information.\";\n                    throw new WeakKeyException(msg);\n                }\n            }","sourceCodeStart":417,"sourceCodeEnd":453,"githubUrl":"https://github.com/jwtk/jjwt/blob/fb71496164c71442d08adec4571d9616ed5e1b8d/api/src/main/java/io/jsonwebtoken/SignatureAlgorithm.java#L417-L453","documentation":"Type guard in SignatureAlgorithm.assertValid: for RSA algorithms (RS256/384/512, PS256/384/512), the key must implement java.security.interfaces.RSAKey so the modulus bit length can be checked. A non-RSA key (e.g. an ECKey or SecretKey) reaching this branch throws InvalidKeyException.","triggerScenarios":"Thrown at api/src/main/java/io/jsonwebtoken/SignatureAlgorithm.java:435 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Supply an RSA key pair generated with Keys.keyPairFor(SignatureAlgorithm.RS256) or equivalent, at least 2048-bit modulus.","If the key is EC, switch to the ES* algorithm family instead.","Confirm signing uses the RSAPrivateKey and verification uses the RSAPublicKey from the same pair."],"exampleFix":null,"handlingStrategy":"type-guard","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"fb71496164c71442d08adec4571d9616ed5e1b8d","analyzedAt":"2026-09-09T00:33:09.982Z","contentChangedAt":"2026-09-09T00:33:09.982Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}