{"record":{"id":"3f55fe8f3ba02066","repo":"spring-projects/spring-security","slug":"only-rsa-is-currently-supported-but-algorithm-was","errorCode":null,"errorMessage":"Only RSA is currently supported, but algorithm was ","messagePattern":"Only RSA is currently supported, but algorithm was ","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"crypto/src/main/java/org/springframework/security/crypto/encrypt/RsaKeyHelper.java","lineNumber":178,"sourceCode":"\t\tcatch (NoSuchAlgorithmException ex) {\n\t\t\tthrow new IllegalStateException(ex);\n\t\t}\n\n\t}\n\n\tprivate static final Pattern SSH_PUB_KEY = Pattern.compile(\"ssh-(rsa|dsa) ([A-Za-z0-9/+]+=*) (.*)\");\n\n\tprivate static @Nullable RSAPublicKey extractPublicKey(String key) {\n\n\t\tMatcher m = SSH_PUB_KEY.matcher(key);\n\n\t\tif (m.matches()) {\n\t\t\tString alg = m.group(1);\n\t\t\tString encKey = m.group(2);\n\t\t\t// String id = m.group(3);\n\n\t\t\tif (!\"rsa\".equalsIgnoreCase(alg)) {\n\t\t\t\tthrow new IllegalArgumentException(\"Only RSA is currently supported, but algorithm was \" + alg);\n\t\t\t}\n\n\t\t\treturn parseSSHPublicKey(encKey);\n\t\t}\n\t\telse if (!key.startsWith(BEGIN)) {\n\t\t\t// Assume it's the plain Base64 encoded ssh key without the\n\t\t\t// \"ssh-rsa\" at the start\n\t\t\treturn parseSSHPublicKey(key);\n\t\t}\n\n\t\treturn null;\n\t}\n\n\tstatic RSAPublicKey parsePublicKey(String key) {\n\n\t\tRSAPublicKey publicKey = extractPublicKey(key);\n\n\t\tif (publicKey != null) {","sourceCodeStart":160,"sourceCodeEnd":196,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/crypto/src/main/java/org/springframework/security/crypto/encrypt/RsaKeyHelper.java#L160-L196","documentation":"RsaKeyHelper.extractPublicKey parses SSH public key strings of the form 'ssh-rsa AAAA... comment'. After regex-extracting the algorithm name and base64 payload it requires the algorithm to be 'rsa' (case-insensitive). Any other algorithm name triggers this IllegalArgumentException.","triggerScenarios":"Calling extractPublicKey/publicKey with a key string whose first token is not 'rsa', e.g. 'ssh-ed25519 AAAA...' or 'ecdsa-sha2-nistp256 AAAA...'.","commonSituations":"Users generate modern SSH keys with ssh-keygen -t ed25519 (now the default recommendation) or ECDSA and paste them into configuration expecting RSA-only helpers to accept them.","solutions":["Regenerate the key as RSA: ssh-keygen -t rsa -b 2048 (or 4096) and supply that key.","Use a parser that supports the key's actual algorithm (e.g. java security providers or sshd-common) instead of RsaKeyHelper.","If the key file contains multiple key types, pick the rsa entry from the authorized_keys/id_rsa.pub file rather than id_ed25519.pub.","Strip surrounding whitespace/lines so the first token is genuinely the algorithm field."],"exampleFix":"// before\nString key = Files.readString(Path.of(\"~/.ssh/id_ed25519.pub\"));\nPublicKey pk = helper.extractPublicKey(key);\n// after\nString key = Files.readString(Path.of(\"~/.ssh/id_rsa.pub\"));\nPublicKey pk = helper.extractPublicKey(key);","handlingStrategy":"validation","validationCode":"if (!key.trim().startsWith(\"ssh-rsa \")) {\n    throw new IllegalArgumentException(\"Only ssh-rsa keys are supported, got: \" + key.split(\"\\\\s+\")[0]);\n}","typeGuard":"boolean isRsaSshKey(String key) {\n    String[] parts = key == null ? new String[0] : key.trim().split(\"\\\\s+\");\n    return parts.length >= 2 && \"rsa\".equalsIgnoreCase(parts[0]);\n}","tryCatchPattern":"try {\n    RSAPublicKey pk = helper.extractPublicKey(key);\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().contains(\"Only RSA\")) {\n        throw new ConfigException(\"Provide an ssh-rsa public key (regenerate with: ssh-keygen -t rsa -b 4096)\");\n    }\n    throw e;\n}","preventionTips":["Generate SSH keys with -t rsa when this library is in the pipeline.","Validate the first token of the key string equals 'ssh-rsa' at config load time.","Document that ed25519/ecdsa keys are unsupported and fail fast with a clear message.","Keep both id_rsa.pub and id_ed25519.pub out of shared config; pick explicitly."],"tags":["rsa","ssh-key","crypto","unsupported-algorithm"],"backgroundTag":"unsupported-enum-value","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}