{"record":{"id":"459f2fa2822aac90","repo":"denoland/deno","slug":"err-crypto-incompatible-key","errorCode":"ERR_CRYPTO_INCOMPATIBLE_KEY","errorMessage":"Incompatible key types for Diffie-Hellman: ${privType} and ${pubType}","messagePattern":"Incompatible key types for Diffie-Hellman: (.+?) and (.+?)","errorType":"exception","errorClass":"ERR_CRYPTO_INCOMPATIBLE_KEY","httpStatus":null,"severity":"error","filePath":"ext/node/polyfills/internal/crypto/diffiehellman.ts","lineNumber":1607,"sourceCode":"ECDH.prototype.setPublicKey = deprecate(\n  ECDHImpl.prototype.setPublicKey,\n  \"ecdh.setPublicKey() is deprecated.\",\n  \"DEP0031\",\n);\n\nfunction statelessDH(\n  privateKeyObject: KeyObject,\n  publicKeyObject: KeyObject,\n): Buffer {\n  const privateKey = getKeyObjectHandle(privateKeyObject, kConsumePrivate);\n  const publicKey = getKeyObjectHandle(publicKeyObject, kConsumePublic);\n\n  const privType = privateKeyObject.asymmetricKeyType;\n  const pubType = publicKeyObject.asymmetricKeyType;\n  if (\n    privType !== undefined && pubType !== undefined && privType !== pubType\n  ) {\n    throw new ERR_CRYPTO_INCOMPATIBLE_KEY(\n      \"key types for Diffie-Hellman\",\n      `${privType} and ${pubType}`,\n    );\n  }\n\n  try {\n    const bytes = op_node_diffie_hellman(privateKey, publicKey);\n    return Buffer.from(bytes);\n  } catch (err) {\n    const e = err as Error & { code?: string };\n    if (e && typeof e.message === \"string\") {\n      if (\n        StringPrototypeIncludes(e.message, \"mismatching domain parameters\")\n      ) {\n        e.code = \"ERR_OSSL_MISMATCHING_DOMAIN_PARAMETERS\";\n      } else if (\n        StringPrototypeIncludes(e.message, \"failed during derivation\")\n      ) {","sourceCodeStart":1589,"sourceCodeEnd":1625,"githubUrl":"https://github.com/denoland/deno/blob/9ad36f7a2cce60488e6ec52283efb32efddaf93a/ext/node/polyfills/internal/crypto/diffiehellman.ts#L1589-L1625","documentation":"statelessDH() — the engine behind crypto.diffieHellman({privateKey, publicKey}) — throws ERR_CRYPTO_INCOMPATIBLE_KEY when both KeyObjects have a known asymmetricKeyType and the types differ. Diffie-Hellman can only combine two keys of the same algorithm (e.g. 'ec' with 'ec', 'x25519' with 'x25519'); mixing kinds can never produce a shared secret.","triggerScenarios":"crypto.diffieHellman({ privateKey: createPrivateKey(rsaPem), publicKey: createPublicKey(ecPem) }); or an 'x25519' private key with an 'ec' (NIST) public key, or 'dh' with 'ec'.","commonSituations":"Key-management code that grabs whatever KeyObject is at hand; protocols that upgraded one side from RSA/ECDH to X25519 while the other side still sends the old key type; config files pointing privateKey and publicKey at PEMs of different algorithms.","solutions":["Use a matching pair: generate one key pair (e.g. generateKeyPairSync('x25519')) and pass its privateKey plus the peer's same-type public key","Log privateKeyObject.asymmetricKeyType and publicKeyObject.asymmetricKeyType before the call and fix whichever side is wrong","Verify PEM/DER files were loaded with createPrivateKey/createPublicKey and not swapped"],"exampleFix":"// before\nconst secret = crypto.diffieHellman({ privateKey: rsaPriv, publicKey: ecPub });\n\n// after\nconst secret = crypto.diffieHellman({ privateKey: ecPriv, publicKey: ecPub });","handlingStrategy":"type-guard","validationCode":"if (privateKeyObject.asymmetricKeyType !== publicKeyObject.asymmetricKeyType) {\n  throw new TypeError(\n    `key types must match: ${privateKeyObject.asymmetricKeyType} vs ${publicKeyObject.asymmetricKeyType}`,\n  );\n}\nconst secret = crypto.diffieHellman({ privateKey: privateKeyObject, publicKey: publicKeyObject });","typeGuard":"const isMatchingDHPair = (priv: crypto.KeyObject, pub: crypto.KeyObject): boolean =>\n  priv.asymmetricKeyType === pub.asymmetricKeyType &&\n  ['ec', 'x25519', 'ed25519', 'dh'].includes(String(priv.asymmetricKeyType));","tryCatchPattern":"catch (e) { if ((e as NodeJS.ErrnoException).code === 'ERR_CRYPTO_INCOMPATIBLE_KEY') { /* log both key types, re-key the offending side */ } throw e; }","preventionTips":["Always generate a fresh pair with generateKeyPairSync and pass its private half plus the peer's same-type public half","Log asymmetricKeyType when loading keys so mismatches are visible before the op","Version your protocol's key algorithm so both sides agree after upgrades"],"tags":["crypto","diffie-hellman","key-types","node-compat"],"backgroundTag":"incompatible-key-types","analyzedSha":"9ad36f7a2cce60488e6ec52283efb32efddaf93a","analyzedAt":"2026-08-20T13:07:44.778Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}