{"record":{"id":"46d3b38aadf9f810","repo":"gchq/CyberChef","slug":"could-not-identify-a-key-manager","errorCode":null,"errorMessage":"Could not identify a key manager.","messagePattern":"Could not identify a key manager\\.","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/operations/PGPDecryptAndVerify.mjs","lineNumber":112,"sourceCode":"                        }\n                        if (signer.comment) {\n                            text += `(${signer.comment}) `;\n                        }\n                        if (signer.email) {\n                            text += `<${signer.email}>`;\n                        }\n                        text += \"\\n\";\n                    }\n                    text += [\n                        `PGP key ID: ${km.get_pgp_short_key_id()}`,\n                        `PGP fingerprint: ${km.get_pgp_fingerprint().toString(\"hex\")}`,\n                        `Signed on ${new Date(ds.sig.when_generated() * 1000).toUTCString()}`,\n                        \"----------------------------------\\n\"\n                    ].join(\"\\n\");\n                    text += unboxedLiterals.toString();\n                    return text.trim();\n                } else {\n                    throw new OperationError(\"Could not identify a key manager.\");\n                }\n            } else {\n                throw new OperationError(\"The data does not appear to be signed.\");\n            }\n        } catch (err) {\n            throw new OperationError(`Couldn't verify message: ${err}`);\n        }\n    }\n\n}\n\nexport default PGPDecryptAndVerify;\n","sourceCodeStart":94,"sourceCodeEnd":125,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/operations/PGPDecryptAndVerify.mjs#L94-L125","documentation":"After kbpgp.unbox succeeds and get_data_signer() returns a signer, get_key_manager() is called to retrieve the signing key. If it returns null/falsy the operation cannot report who signed, so it throws. Note: this throw (line 112) sits inside the surrounding try/catch at line 117, so it is re-wrapped and surfaces to the user as 'Couldn't verify message: ...' rather than this verbatim text.","triggerScenarios":"A signature packet exists but its issuer key manager cannot be resolved - the signing key is not in the keyring, the signature references a key ID kbpgp cannot bind to an imported manager, or the data_signer has no attached key manager object.","commonSituations":"Signer's public key not supplied or a different key than the one that signed; keyring contains only an encryption subkey, not the signing subkey; third-party-signed message where the signing key was never imported.","solutions":["Ensure the signer's correct public key is supplied in the 'Public key of signer' argument.","Confirm the supplied public key matches the key ID / fingerprint embedded in the signature.","Import the full public key (primary + signing subkey), not just an encryption subkey."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if (!/-----BEGIN PGP PUBLIC KEY BLOCK-----/.test(publicKey)) {\n    throw new Error('Supply the signer armoured public key before running.');\n}","typeGuard":null,"tryCatchPattern":"try {\n    out = await chef.PGPDecryptAndVerify(msg, [pub, priv, pass]);\n} catch (e) {\n    if (/identify a key manager|verify message/.test(e.message)) {\n        // signing key missing from keyring - supply the correct signer public key\n    } else throw e;\n}","preventionTips":["Always supply the signer full public key (primary + subkeys).","Match the key ID in the signature to the imported key.","Remember the verbatim message is wrapped by 'Couldn't verify message' in this operation."],"tags":["pgp","kbpgp","signature","cryptography"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}