{"record":{"id":"5c63e838f3d6acf7","repo":"gchq/CyberChef","slug":"provided-key-is-not-an-ec-key-5c63e8","errorCode":null,"errorMessage":"Provided key is not an EC key.","messagePattern":"Provided key is not an EC key\\.","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/operations/ECDSAVerify.mjs","lineNumber":148,"sourceCode":"            case \"Raw JSON\": {\n                if (!inputJson) inputJson = JSON.parse(input);\n                if (!inputJson.r) {\n                    throw new OperationError('No \"r\" value in the signature JSON');\n                }\n                if (!inputJson.s) {\n                    throw new OperationError('No \"s\" value in the signature JSON');\n                }\n                signatureASN1Hex = r.KJUR.crypto.ECDSA.hexRSSigToASN1Sig(inputJson.r, inputJson.s);\n                break;\n            }\n        }\n\n        // verify signature\n        const internalAlgorithmName = mdAlgo.replace(\"-\", \"\") + \"withECDSA\";\n        const sig = new r.KJUR.crypto.Signature({ alg: internalAlgorithmName });\n        const key = r.KEYUTIL.getKey(keyPem);\n        if (key.type !== \"EC\") {\n            throw new OperationError(\"Provided key is not an EC key.\");\n        }\n        if (!key.isPublic) {\n            throw new OperationError(\"Provided key is not a public key.\");\n        }\n        sig.init(key);\n        const messageStr = Utils.convertToByteString(msg, msgFormat);\n        sig.updateString(messageStr);\n        const result = sig.verify(signatureASN1Hex);\n        return result ? \"Verified OK\" : \"Verification Failure\";\n    }\n}\n\nexport default ECDSAVerify;\n","sourceCodeStart":130,"sourceCodeEnd":162,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/operations/ECDSAVerify.mjs#L130-L162","documentation":"Thrown in ECDSAVerify.run after r.KEYUTIL.getKey(keyPem) parses the PEM but key.type !== 'EC'. KEYUTIL.getKey accepts RSA/EC/DSA; ECDSA Verify requires an EC key, so a non-EC public key is rejected before verification. Fires only when getKey succeeded; an unparseable PEM throws a jsrsasign error earlier.","triggerScenarios":"An RSA or DSA public key (PEM) was pasted into the ECDSA public-key field. getKey parses it, key.type returns 'RSA'/'DSA', failing the guard.","commonSituations":"Pasting the wrong certificate's public key (RSA server cert) into the ECDSA verifier; a PKCS#8 public key for a non-EC algorithm.","solutions":["Provide an EC public key matching the curve used to sign (P-256/P-384/P-521).","If the key is RSA, use the RSA Verify operation instead.","Extract the EC public key from the signer's certificate with openssl."],"exampleFix":"// before: RSA public key -> key.type === 'RSA'\nconst key = rsaPublicKeyPem;\n// after: EC public key\nconst key = ecPublicKeyPem; // key.type === 'EC'","handlingStrategy":"validation","validationCode":"import r from \"jsrsasign\";\nconst key = r.KEYUTIL.getKey(keyPem);\nif (key.type !== \"EC\") throw new Error(\"key is not EC; use the appropriate verify operation\");","typeGuard":"const isEcKey = (k) => k && k.type === \"EC\";","tryCatchPattern":null,"preventionTips":["Match the key algorithm to the operation (EC for ECDSA Verify).","Inspect key.type after KEYUTIL.getKey before verifying."],"tags":["crypto","ecdsa","key-validation","jsrsasign","operation-error"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}