{"record":{"id":"6bcd23187de3ba69","repo":"gchq/CyberChef","slug":"provided-key-is-not-an-ec-key","errorCode":null,"errorMessage":"Provided key is not an EC key.","messagePattern":"Provided key is not an EC key\\.","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/operations/ECDSASign.mjs","lineNumber":76,"sourceCode":"    }\n\n    /**\n     * @param {string} input\n     * @param {Object[]} args\n     * @returns {string}\n     */\n    run(input, args) {\n        const [keyPem, mdAlgo, outputFormat] = args;\n\n        if (keyPem.replace(\"-----BEGIN EC PRIVATE KEY-----\", \"\").length === 0) {\n            throw new OperationError(\"Please enter a private key.\");\n        }\n\n        const internalAlgorithmName = mdAlgo.replace(\"-\", \"\") + \"withECDSA\";\n        const sig = new r.KJUR.crypto.Signature({ alg: internalAlgorithmName });\n        const key = r.KEYUTIL.getKey(keyPem);\n        if (key.type !== \"EC\") {\n            throw new OperationError(\"Provided key is not an EC key.\");\n        }\n        if (!key.isPrivate) {\n            throw new OperationError(\"Provided key is not a private key.\");\n        }\n        sig.init(key);\n        const signatureASN1Hex = sig.signString(input);\n\n        let result;\n        switch (outputFormat) {\n            case \"ASN.1 HEX\":\n                result = signatureASN1Hex;\n                break;\n            case \"P1363 HEX\":\n                result = r.KJUR.crypto.ECDSA.asn1SigToConcatSig(signatureASN1Hex);\n                break;\n            case \"JSON Web Signature\":\n                result = r.KJUR.crypto.ECDSA.asn1SigToConcatSig(signatureASN1Hex);\n                result = toBase64(fromHex(result), \"A-Za-z0-9-_\");  // base64url","sourceCodeStart":58,"sourceCodeEnd":94,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/operations/ECDSASign.mjs#L58-L94","documentation":"Thrown in ECDSASign.run after r.KEYUTIL.getKey(keyPem) parses the PEM but the key object has key.type !== 'EC'. jsrsasign's KEYUTIL.getKey accepts RSA, EC, and DSA keys, returning a key whose .type names the family. This operation is ECDSA-only, so any non-EC key is rejected before signing. It fires only when getKey did not throw; a malformed PEM would surface a jsrsasign exception earlier.","triggerScenarios":"The user pasted an RSA or DSA private key into the ECDSA key field, or an EC key wrapped in a container jsrsasign labels differently. getKey parses it without error but key.type is 'RSA'/'DSA' rather than 'EC'.","commonSituations":"Copying an RSA key from a server cert into the ECDSA field; a PKCS#8 generic private key whose algorithm is not EC; confusing EC and RSA key generation.","solutions":["Provide a genuine EC private key (prime256v1/secp384r1/secp521r1).","If you only have an RSA key, use the RSA Sign operation instead.","Convert the key to EC PEM with openssl if appropriate, or generate a fresh EC keypair."],"exampleFix":"// before: RSA key pasted into the ECDSA field\nconst key = rsaPrivateKeyPem;   // key.type === 'RSA'\n// after: EC key\nconst key = ecPrivateKeyPem;    // key.type === 'EC'","handlingStrategy":"validation","validationCode":"// Pre-check the key family with jsrsasign before invoking the operation.\nimport r from \"jsrsasign\";\nconst key = r.KEYUTIL.getKey(keyPem);\nif (key.type !== \"EC\") throw new Error(\"key is not EC; use the RSA/DSA sign operation instead\");","typeGuard":"const isEcKey = (k) => k && k.type === \"EC\";","tryCatchPattern":null,"preventionTips":["Confirm the key algorithm matches the operation (EC for ECDSA, RSA for RSA Sign).","Read the key type via KEYUTIL.getKey(...).type before building a crypto recipe."],"tags":["crypto","ecdsa","key-validation","jsrsasign","operation-error"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}