{"record":{"id":"70780ae9917d038e","repo":"grafana/k6","slug":"failed-to-decode-second-prime-factor-w","errorCode":null,"errorMessage":"failed to decode second prime factor: %w","messagePattern":"failed to decode second prime factor: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/js/modules/k6/webcrypto/jwk.go","lineNumber":366,"sourceCode":"\t\tE: int(eInt),\n\t}\n\n\t// if the private exponent is missing, return the public key\n\tif jwk.D == \"\" {\n\t\treturn pubKey, PublicCryptoKeyType, pubKey.N.BitLen(), nil\n\t}\n\n\tdBytes, err := base64URLDecode(jwk.D)\n\tif err != nil {\n\t\treturn nil, UnknownCryptoKeyType, 0, fmt.Errorf(\"failed to decode private exponent: %w\", err)\n\t}\n\tpBytes, err := base64URLDecode(jwk.P)\n\tif err != nil {\n\t\treturn nil, UnknownCryptoKeyType, 0, fmt.Errorf(\"failed to decode first prime factor: %w\", err)\n\t}\n\tqBytes, err := base64URLDecode(jwk.Q)\n\tif err != nil {\n\t\treturn nil, UnknownCryptoKeyType, 0, fmt.Errorf(\"failed to decode second prime factor: %w\", err)\n\t}\n\tdpBytes, err := base64URLDecode(jwk.Dp)\n\tif err != nil {\n\t\treturn nil, UnknownCryptoKeyType, 0, fmt.Errorf(\"failed to decode first exponent: %w\", err)\n\t}\n\tdqBytes, err := base64URLDecode(jwk.Dq)\n\tif err != nil {\n\t\treturn nil, UnknownCryptoKeyType, 0, fmt.Errorf(\"failed to decode second exponent: %w\", err)\n\t}\n\tqiBytes, err := base64URLDecode(jwk.Qi)\n\tif err != nil {\n\t\treturn nil, UnknownCryptoKeyType, 0, fmt.Errorf(\"failed to decode coefficient: %w\", err)\n\t}\n\n\tprivKey := &rsa.PrivateKey{\n\t\tPublicKey: pubKey,\n\t\tD:         new(big.Int).SetBytes(dBytes),\n\t\tPrimes: []*big.Int{","sourceCodeStart":348,"sourceCodeEnd":384,"githubUrl":"https://github.com/grafana/k6/blob/93accf6570dcd306ca5e99cc44c393ee3797761b/internal/js/modules/k6/webcrypto/jwk.go#L348-L384","documentation":"For RSA private-key JWK import, the second prime factor q is decoded with base64.RawURLEncoding after p. This error means q failed that decode — the same failure modes as the other fields: '=' padding, '+'/'/' alphabet, embedded whitespace, or impossible length. It is returned from crypto.subtle.importKey('jwk', ...) for RSA algorithms.","triggerScenarios":"q encoded with padding or the standard base64 alphabet; q truncated; q containing line breaks; q swapped with p is not this error's cause (both decode fine and the swap fails later at Validate()).","commonSituations":"Same as p: PEM-derived or vault-stored values re-encoded incorrectly; copy-paste truncation of the last fields of long JWKs.","solutions":["Convert q to unpadded base64url","Remove whitespace and padding","Check the decoded length is about half the modulus","Ensure p and q come from the same key and are in the correct JWK slots"],"exampleFix":"// before\nconst jwk = { kty: 'RSA', n, e: 'AQAB', d, p, q: paddedQ, dp, dq, qi };\n// after\nconst toB64u = (s) => s.replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '').replace(/\\s+/g, '');\nconst jwk = { kty: 'RSA', n, e: 'AQAB', d, p, q: toB64u(paddedQ), dp, dq, qi };","handlingStrategy":"validation","validationCode":"const B64URL = /^[A-Za-z0-9_-]+$/;\nif (jwk.q !== undefined) {\n  const q = String(jwk.q).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '').replace(/\\s+/g, '');\n  if (!B64URL.test(q)) throw new Error('prime q is not unpadded base64url');\n  jwk = { ...jwk, q };\n}","typeGuard":"function isB64uPrime(s) {\n  return typeof s === 'string' && /^[A-Za-z0-9_-]+$/.test(s) && s.length >= 20;\n}","tryCatchPattern":"try {\n  key = await crypto.subtle.importKey('jwk', jwk, rsaAlg, true, usages);\n} catch (e) {\n  if (e.message.includes('failed to decode second prime factor')) {\n    jwk = { ...jwk, q: toB64u(jwk.q) };\n    key = await crypto.subtle.importKey('jwk', jwk, rsaAlg, true, usages);\n  } else throw e;\n}","preventionTips":["Apply the same unpadded base64url normalization to q as to p","Ensure p and q come from the same key and are not swapped","Watch for truncation at the tail of long JWK strings"],"tags":["webcrypto","jwk","import","rsa","base64url","private-key","k6"],"backgroundTag":null,"analyzedSha":"93accf6570dcd306ca5e99cc44c393ee3797761b","analyzedAt":"2026-08-15T21:23:27.118Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}