{"record":{"id":"72e711b352d59c58","repo":"gchq/CyberChef","slug":"couldn-t-sign-message-err","errorCode":null,"errorMessage":"Couldn't sign message: ${err}","messagePattern":"Couldn't sign message: (.+?)","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/operations/PGPEncryptAndSign.mjs","lineNumber":86,"sourceCode":"    async run(input, args) {\n        const message = input,\n            [privateKey, passphrase, publicKey] = args;\n        let signedMessage;\n\n        if (!privateKey) throw new OperationError(\"Enter the private key of the signer.\");\n        if (!publicKey) throw new OperationError(\"Enter the public key of the recipient.\");\n        const privKey = await importPrivateKey(privateKey, passphrase);\n        const pubKey = await importPublicKey(publicKey);\n\n        try {\n            signedMessage = await promisify(kbpgp.box)({\n                \"msg\": message,\n                \"encrypt_for\": pubKey,\n                \"sign_with\": privKey,\n                \"asp\": ASP\n            });\n        } catch (err) {\n            throw new OperationError(`Couldn't sign message: ${err}`);\n        }\n\n        return signedMessage;\n    }\n\n}\n\nexport default PGPEncryptAndSign;\n","sourceCodeStart":68,"sourceCodeEnd":95,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/operations/PGPEncryptAndSign.mjs#L68-L95","documentation":"Catch-all around kbpgp.box with both encrypt_for and sign_with in PGPEncryptAndSign.run. Both keys imported successfully, but the combined encrypt + sign call rejected. The appended err holds the kbpgp cause.","triggerScenarios":"Signer private key has no signing capability/subkey; recipient public key has no encryption subkey; passphrase-unlocked key is actually wrong; large message; kbpgp internal error during the combined operation.","commonSituations":"Signer key is encryption-only; recipient key is signing-only; wrong passphrase producing a 'valid but wrong' key; key capability mismatch between the two parties.","solutions":["Verify the signer private key can sign (has a signing subkey / signing capability).","Verify the recipient public key can encrypt (has an encryption subkey).","Re-check the passphrase and reduce the message size."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"if (!/-----BEGIN PGP PRIVATE KEY BLOCK-----/.test(privateKey)) throw new Error('Signer private key missing');\nif (!/-----BEGIN PGP PUBLIC KEY BLOCK-----/.test(publicKey)) throw new Error('Recipient public key missing');","typeGuard":null,"tryCatchPattern":"try {\n    out = await chef.PGPEncryptAndSign(msg, [priv, pass, pub]);\n} catch (e) {\n    if (/Couldn't sign/.test(e.message)) { /* inspect suffix for kbpgp cause */ }\n    else throw e;\n}","preventionTips":["Use keys with appropriate subkey capabilities (sign for signer, encrypt for recipient).","Verify the passphrase unlocks the private key.","Validate both keys before running."],"tags":["pgp","kbpgp","signing","cryptography"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}