{"record":{"id":"736420ffa589ba72","repo":"gchq/CyberChef","slug":"dsa-keys-are-not-supported-for-jwk","errorCode":null,"errorMessage":"DSA keys are not supported for JWK","messagePattern":"DSA keys are not supported for JWK","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/operations/PEMToJWK.mjs","lineNumber":64,"sourceCode":"        while ((match = regex.exec(input)) !== null) {\n            // find corresponding end tag\n            const indexBase64 = match.index + match[0].length;\n            const header = input.substring(match.index, indexBase64);\n            const footer = `-----END ${match[1]}-----`;\n            const indexFooter = input.indexOf(footer, indexBase64);\n            if (indexFooter === -1) {\n                throw new OperationError(`PEM footer '${footer}' not found`);\n            }\n\n            const pem = input.substring(match.index, indexFooter + footer.length);\n            if (match[1].indexOf(\"KEY\") !== -1) {\n                if (header === \"-----BEGIN RSA PUBLIC KEY-----\") {\n                    throw new OperationError(\"Unsupported RSA public key format. Only PKCS#8 is supported.\");\n                }\n\n                const key = r.KEYUTIL.getKey(pem);\n                if (key.type === \"DSA\") {\n                    throw new OperationError(\"DSA keys are not supported for JWK\");\n                }\n                const jwk = r.KEYUTIL.getJWKFromKey(key);\n                if (output.length > 0) {\n                    output += \"\\n\";\n                }\n                output += JSON.stringify(jwk);\n            } else if (match[1] === \"CERTIFICATE\") {\n                const cert = new r.X509();\n                cert.readCertPEM(pem);\n                const key = cert.getPublicKey();\n                const jwk = r.KEYUTIL.getJWKFromKey(key);\n                if (output.length > 0) {\n                    output += \"\\n\";\n                }\n                output += JSON.stringify(jwk);\n            } else {\n                throw new OperationError(`Unsupported PEM type '${match[1]}'`);\n            }","sourceCodeStart":46,"sourceCodeEnd":82,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/operations/PEMToJWK.mjs#L46-L82","documentation":"PEMToJWK parses the key via jsrsasign KEYUTIL.getKey, then checks key.type. If it equals 'DSA' the operation throws because RFC 7517/7518 (JWK) registers no DSA key type - only RSA, EC, oct, and OKP are defined. There is no JWK serialization path for DSA.","triggerScenarios":"User supplies a DSA private or public key (e.g. '-----BEGIN DSA PRIVATE KEY-----' or a PKCS#8-wrapped DSA key). jsrsasign parses it, sets key.type to 'DSA', and this guard rejects it.","commonSituations":"Legacy DSA keys from SSH/OpenSSL; DSA certificates or CA keys; DSA keys encountered while batch-converting a key bundle to JWK.","solutions":["Use an RSA or EC key instead - only those produce JWK output here.","If you need raw DSA parameters, extract them with a DSA-aware tool rather than JWK.","Confirm the key algorithm: 'openssl pkey -in key.pem -text -noout' prints the type."],"exampleFix":"// before (unsupported)\n-----BEGIN DSA PRIVATE KEY-----\n...\n// after (use EC or RSA)\n-----BEGIN EC PRIVATE KEY-----\n...","handlingStrategy":"validation","validationCode":"function guessKeyType(pem) {\n    if (/DSA/.test(pem)) return 'DSA';\n    if (/EC PRIVATE|EC PUBLIC/.test(pem)) return 'EC';\n    return /RSA/.test(pem) ? 'RSA' : 'unknown';\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["JWK supports only RSA, EC, oct, OKP - avoid DSA keys.","Inspect key.type via jsrsasign KEYUTIL.getKey(pem).type before calling getJWKFromKey.","Run 'openssl pkey -in key.pem -text -noout' to confirm the algorithm."],"tags":["pem","dsa","jwk","cryptography"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}