{"record":{"id":"7d3fdd10d49cc423","repo":"OpenNHP/opennhp","slug":"invalid-input-key-7d3fdd","errorCode":null,"errorMessage":"invalid input key","messagePattern":"invalid input key","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"endpoints/server/main/main.go","lineNumber":138,"sourceCode":"\t\t},\n\t\tAction: func(c *cli.Context) error {\n\t\t\temitErr := func(err error) error {\n\t\t\t\tif c.Bool(\"json\") {\n\t\t\t\t\tjson.NewEncoder(os.Stdout).Encode(map[string]string{\"error\": err.Error()})\n\t\t\t\t\treturn nil\n\t\t\t\t}\n\t\t\t\treturn err\n\t\t\t}\n\t\t\tprivBytes, err := base64.StdEncoding.DecodeString(c.Args().First())\n\t\t\tif err != nil {\n\t\t\t\treturn emitErr(fmt.Errorf(\"decode private key: %w\", err))\n\t\t\t}\n\n\t\t\tif c.Bool(\"both\") {\n\t\t\t\tsm2 := core.ECDHFromKey(core.ECC_SM2, privBytes)\n\t\t\t\tcurve := core.ECDHFromKey(core.ECC_CURVE25519, privBytes)\n\t\t\t\tif sm2 == nil || curve == nil {\n\t\t\t\t\treturn emitErr(fmt.Errorf(\"invalid input key\"))\n\t\t\t\t}\n\t\t\t\tif c.Bool(\"json\") {\n\t\t\t\t\tjson.NewEncoder(os.Stdout).Encode(map[string]string{\n\t\t\t\t\t\t\"sm2PublicKey\":        sm2.PublicKeyBase64(),\n\t\t\t\t\t\t\"curve25519PublicKey\": curve.PublicKeyBase64(),\n\t\t\t\t\t})\n\t\t\t\t} else {\n\t\t\t\t\tfmt.Println(\"SM2 public key:       \", sm2.PublicKeyBase64())\n\t\t\t\t\tfmt.Println(\"Curve25519 public key:\", curve.PublicKeyBase64())\n\t\t\t\t}\n\t\t\t\treturn nil\n\t\t\t}\n\n\t\t\teccType := core.ECC_SM2\n\t\t\tif c.Bool(\"curve\") {\n\t\t\t\teccType = core.ECC_CURVE25519\n\t\t\t}\n\t\t\te := core.ECDHFromKey(eccType, privBytes)","sourceCodeStart":120,"sourceCodeEnd":156,"githubUrl":"https://github.com/OpenNHP/opennhp/blob/6e04ca5ff03222a699c24205cd4bf8fee9af7ffe/endpoints/server/main/main.go#L120-L156","documentation":"The nhp-serverd `pubkey --both` command failed to construct ECDH objects for the supplied private key. `core.ECDHFromKey` returned nil for either the SM2 or the Curve25519 instance, so the command cannot derive public keys and aborts with \"invalid input key\". When --json is set the error is emitted as JSON on stdout instead of a CLI error.","triggerScenarios":"Running `nhp-serverd pubkey --both <base64key>` where the base64 decodes but the resulting bytes are not a valid private scalar for SM2 and/or Curve25519 (e.g. zero scalar, wrong length after padding, or a key rejected by the crypto backend).","commonSituations":"Backfilling public keys for a legacy secret per generate-nhp-keys.sh but the stored base64 was truncated, contains whitespace/padding variants, or is a public (not private) key pasted by mistake.","solutions":["Verify the argument is the exact base64-encoded 32-byte private key (no quotes, whitespace, or trailing newline) and re-run the command.","Base64-decode the key locally and confirm it is 32 bytes and not all zeros before retrying.","If the secret is unrecoverable, regenerate a fresh key pair with `nhp-serverd keygen` and rotate peers in lockstep.","Check with `--json` off to see the raw error rather than a JSON envelope."],"exampleFix":"// before: whitespace-mangled key from config\nnhp-serverd pubkey --both \"YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXog\"\n// after: exact base64 private key, no padding/space issues\nnhp-serverd pubkey --both \"YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXo=\"","handlingStrategy":"validation","validationCode":"raw, err := base64.StdEncoding.DecodeString(keyArg)\nif err != nil || len(raw) != 32 {\n    return fmt.Errorf(\"private key must be base64 of exactly 32 bytes\")\n}\nif bytes.Equal(raw, make([]byte, 32)) {\n    return fmt.Errorf(\"private key must not be all zeros\")\n}","typeGuard":"func isValidPrivKeyArg(s string) bool {\n    b, err := base64.StdEncoding.DecodeString(s)\n    return err == nil && len(b) == 32 && !bytes.Equal(b, make([]byte, 32))\n}","tryCatchPattern":"if out, err := runPubkeyCmd(\"--both\", keyArg); err != nil {\n    log.Warn(\"pubkey derivation failed: %v\", err) // includes \"invalid input key\"\n}","preventionTips":["Store keys as exact single-line base64; never copy through editors that wrap or add whitespace.","Validate base64 decode length (32 bytes) before invoking pubkey.","Keep scheme-agnostic private keys distinct from public keys; label them in the secret store."],"tags":["cli","cryptography","key-derivation"],"backgroundTag":"invalid-argument-value","analyzedSha":"6e04ca5ff03222a699c24205cd4bf8fee9af7ffe","analyzedAt":"2026-09-07T15:44:59.941Z","contentChangedAt":"2026-09-07T15:44:59.941Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}