{"record":{"id":"8ba97f96aa419120","repo":"jwtk/jjwt","slug":"unrecognized-ec-key-algorithm-name","errorCode":null,"errorMessage":"Unrecognized EC key algorithm name.","messagePattern":"Unrecognized EC key algorithm name\\.","errorType":"exception","errorClass":"io.jsonwebtoken.security.InvalidKeyException","httpStatus":null,"severity":"error","filePath":"impl/src/main/java/io/jsonwebtoken/impl/security/EcSignatureAlgorithm.java","lineNumber":148,"sourceCode":"        this.OID = Assert.hasText(oid, \"Invalid OID.\");\n        String curveName = \"secp\" + orderBitLength + \"r1\";\n        this.KEY_PAIR_GEN_PARAMS = new ECGenParameterSpec(curveName);\n        this.orderBitLength = orderBitLength;\n        this.sigFieldByteLength = Bytes.length(this.orderBitLength);\n        this.signatureByteLength = this.sigFieldByteLength * 2; // R bytes + S bytes = concat signature bytes\n    }\n\n    @Override\n    public KeyPairBuilder keyPair() {\n        return new DefaultKeyPairBuilder(ECCurve.KEY_PAIR_GENERATOR_JCA_NAME, this.KEY_PAIR_GEN_PARAMS)\n                .random(Randoms.secureRandom());\n    }\n\n    @Override\n    protected void validateKey(Key key, boolean signing) {\n        super.validateKey(key, signing);\n        if (!KEY_ALG_NAMES.contains(KeysBridge.findAlgorithm(key))) {\n            throw new InvalidKeyException(\"Unrecognized EC key algorithm name.\");\n        }\n        int size = KeysBridge.findBitLength(key);\n        if (size < 0) return; // likely PKCS11 or HSM key, can't get the data we need\n        int sigFieldByteLength = Bytes.length(size);\n        int concatByteLength = sigFieldByteLength * 2;\n        if (concatByteLength != this.signatureByteLength) {\n            String msg = \"The provided Elliptic Curve \" + keyType(signing) +\n                    \" key size (aka order bit length) is \" + Bytes.bitsMsg(size) + \", but the '\" +\n                    getId() + \"' algorithm requires EC Keys with \" + Bytes.bitsMsg(this.orderBitLength) +\n                    \" per [RFC 7518, Section 3.4](https://www.rfc-editor.org/rfc/rfc7518.html#section-3.4).\";\n            throw new InvalidKeyException(msg);\n        }\n    }\n\n    @Override\n    protected byte[] doDigest(final SecureRequest<InputStream, PrivateKey> request) {\n        return jca(request).withSignature(new CheckedFunction<Signature, byte[]>() {\n            @Override","sourceCodeStart":130,"sourceCodeEnd":166,"githubUrl":"https://github.com/jwtk/jjwt/blob/fb71496164c71442d08adec4571d9616ed5e1b8d/impl/src/main/java/io/jsonwebtoken/impl/security/EcSignatureAlgorithm.java#L130-L166","documentation":"EcSignatureAlgorithm.validateKey checks that the key's JCA algorithm name is one of the recognized EC names (e.g. 'EC', 'ECDSA'); otherwise the key cannot be assumed to be an EC key usable for ES256/ES384/ES512 signing. If findAlgorithm returns something outside KEY_ALG_NAMES, it throws this InvalidKeyException.","triggerScenarios":"Using signWith(key, SignatureAlgorithm.ES256) (or a KeyPair with non-EC key) where the supplied key is an RSA, PSS, or custom-named key; keys from providers reporting unusual algorithm strings.","commonSituations":"Passing an RSA key pair to an EC signature algorithm; PKCS11/HSM keys whose algorithm name is provider-specific; accidental argument order mix-up in signWith calls.","solutions":["Supply an EC KeyPair (KeyPairGenerator.getInstance(\"EC\") with a named curve) for ES* algorithms.","Verify key.getAlgorithm() returns 'EC' or 'ECDSA' before signing.","Match algorithm families: RSA keys with RS*/PS* algorithms, EC keys with ES* algorithms.","For HSM keys with odd names, wrap or register the expected algorithm name, or use a key on a standard provider."],"exampleFix":"// before\nKeyPair rsaPair = KeyPairGenerator.getInstance(\"RSA\").generateKeyPair();\nJwts.builder().signWith(rsaPair.getPrivate(), SignatureAlgorithm.ES256);\n// after\nKeyPairGenerator kg = KeyPairGenerator.getInstance(\"EC\");\nkg.initialize(new ECGenParameterSpec(\"secp256r1\"));\nJwts.builder().signWith(kg.generateKeyPair().getPrivate(), SignatureAlgorithm.ES256);","handlingStrategy":"validation","validationCode":"String alg = key.getAlgorithm();\nif (!(\"EC\".equalsIgnoreCase(alg) || \"ECDSA\".equalsIgnoreCase(alg))) {\n    throw new IllegalArgumentException(\"ES* algorithms require an EC key, got: \" + alg);\n}","typeGuard":"boolean isEcKey(Key k) { return k instanceof java.security.interfaces.ECKey; }","tryCatchPattern":"try {\n    jwt = Jwts.builder().signWith(priv, SignatureAlgorithm.ES256)...compact();\n} catch (io.jsonwebtoken.security.InvalidKeyException e) {\n    // match key family to algorithm family\n}","preventionTips":["Match algorithm families: EC keys with ES*, RSA keys with RS*/PS*","Verify key.getAlgorithm() before signWith","Use standard providers so keys report standard algorithm names"],"tags":["java","jjwt","ec","signature","invalid-key"],"backgroundTag":"invalid-key-algorithm","analyzedSha":"fb71496164c71442d08adec4571d9616ed5e1b8d","analyzedAt":"2026-09-09T00:33:09.982Z","contentChangedAt":"2026-09-09T00:33:09.982Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}