{"record":{"id":"8d05f2cb75908333","repo":"grafana/k6","slug":"invalid-elliptic-curve-k","errorCode":null,"errorMessage":"invalid elliptic curve {k}","messagePattern":"invalid elliptic curve (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/js/modules/k6/webcrypto/elliptic_curve.go","lineNumber":412,"sourceCode":"\tcase p384Canonical:\n\t\treturn ecdh.P384(), nil\n\tcase p521Canonical:\n\t\treturn ecdh.P521(), nil\n\tdefault:\n\t\treturn nil, errors.New(\"invalid ECDH curve\")\n\t}\n}\n\nfunc pickEllipticCurve(k string) (elliptic.Curve, error) {\n\tswitch k {\n\tcase p256Canonical:\n\t\treturn elliptic.P256(), nil\n\tcase p384Canonical:\n\t\treturn elliptic.P384(), nil\n\tcase p521Canonical:\n\t\treturn elliptic.P521(), nil\n\tdefault:\n\t\treturn nil, errors.New(\"invalid elliptic curve \" + k)\n\t}\n}\n\nfunc exportECKey(ck *CryptoKey, format KeyFormat) (any, error) {\n\tif ck.handle == nil {\n\t\treturn nil, NewError(OperationError, \"key data is not accessible\")\n\t}\n\n\talg, ok := ck.Algorithm.(EcKeyAlgorithm)\n\tif !ok {\n\t\treturn nil, NewError(InvalidAccessError, \"key algorithm is not a valid EC algorithm\")\n\t}\n\n\tswitch format {\n\tcase RawKeyFormat:\n\t\tif ck.Type != PublicCryptoKeyType {\n\t\t\treturn nil, NewError(InvalidAccessError, \"key is not a valid elliptic curve public key\")\n\t\t}","sourceCodeStart":394,"sourceCodeEnd":430,"githubUrl":"https://github.com/grafana/k6/blob/93accf6570dcd306ca5e99cc44c393ee3797761b/internal/js/modules/k6/webcrypto/elliptic_curve.go#L394-L430","documentation":"pickEllipticCurve (internal/js/modules/k6/webcrypto/elliptic_curve.go:403) resolves the curve for ECDSA/EC operations (generateKey, importKey, signing) and, like its ECDH counterpart, accepts only 'P-256', 'P-384' and 'P-521'. Anything else — including case variants and other curve families — returns \"invalid elliptic curve <k>\" with the offending name appended.","triggerScenarios":"`crypto.subtle.generateKey({ name: 'ECDSA', namedCurve: 'secp256k1', hash: 'SHA-256' }, ...)`; namedCurve 'p-256' (lowercase) or 'P256' (missing dash); importing a JWK EC key with an unsupported crv value.","commonSituations":"Blockchain/secp256k1-related signing code ported into load tests; curve names copied from other libraries (Node crypto, jose) that use different spellings; case-sensitive copy-paste errors.","solutions":["Use exactly 'P-256', 'P-384', or 'P-521' as namedCurve","Check for typos, casing and the dash in the curve string","For non-NIST curves, k6's webcrypto cannot generate/sign — precompute keys or offload the operation"],"exampleFix":"// before\nconst key = await crypto.subtle.generateKey(\n  { name: 'ECDSA', namedCurve: 'secp256k1', hash: 'SHA-256' }, true, ['sign', 'verify']);\n\n// after\nconst key = await crypto.subtle.generateKey(\n  { name: 'ECDSA', namedCurve: 'P-256', hash: 'SHA-256' }, true, ['sign', 'verify']);","handlingStrategy":"validation","validationCode":"const SUPPORTED_EC_CURVES = ['P-256', 'P-384', 'P-521'];\nif (!SUPPORTED_EC_CURVES.includes(alg.namedCurve)) {\n  throw new Error(`unsupported EC curve ${alg.namedCurve}`);\n}","typeGuard":"const isSupportedCurve = (c) => ['P-256', 'P-384', 'P-521'].includes(c);","tryCatchPattern":"try {\n  key = await crypto.subtle.generateKey({ name: 'ECDSA', namedCurve, hash: { name: 'SHA-256' } }, true, ['sign', 'verify']);\n} catch (e) {\n  if (String(e.message).includes('invalid elliptic curve')) throw new Error(`namedCurve '${namedCurve}' unsupported/misspelled; use P-256/P-384/P-521`);\n  throw e;\n}","preventionTips":["Use exact canonical spellings P-256, P-384, P-521","Validate curve strings from config/env before passing them to webcrypto","Confirm the JWK crv value when importing EC keys — it must be one of the three"],"tags":["webcrypto","ecdsa","elliptic-curve","validation"],"backgroundTag":null,"analyzedSha":"93accf6570dcd306ca5e99cc44c393ee3797761b","analyzedAt":"2026-08-15T21:23:27.118Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}