{"record":{"id":"9235e1e263fab50d","repo":"grafana/k6","slug":"failed-to-decode-first-prime-factor-w","errorCode":null,"errorMessage":"failed to decode first prime factor: %w","messagePattern":"failed to decode first prime factor: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/js/modules/k6/webcrypto/jwk.go","lineNumber":362,"sourceCode":"\t// convert exponent to an integer\n\teInt := new(big.Int).SetBytes(eBytes).Int64()\n\tpubKey := rsa.PublicKey{\n\t\tN: new(big.Int).SetBytes(nBytes),\n\t\tE: int(eInt),\n\t}\n\n\t// if the private exponent is missing, return the public key\n\tif jwk.D == \"\" {\n\t\treturn pubKey, PublicCryptoKeyType, pubKey.N.BitLen(), nil\n\t}\n\n\tdBytes, err := base64URLDecode(jwk.D)\n\tif err != nil {\n\t\treturn nil, UnknownCryptoKeyType, 0, fmt.Errorf(\"failed to decode private exponent: %w\", err)\n\t}\n\tpBytes, err := base64URLDecode(jwk.P)\n\tif err != nil {\n\t\treturn nil, UnknownCryptoKeyType, 0, fmt.Errorf(\"failed to decode first prime factor: %w\", err)\n\t}\n\tqBytes, err := base64URLDecode(jwk.Q)\n\tif err != nil {\n\t\treturn nil, UnknownCryptoKeyType, 0, fmt.Errorf(\"failed to decode second prime factor: %w\", err)\n\t}\n\tdpBytes, err := base64URLDecode(jwk.Dp)\n\tif err != nil {\n\t\treturn nil, UnknownCryptoKeyType, 0, fmt.Errorf(\"failed to decode first exponent: %w\", err)\n\t}\n\tdqBytes, err := base64URLDecode(jwk.Dq)\n\tif err != nil {\n\t\treturn nil, UnknownCryptoKeyType, 0, fmt.Errorf(\"failed to decode second exponent: %w\", err)\n\t}\n\tqiBytes, err := base64URLDecode(jwk.Qi)\n\tif err != nil {\n\t\treturn nil, UnknownCryptoKeyType, 0, fmt.Errorf(\"failed to decode coefficient: %w\", err)\n\t}\n","sourceCodeStart":344,"sourceCodeEnd":380,"githubUrl":"https://github.com/grafana/k6/blob/93accf6570dcd306ca5e99cc44c393ee3797761b/internal/js/modules/k6/webcrypto/jwk.go#L344-L380","documentation":"For RSA private-key JWK import, the first prime factor p is decoded with base64.RawURLEncoding. This error indicates p is not valid unpadded base64url (padding, '+'/'/' characters, whitespace, or bad length). Note the field is only read once d is present, so public-key imports never hit it.","triggerScenarios":"p in padded or standard base64; p truncated; p missing-but-typed incorrectly (an empty p decodes as empty bytes and fails later at key validation, not here); whitespace inside p.","commonSituations":"Private JWKs assembled from PEM-derived values; primes re-encoded by intermediate systems; multi-line PEM body mistakenly used as p.","solutions":["Convert p to unpadded base64url","Strip whitespace/newlines from the value","Verify the decoded length is roughly half the modulus size (128 bytes for RSA-2048)","Re-export the full private JWK from the original key material rather than assembling field by field"],"exampleFix":"// before\nconst jwk = { kty: 'RSA', n, e: 'AQAB', d, p: pemBodyP, q, dp, dq, qi };\n// after\nconst toB64u = (s) => s.replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '').replace(/\\s+/g, '');\nconst jwk = { kty: 'RSA', n, e: 'AQAB', d, p: toB64u(pemBodyP), q, dp, dq, qi };","handlingStrategy":"validation","validationCode":"const B64URL = /^[A-Za-z0-9_-]+$/;\nif (jwk.p !== undefined) {\n  const p = String(jwk.p).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '').replace(/\\s+/g, '');\n  if (!B64URL.test(p)) throw new Error('prime p is not unpadded base64url');\n  jwk = { ...jwk, p };\n}","typeGuard":"function isB64uPrime(s) {\n  return typeof s === 'string' && /^[A-Za-z0-9_-]+$/.test(s) && s.length >= 20;\n}","tryCatchPattern":"try {\n  key = await crypto.subtle.importKey('jwk', jwk, rsaAlg, true, usages);\n} catch (e) {\n  if (e.message.includes('failed to decode first prime factor')) {\n    jwk = { ...jwk, p: toB64u(jwk.p) };\n    key = await crypto.subtle.importKey('jwk', jwk, rsaAlg, true, usages);\n  } else throw e;\n}","preventionTips":["Normalize all private fields (d, p, q, dp, dq, qi) together in one pass","Do not assemble private JWKs from PEM dumps field by field; export a complete JWK","Check p decodes to about half the modulus length"],"tags":["webcrypto","jwk","import","rsa","base64url","private-key","k6"],"backgroundTag":null,"analyzedSha":"93accf6570dcd306ca5e99cc44c393ee3797761b","analyzedAt":"2026-08-15T21:23:27.118Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}