{"record":{"id":"94c6f5cdc1337d3d","repo":"ipfs/kubo","slug":"creating-identity-v","errorCode":null,"errorMessage":"creating identity (%v)","messagePattern":"creating identity \\((.+?)\\)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/commands/keystore.go","lineNumber":798,"sourceCode":"\tcfg, err := repo.Config()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"reading config from repo (%v)\", err)\n\t}\n\n\t// Generate new identity\n\tvar identity config.Identity\n\tif nBitsGiven {\n\t\tidentity, err = config.CreateIdentity(out, []options.KeyGenerateOption{\n\t\t\toptions.Key.Size(nBitsForKeypair),\n\t\t\toptions.Key.Type(algorithm),\n\t\t})\n\t} else {\n\t\tidentity, err = config.CreateIdentity(out, []options.KeyGenerateOption{\n\t\t\toptions.Key.Type(algorithm),\n\t\t})\n\t}\n\tif err != nil {\n\t\treturn fmt.Errorf(\"creating identity (%v)\", err)\n\t}\n\n\t// Save old identity to keystore\n\toldPrivKey, err := cfg.Identity.DecodePrivateKey(\"\")\n\tif err != nil {\n\t\treturn fmt.Errorf(\"decoding old private key (%v)\", err)\n\t}\n\tkeystore := repo.Keystore()\n\tif err := keystore.Put(oldKey, oldPrivKey); err != nil {\n\t\treturn fmt.Errorf(\"saving old key in keystore (%v)\", err)\n\t}\n\n\t// Update identity\n\tcfg.Identity = identity\n\n\t// Write config file to repo\n\tif err = repo.SetConfig(cfg); err != nil {\n\t\treturn fmt.Errorf(\"saving new key to config (%v)\", err)","sourceCodeStart":780,"sourceCodeEnd":816,"githubUrl":"https://github.com/ipfs/kubo/blob/329838acdfafae224582930457efe80aa217afc0/core/commands/keystore.go#L780-L816","documentation":"doRotate generates the new node identity via config.CreateIdentity using either the explicit key-size option or the requested algorithm (e.g. ed25519, rsa). If key generation fails — unsupported algorithm, bad key size for RSA, or entropy source failure — the error is wrapped as \"creating identity (%v)\".","triggerScenarios":"`ipfs key rotate -t <unsupported-type>`; `ipfs key rotate -t rsa -s 1024` (below accepted minimum); `-s` supplied without `-t rsa` misuse; invalid algorithm string passed via keyStoreTypeOptionName.","commonSituations":"Typo in algorithm name (e.g. `-t ED25519` vs expected casing); requesting RSA sizes the crypto library rejects; rotating on a system where crypto/rand fails (rare, e.g. broken getrandom).","solutions":["Use a supported algorithm: `ipfs key rotate -t ed25519` (recommended, no size needed)","For RSA use `ipfs key rotate -t rsa -s 4096` (2048 or 4096 bits)","Check `ipfs key gen -t <type>` with the same type to validate the algorithm name before rotating","Read the wrapped error for the exact cause reported by go-libp2p crypto"],"exampleFix":"// before\nipfs key rotate -t rsa -s 1024\n// after\nipfs key rotate -t rsa -s 4096","handlingStrategy":"validation","validationCode":"// validate algorithm first with key gen on a scratch name\nipfs key gen _probe -t ed25519 && ipfs key rm _probe\n// then rotate\nipfs key rotate -t ed25519 --old-key=old-self","typeGuard":null,"tryCatchPattern":"if err := doRotate(...); err != nil {\n    if strings.Contains(err.Error(), \"creating identity\") {\n        // fall back to a known-good algorithm: -t ed25519\n    }\n}","preventionTips":["Prefer ed25519 (no key size needed, fast)","For RSA, use 2048 or 4096 bits only","Test the algorithm via `ipfs key gen` before rotating the node identity"],"tags":["crypto","identity","key-generation","cli"],"backgroundTag":"unsupported-key-type","analyzedSha":"329838acdfafae224582930457efe80aa217afc0","analyzedAt":"2026-09-03T18:30:52.135Z","contentChangedAt":"2026-09-03T18:30:52.135Z","schemaVersion":2},"datasetVersion":"2026-09-11T00:17:11.886Z"}