{"record":{"id":"95be839242917346","repo":"TechnitiumSoftware/DnsServer","slug":"dnssec-private-key-format-is-invalid","errorCode":null,"errorMessage":"DNSSEC private key format is invalid.","messagePattern":"DNSSEC private key format is invalid\\.","errorType":"exception","errorClass":"InvalidDataException","httpStatus":null,"severity":"error","filePath":"DnsServerCore/Dns/Dnssec/DnssecPrivateKey.cs","lineNumber":286,"sourceCode":"\n                case DnssecAlgorithm.ED448:\n                    using (PemReader pemReader = new PemReader(new StringReader(pemPrivateKey)))\n                    {\n                        if (pemReader.ReadObject() is not Ed448PrivateKeyParameters privateKey)\n                            throw new ArgumentException($\"The EdDSA ({(keyType == DnssecPrivateKeyType.KeySigningKey ? \"KSK\" : \"ZSK\")}) private key must be for Ed448 curve.\", nameof(pemPrivateKey));\n\n                        return new DnssecEddsaPrivateKey(keyType, privateKey);\n                    }\n\n                default:\n                    throw new NotSupportedException(\"DNSSEC algorithm is not supported: \" + algorithm.ToString());\n            }\n        }\n\n        public static DnssecPrivateKey ReadFrom(BinaryReader bR)\n        {\n            if (Encoding.ASCII.GetString(bR.BaseStream.ReadExactly(2)) != \"DK\")\n                throw new InvalidDataException(\"DNSSEC private key format is invalid.\");\n\n            int version = bR.ReadByte();\n            switch (version)\n            {\n                case 1:\n                case 2:\n                    DnssecAlgorithm algorithm = (DnssecAlgorithm)bR.ReadByte();\n                    switch (algorithm)\n                    {\n                        case DnssecAlgorithm.RSAMD5:\n                        case DnssecAlgorithm.RSASHA1:\n                        case DnssecAlgorithm.RSASHA1_NSEC3_SHA1:\n                        case DnssecAlgorithm.RSASHA256:\n                        case DnssecAlgorithm.RSASHA512:\n                            return new DnssecRsaPrivateKey(algorithm, bR, version);\n\n                        case DnssecAlgorithm.ECDSAP256SHA256:\n                        case DnssecAlgorithm.ECDSAP384SHA384:","sourceCodeStart":268,"sourceCodeEnd":304,"githubUrl":"https://github.com/TechnitiumSoftware/DnsServer/blob/d0484b6c1e7439cdc53d67d81e9c876cda2ad756/DnsServerCore/Dns/Dnssec/DnssecPrivateKey.cs#L268-L304","documentation":"Thrown by DnssecPrivateKey.ReadFrom when the first two bytes of the binary stream are not the ASCII magic \"DK\". This is the format signature of the library's proprietary DNSSEC private-key serialization; a missing/wrong magic means the data is corrupt, truncated, or not a DNSSEC key blob at all.","triggerScenarios":"Calling DnssecPrivateKey.ReadFrom(binaryReader) on a stream whose first 2 bytes are not \"DK\" — e.g. a different file format, a corrupted key file, or a stream positioned past the start.","commonSituations":"Loading a non-key file (zone file, cert, PEM text) as a binary key; truncated download; reading from the wrong stream offset; version mismatch where the file was written by incompatible tooling.","solutions":["Ensure you are loading a file previously written by this library's DNSSEC key export (starts with \"DK\").","Verify the file length and that the stream is at position 0 before reading.","If you have a PEM instead, use the Create(algorithm, keyType, pem) overload rather than ReadFrom."],"exampleFix":"// before\nusing var fs = File.OpenRead(\"zone.txt\");\nvar key = DnssecPrivateKey.ReadFrom(new BinaryReader(fs)); // wrong file\n\n// after\nusing var fs = File.OpenRead(\"ksk.dnssec.key\"); // file written by this library\nvar key = DnssecPrivateKey.ReadFrom(new BinaryReader(fs));","handlingStrategy":"validation","validationCode":"using var fs = File.OpenRead(path);\nusing var br = new BinaryReader(fs);\nSpan<byte> magic = stackalloc byte[2]; br.BaseStream.ReadExactly(magic);\nif (Encoding.ASCII.GetString(magic) != \"DK\")\n    throw new InvalidDataException($\"{path} is not a DNSSEC private key file (bad magic).\");\nbr.BaseStream.Seek(0, SeekOrigin.Begin);\nvar key = DnssecPrivateKey.ReadFrom(br);","typeGuard":"static bool LooksLikeDnssecKeyFile(string path)\n{\n    try\n    {\n        using var fs = File.OpenRead(path);\n        Span<byte> b = stackalloc byte[2]; fs.ReadExactly(b);\n        return b[0] == (byte)'D' && b[1] == (byte)'K';\n    }\n    catch { return false; }\n}","tryCatchPattern":"try { return DnssecPrivateKey.ReadFrom(reader); }\ncatch (InvalidDataException ex) { throw new ConfigurationErrorsException(\"Selected file is not a valid DNSSEC key blob.\", ex); }","preventionTips":["Verify the \"DK\" magic before parsing.","Keep key files in a dedicated directory with a distinct extension.","If you have a PEM, use the Create(..., pem) overload instead of ReadFrom."],"tags":["dns","dnssec","crypto","serialization","binary","format"],"backgroundTag":null,"analyzedSha":"d0484b6c1e7439cdc53d67d81e9c876cda2ad756","analyzedAt":"2026-08-13T22:57:35.508Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}