{"record":{"id":"9ec6f20e2174827e","repo":"jwtk/jjwt","slug":"invalid-id-asn-1-encoding-t-getmessage","errorCode":null,"errorMessage":"Invalid ${id} ASN.1 encoding: ${t.getMessage()}","messagePattern":"Invalid (.+?) ASN\\.1 encoding: (.+?)","errorType":"exception","errorClass":"io.jsonwebtoken.security.InvalidKeyException","httpStatus":null,"severity":"error","filePath":"impl/src/main/java/io/jsonwebtoken/impl/security/EdwardsCurve.java","lineNumber":200,"sourceCode":"        this.PUBLIC_KEY_ASN1_PREFIX = publicKeyAsn1Prefix(this.encodedKeyByteLength, this.ASN1_OID);\n        this.PRIVATE_KEY_ASN1_PREFIX = privateKeyPkcs8Prefix(this.encodedKeyByteLength, this.ASN1_OID, true);\n        this.PRIVATE_KEY_JDK11_PREFIX = privateKeyPkcs8Prefix(this.encodedKeyByteLength, this.ASN1_OID, false);\n    }\n\n    @Override\n    public int getKeyBitLength() {\n        return this.keyBitLength;\n    }\n\n    public byte[] getKeyMaterial(Key key) {\n        try {\n            return doGetKeyMaterial(key); // can throw assertion and ArrayIndexOutOfBound exception on invalid input\n        } catch (Throwable t) {\n            if (t instanceof KeyException) { //propagate\n                throw (KeyException) t;\n            }\n            String msg = \"Invalid \" + getId() + \" ASN.1 encoding: \" + t.getMessage();\n            throw new InvalidKeyException(msg, t);\n        }\n    }\n\n    /**\n     * Parses the ASN.1-encoding of the specified key\n     *\n     * @param key the Edwards curve key\n     * @return the key value, encoded according to <a href=\"https://www.rfc-editor.org/rfc/rfc8032\">RFC 8032</a>\n     * @throws RuntimeException if the key's encoded bytes do not reflect a validly ASN.1-encoded edwards key\n     */\n    protected byte[] doGetKeyMaterial(Key key) {\n        byte[] encoded = KeysBridge.getEncoded(key);\n        try {\n            int i = Bytes.indexOf(encoded, ASN1_OID);\n            Assert.gt(i, -1, \"Missing or incorrect algorithm OID.\");\n            i = i + ASN1_OID.length;\n            int keyLen = 0;\n            if (encoded[i] == 0x05) { // NULL terminator, next should be zero byte indicator","sourceCodeStart":182,"sourceCodeEnd":218,"githubUrl":"https://github.com/jwtk/jjwt/blob/fb71496164c71442d08adec4571d9616ed5e1b8d/impl/src/main/java/io/jsonwebtoken/impl/security/EdwardsCurve.java#L182-L218","documentation":"Edwards curve keys (Ed25519/Ed448/X25519/X448) are stored and exchanged via a fixed ASN.1 (PKCS#8/SubjectPublicKeyInfo-style) encoding prefixed by a curve-specific DER header. When EdwardsCurve.getKeyMaterial parses a key's encoded bytes and the ASN.1 structure fails to decode (or is out of bounds), the raw cause is wrapped into an InvalidKeyException with this message.","triggerScenarios":"Passing a key whose encoded bytes do not follow the expected ASN.1 layout for the curve — e.g. a key generated/serialized by a different library format, an Ed25519 key bytes truncated or prefixed incorrectly, or feeding a non-Edwards key's bytes into EdwardsCurve parsing via findByKey/pkBytes/d/x.","commonSituations":"Interoperability with OpenSSL or other libraries that export keys in a different DER layout; manually constructing PrivateKey objects from raw bytes without the DER prefix; copy-paste corruption of base64 key material; using a P-256 EC key where an OKP key is expected.","solutions":["Regenerate or re-export the key in standard PKCS#8 (private) / X.509 SPKI (public) DER format compatible with the curve.","Do not strip or manually prepend the ASN.1 prefix bytes; let jjwt/JCE encode the key.","Inspect the exception's cause (t) to see the exact ASN.1 parse failure and fix the encoding.","Verify the key is actually an Edwards-curve key, not an ordinary EC key."],"exampleFix":"// before: building a private key from raw seed bytes with wrong wrapping\nPrivateKey key = new RawEdPrivateKey(seedBytes);\n// after\nKeyPair kp = Jwts.SIG.EdDSA.keyPair().build();\nPrivateKey key = kp.getPrivate();","handlingStrategy":"try-catch","validationCode":"byte[] enc = key.getEncoded();\nif (enc == null || enc.length < 16) throw new IllegalArgumentException(\"Key has no/short encoded form; expected PKCS#8 or SPKI DER\");","typeGuard":null,"tryCatchPattern":"try {\n  PublicKey pub = EdwardsCurve.Ed25519.toPublicKey(xBytes, null);\n} catch (InvalidKeyException e) {\n  // cause holds the ASN.1 parse error; fix the encoding\n  Throwable cause = e.getCause();\n}","preventionTips":["Export keys in standard DER (PKCS#8/SPKI) formats","Do not strip or hand-craft ASN.1 prefix bytes","Verify key is an Edwards-curve key before parsing"],"tags":["asn1","ed25519","key-encoding","invalid-key"],"backgroundTag":"invalid-key-format","analyzedSha":"fb71496164c71442d08adec4571d9616ed5e1b8d","analyzedAt":"2026-09-09T00:33:09.982Z","contentChangedAt":"2026-09-09T00:33:09.982Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}