{"record":{"id":"a6872189193ffdc9","repo":"gravitational/teleport","slug":"public-key-representation-too-small-v-bytes","errorCode":null,"errorMessage":"public key representation too small (%v bytes)","messagePattern":"public key representation too small \\((.+?) bytes\\)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/darwin/pub_key.go","lineNumber":37,"sourceCode":"package darwin\n\nimport (\n\t\"crypto/ecdsa\"\n\t\"crypto/elliptic\"\n\t\"fmt\"\n\t\"math/big\"\n)\n\n// ECDSAPublicKeyFromRaw reads an ECDSA public key from a raw Apple public key,\n// as returned by SecKeyCopyExternalRepresentation.\nfunc ECDSAPublicKeyFromRaw(pubKeyRaw []byte) (*ecdsa.PublicKey, error) {\n\t// Verify key length to avoid a potential panic below.\n\t// 3 is the smallest number that clears it, but in practice 65 is the more\n\t// common length.\n\t// Apple's docs make no guarantees, hence no assumptions are made here.\n\tswitch l := len(pubKeyRaw); {\n\tcase l < 3:\n\t\treturn nil, fmt.Errorf(\"public key representation too small (%v bytes)\", l)\n\tcase l%2 != 1: // 0x4+keyLen+keyLen is always odd, see explanation below.\n\t\treturn nil, fmt.Errorf(\"public key representation has unexpected length (%v bytes)\", l)\n\tcase pubKeyRaw[0] != 0x04: // See explanation below.\n\t\treturn nil, fmt.Errorf(\"public key representation starts with unexpected byte (%#x vs 0x4)\", pubKeyRaw[0])\n\t}\n\n\t// \"For an elliptic curve public key, the format follows the ANSI X9.63\n\t// standard using a byte string of 04 || X || Y. (...) All of these\n\t// representations use constant size integers, including leading zeros as\n\t// needed.\"\n\t// https://developer.apple.com/documentation/security/1643698-seckeycopyexternalrepresentation?language=objc\n\tpubKeyRaw = pubKeyRaw[1:] // skip 0x4\n\tl := len(pubKeyRaw) / 2\n\tx := pubKeyRaw[:l]\n\ty := pubKeyRaw[l:]\n\n\treturn &ecdsa.PublicKey{\n\t\tCurve: elliptic.P256(),","sourceCodeStart":19,"sourceCodeEnd":55,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/lib/darwin/pub_key.go#L19-L55","documentation":"ECDSAPublicKeyFromRaw validates the raw SecKeyCopyExternalRepresentation bytes before parsing: fewer than 3 bytes cannot possibly contain a point header plus coordinates, so parsing would panic; the input public key data is truncated or corrupt.","triggerScenarios":"Thrown at lib/darwin/pub_key.go:37 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Re-fetch the credential from the macOS Keychain / SecKey API to obtain the full raw representation","Verify the stored credential is an ECDSA key and the bytes were not truncated in transit or storage"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}