{"record":{"id":"a690b43fec8f5813","repo":"OpenNHP/opennhp","slug":"unsupported-key-type-expect-rsa","errorCode":null,"errorMessage":"unsupported key type, expect RSA","messagePattern":"unsupported key type, expect RSA","errorType":"http","errorClass":null,"httpStatus":400,"severity":"error","filePath":"endpoints/server/kbs/attest/attest.go","lineNumber":103,"sourceCode":"\tteePubKeys.Lock()\n\tteePubKeys.data[token] = teePubKey\n\tteePubKeys.Unlock()\n\n\tc.SetCookie(\n\t\t\"kbs-session-id\",\n\t\tsessionID,\n\t\t3600,\n\t\t\"/\", \"\", true, true, // Secure: only send over HTTPS\n\t)\n\n\tc.JSON(http.StatusOK, gin.H{\n\t\t\"token\": token,\n\t})\n}\n\nfunc parseTeePubkey(pubkey TeePubkey) (*rsa.PublicKey, error) {\n\tif pubkey.Kty != \"RSA\" {\n\t\treturn nil, errors.New(\"unsupported key type, expect RSA\")\n\t}\n\n\tnBytes, err := base64.RawURLEncoding.DecodeString(pubkey.N)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"invalid n: %w\", err)\n\t}\n\n\teBytes, err := base64.RawURLEncoding.DecodeString(pubkey.E)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"invalid e: %w\", err)\n\t}\n\n\te := 0\n\tfor _, b := range eBytes {\n\t\te = e<<8 | int(b)\n\t}\n\n\treturn &rsa.PublicKey{","sourceCodeStart":85,"sourceCodeEnd":121,"githubUrl":"https://github.com/OpenNHP/opennhp/blob/6e04ca5ff03222a699c24205cd4bf8fee9af7ffe/endpoints/server/kbs/attest/attest.go#L85-L121","documentation":"parseTeePubkey only supports RSA keys when converting a TEE attestation's COSE/CBOR public key into an *rsa.PublicKey. If the key type (kty) field of the attested TEE pubkey is anything other than \"RSA\" (e.g. EC2/EC, OKP), attestation is rejected.","triggerScenarios":"Attest() receives a TEE evidence token whose pubkey.kty is not \"RSA\" — e.g. the TEE (or its signing attester) was configured to produce EC keys, or a malformed/forged token supplies a different kty.","commonSituations":"Migrating confidential-computing workloads (SEV-SNP/TDX guests) that emit EC P-256 keys, upgrading attestation SDKs that changed the default key algorithm, or testing with keys generated by a crypto library defaulting to elliptic curves.","solutions":["Configure the TEE/attester to generate RSA keys for its attestation public key","Extend parseTeePubkey to handle the kty you actually use (e.g. EC2 -> ecdsa.PublicKey)","Verify the pubkey JSON/N/E fields come from the expected attestation format","Check the attestation SDK version didn't change the default key type"],"exampleFix":"// before\nif pubkey.Kty != \"RSA\" {\n    return nil, errors.New(\"unsupported key type, expect RSA\")\n}\n// after\nswitch pubkey.Kty {\ncase \"RSA\":\n    return parseRSAPubkey(pubkey)\ncase \"EC2\":\n    return parseECPubkey(pubkey)\ndefault:\n    return nil, fmt.Errorf(\"unsupported key type: %s\", pubkey.Kty)\n}","handlingStrategy":"validation","validationCode":"pubkey, err := extractTeePubkey(evidence)\nif err != nil { return err }\nif pubkey.Kty != \"RSA\" {\n    return fmt.Errorf(\"TEE produced %q key; configure RSA or extend parser\", pubkey.Kty)\n}","typeGuard":"func isRSATeePubkey(k TeePubkey) bool { return k.Kty == \"RSA\" && k.N != \"\" && k.E != \"\" }","tryCatchPattern":"pk, err := parseTeePubkey(tp)\nif err != nil {\n    if strings.Contains(err.Error(), \"unsupported key type\") {\n        log.Errorf(\"attester must emit RSA keys: %v\", err)\n    }\n    return err\n}","preventionTips":["Pin the attestation SDK/key-algorithm config to RSA","Add an integration test attesting with the real TEE to catch key-type drift","Log the received kty before failing to ease diagnosis"],"tags":["go","attestation","rsa","tee"],"backgroundTag":"unsupported-key-type","analyzedSha":"6e04ca5ff03222a699c24205cd4bf8fee9af7ffe","analyzedAt":"2026-09-07T15:44:59.941Z","contentChangedAt":"2026-09-07T15:44:59.941Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}