{"record":{"id":"a95b62af5b5dee96","repo":"ipfs/kubo","slug":"invalid-key-size-d-s-keys-are-always-d-bits","errorCode":null,"errorMessage":"invalid key size %d: %s keys are always %d bits","messagePattern":"invalid key size (.+?): (.+?) keys are always (.+?) bits","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/coreiface/options/key.go","lineNumber":110,"sourceCode":"// CheckKeySize validates a requested key size for the given algorithm. RSA\n// accepts any size (callers apply DefaultRSALen when it is unset). ed25519 and\n// secp256k1 have a fixed size, so a size is accepted only when it is unset (-1)\n// or equals that size, and rejected otherwise.\nfunc CheckKeySize(algorithm string, size int) error {\n\tif size == -1 {\n\t\treturn nil\n\t}\n\tvar fixed int\n\tswitch algorithm {\n\tcase \"ed25519\":\n\t\tfixed = ed25519KeyBits\n\tcase \"secp256k1\":\n\t\tfixed = secp256k1KeyBits\n\tdefault:\n\t\treturn nil\n\t}\n\tif size != fixed {\n\t\treturn fmt.Errorf(\"invalid key size %d: %s keys are always %d bits\", size, algorithm, fixed)\n\t}\n\treturn nil\n}\n\n// Force is an option for Key.Rename which specifies whether to allow to\n// replace existing keys.\nfunc (keyOpts) Force(force bool) KeyRenameOption {\n\treturn func(settings *KeyRenameSettings) error {\n\t\tsettings.Force = force\n\t\treturn nil\n\t}\n}\n","sourceCodeStart":92,"sourceCodeEnd":123,"githubUrl":"https://github.com/ipfs/kubo/blob/329838acdfafae224582930457efe80aa217afc0/core/coreiface/options/key.go#L92-L123","documentation":"This error is thrown by CheckKeySize in the IPFS interface options package when an RSA or secp256k1 key is requested with a bit size that does not match the algorithm's fixed requirement. secp256k1 keys must always be a fixed size (secp256k1KeyBits), and RSA keys must meet the algorithm's required size. The library validates this early (during option construction in CreateIdentity) so key generation fails fast with a clear message instead of deep in crypto code.","triggerScenarios":"Calling CreateIdentity with opts.Key.Size set to a value that does not equal secp256k1KeyBits for algorithm \"secp256k1\", or passing an invalid size for RSA keys. Any caller that passes a user-supplied key size without checking it against the algorithm's fixed bit length will produce this error.","commonSituations":"Hardcoding a generic key size like 2048 or 4096 for secp256k1 (which only supports its single fixed bit size); copying RSA key-size configuration into a secp256k1 identity; reading key size from config or CLI flags without validating per-algorithm constraints.","solutions":["For secp256k1, remove the Key.Size option entirely or set it to exactly secp256k1KeyBits (256) — secp256k1 has one valid size","For RSA, use one of the documented valid sizes (e.g. 2048, 4096)","Validate user/config-supplied key sizes against the algorithm before calling CreateIdentity","Use options.Key.Type to confirm which algorithm you are requesting, since the required size depends on it"],"exampleFix":"// before\nopts, err := options.CreateIdentity(\"my-key\",\n    options.Key.Type(options.Ed25519Key),\n    options.Key.Size(2048)) // wrong: fixed-size algorithm\n// after\nopts, err := options.CreateIdentity(\"my-key\",\n    options.Key.Type(options.Secp256k1Key),\n    options.Key.Size(256)) // secp256k1KeyBits","handlingStrategy":"validation","validationCode":"const secp256k1KeyBits = 256\nfunc validKeySize(algorithm string, size int) error {\n    switch algorithm {\n    case \"secp256k1\":\n        if size != secp256k1KeyBits {\n            return fmt.Errorf(\"secp256k1 requires %d-bit keys, got %d\", secp256k1KeyBits, size)\n        }\n    case \"rsa\":\n        if size < 2048 {\n            return fmt.Errorf(\"rsa key size %d too small\", size)\n        }\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"opts, err := options.CreateIdentity(name, optfs...)\nif err != nil {\n    var cerr *fmt.Errorf // treat as user-input validation failure\n    return fmt.Errorf(\"identity options rejected: %w\", err)\n}","preventionTips":["Never pass a Key.Size option when using secp256k1 or Ed25519 (fixed-size algorithms)","Validate key size from config/flags against the chosen algorithm before building options","Let the library defaults decide the size unless the user explicitly requires a custom RSA size"],"tags":["go","ipfs","key-generation","validation"],"backgroundTag":"invalid-key-size","analyzedSha":"329838acdfafae224582930457efe80aa217afc0","analyzedAt":"2026-09-03T18:30:52.135Z","contentChangedAt":"2026-09-03T18:30:52.135Z","schemaVersion":2},"datasetVersion":"2026-09-11T00:17:11.886Z"}