{"record":{"id":"ac22544d52f45198","repo":"nautechsystems/nautilus_trader","slug":"failed-to-generate-rsa-signature","errorCode":null,"errorMessage":"Failed to generate RSA signature","messagePattern":"Failed to generate RSA signature","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/cryptography/src/signing.rs","lineNumber":73,"sourceCode":"        anyhow::bail!(\"PEM does not contain a private key\");\n    }\n\n    // Construct RSA key pair from PKCS#8 DER bytes\n    let key_pair = KeyPair::from_pkcs8(pem.contents())\n        .map_err(|_| anyhow::anyhow!(\"Failed to decode RSA private key\"))?;\n\n    // Prepare RNG and output buffer (signature length = modulus length)\n    let rng = lc_rand::SystemRandom::new();\n    let mut signature = vec![0u8; key_pair.public_modulus_len()];\n\n    key_pair\n        .sign(\n            &lc_signature::RSA_PKCS1_SHA256,\n            &rng,\n            data.as_bytes(),\n            &mut signature,\n        )\n        .map_err(|_| anyhow::anyhow!(\"Failed to generate RSA signature\"))?;\n\n    Ok(BASE64_STANDARD.encode(signature))\n}\n\n/// Signs `data` using Ed25519 with the provided private key seed.\n///\n/// # Errors\n///\n/// Returns an error if the provided private key seed is invalid or signature creation fails.\npub fn ed25519_signature(private_key: &[u8], data: &str) -> anyhow::Result<String> {\n    let signing_key = SigningKey::from_bytes(\n        private_key\n            .try_into()\n            .map_err(|_| anyhow::anyhow!(\"Invalid Ed25519 private key length\"))?,\n    );\n    let signature: Ed25519Signature = signing_key.sign(data.as_bytes());\n    Ok(BASE64_STANDARD.encode(signature.to_bytes()))\n}","sourceCodeStart":55,"sourceCodeEnd":91,"githubUrl":"https://github.com/nautechsystems/nautilus_trader/blob/18893faf8b356be3320add8de2f861b0b647cf06/crates/cryptography/src/signing.rs#L55-L91","documentation":"After successfully loading the RSA key pair, `rsa_signature` signs the data with RSA PKCS#1 v1.5 + SHA-256 using ring's `KeyPair::sign`. This error is returned if ring's signing operation fails. With a validly constructed `KeyPair` this is rare, since PKCS#1 signing over any byte slice has no runtime failure modes other than RNG failure.","triggerScenarios":"Calling `rsa_signature(pem, data)` (via `py_rsa_signature` or tests) where the underlying `lc_rand::SystemRandom` cannot supply randomness (entropy source unavailable) or ring rejects the sign request internally — the sign call returns `Err` and is mapped to this message.","commonSituations":"Running on a platform/container where the system entropy source is unavailable or restricted (hardened sandbox, exotic OS build of ring without RNG support); extremely large `data` inputs are NOT a cause — RSA PKCS#1 hashes first.","solutions":["Check that the OS entropy source is available (`/dev/urandom` readable, `getrandom` syscall permitted); fix container seccomp/sandbox policy if it blocks it.","Retry the operation once — RNG failures are typically transient/environmental.","If it persists, verify ring/lc-rand builds correctly for the target platform and update the dependency versions.","Confirm the key loaded successfully (no preceding 3920 error) — a corrupted key path should be ruled out first by testing key validity with `openssl pkey -check`."],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"// sign failures here are environmental (RNG); retry a bounded number of times\nfor attempt in 0..3 {\n    match rsa_signature(&pem, data) {\n        Ok(sig) => break Ok(sig),\n        Err(e) if e.to_string().contains(\"Failed to generate RSA signature\") && attempt < 2 => {\n            eprintln!(\"sign attempt {} failed, retrying: {e}\", attempt + 1);\n            continue;\n        }\n        Err(e) => break Err(e),\n    }\n}","preventionTips":["Ensure deployments run on platforms with a working entropy source (`/dev/urandom`, getrandom).","Do not run signing workloads inside sandboxes/seccomp profiles that block getrandom(2).","Keep ring/lc-rand dependencies up to date for your target platform.","Distinguish this error from key-decode errors in logs so environmental vs key issues aren't conflated."],"tags":["cryptography","rsa","signing","rng"],"backgroundTag":"api-request-failed","analyzedSha":"18893faf8b356be3320add8de2f861b0b647cf06","analyzedAt":"2026-09-08T20:49:34.690Z","contentChangedAt":"2026-09-08T20:49:34.690Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}