{"record":{"id":"aca244ead857c788","repo":"tailscale/tailscale","slug":"unrecognized-key-kind-v","errorCode":null,"errorMessage":"unrecognized key kind: %v","messagePattern":"unrecognized key kind: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"tka/key.go","lineNumber":131,"sourceCode":"\t}\n\n\t// We have an arbitrary upper limit on the amount\n\t// of metadata that can be associated with a key, so\n\t// people don't start using it as a key-value store and\n\t// causing pathological cases due to the number + size of\n\t// AUMs.\n\tvar metaBytes uint\n\tfor k, v := range k.Meta {\n\t\tmetaBytes += uint(len(k) + len(v))\n\t}\n\tif metaBytes > maxMetaBytes {\n\t\treturn fmt.Errorf(\"key metadata too big (%d > %d)\", metaBytes, maxMetaBytes)\n\t}\n\n\tswitch k.Kind {\n\tcase Key25519:\n\tdefault:\n\t\treturn fmt.Errorf(\"unrecognized key kind: %v\", k.Kind)\n\t}\n\treturn nil\n}\n","sourceCodeStart":113,"sourceCodeEnd":135,"githubUrl":"https://github.com/tailscale/tailscale/blob/6e0912f97994f927632b34ae9e63b53d6516a6ac/tka/key.go#L113-L135","documentation":"Only ed25519 keys (Kind = Key25519) are valid in the current tailnet key authority; StaticValidate rejects any other Kind. Key.Ed25519() similarly refuses non-25519 kinds, so unrecognized kinds surface early whether you are validating or using a key.","triggerScenarios":"Constructing tka.Key with an unset or wrong Kind constant (the zero value is invalid), or deserializing AUMs produced by a newer or different implementation that defined new key kinds.","commonSituations":"Incomplete Key struct literals; forward-compatibility handling of foreign or future-version AUMs.","solutions":["Always set Kind: tka.Key25519 when constructing keys","Run StaticValidate on deserialized keys and reject/drop AUMs from incompatible versions","Check Kind before calling Ed25519()"],"exampleFix":"// before\nk := tka.Key{Public: pub, Votes: 1} // Kind left as zero value\n\n// after\nk := tka.Key{Kind: tka.Key25519, Public: pub, Votes: 1}","handlingStrategy":"type-guard","validationCode":"// After deserializing an AUM, validate its keys before persisting\nfor _, k := range aum.State.Keys {\n    if k.Kind != tka.Key25519 {\n        return fmt.Errorf(\"rejecting AUM with unsupported key kind %v\", k.Kind)\n    }\n}","typeGuard":"func isSupportedKeyKind(k tka.KeyKind) bool { return k == tka.Key25519 }","tryCatchPattern":null,"preventionTips":["Always set Kind explicitly when constructing tka.Key literals","Check Kind before calling Key.Ed25519()","Reject AUMs from incompatible implementations instead of best-effort parsing"],"tags":["tka","tailnet-lock","key-type","validation"],"backgroundTag":"unsupported-key-type","analyzedSha":"6e0912f97994f927632b34ae9e63b53d6516a6ac","analyzedAt":"2026-08-18T08:17:25.280Z","contentChangedAt":"2026-08-18T08:17:25.280Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}