{"record":{"id":"adee723317e877c6","repo":"denoland/deno","slug":"operation-not-supported-for-this-keytype-adee72","errorCode":null,"errorMessage":"operation not supported for this keytype","messagePattern":"operation not supported for this keytype","errorType":"exception","errorClass":"TypeError","httpStatus":null,"severity":"error","filePath":"ext/node/polyfills/internal/crypto/sig.ts","lineNumber":561,"sourceCode":"      }\n      result = op_node_verify_ed25519(handle, dataBytes, signature);\n    } else if (keyType === \"ed448\") {\n      const keyOpts = typeof key === \"object\" && key !== null &&\n          !(ObjectPrototypeIsPrototypeOf(KeyObject.prototype, key))\n        ? key as Record<string, unknown>\n        : null;\n      const ctx = keyOpts?.context;\n      if (\n        ObjectPrototypeIsPrototypeOf(Uint8ArrayPrototype, ctx) &&\n        ctx.length > 0\n      ) {\n        throw new TypeError(\"Context parameter is unsupported\");\n      }\n      result = op_node_verify_ed448(handle, dataBytes, signature);\n    } else if (\n      keyType === \"x25519\" || keyType === \"x448\" || keyType === \"dh\"\n    ) {\n      throw new TypeError(\n        \"operation not supported for this keytype\",\n      );\n    } else {\n      let digest = algorithm;\n      if (digest == null) {\n        if (keyType === \"rsa-pss\") {\n          const details = op_node_get_asymmetric_key_details(handle);\n          if (details.hashAlgorithm) {\n            digest = details.hashAlgorithm;\n          }\n        }\n        if (digest == null) {\n          throw new TypeError(\"no default digest\");\n        }\n      }\n      // Preserve padding/saltLength options from the original key\n      const publicKeyObject = new PublicKeyObject(handle);\n      const verifyKey = typeof key === \"object\" &&","sourceCodeStart":543,"sourceCodeEnd":579,"githubUrl":"https://github.com/denoland/deno/blob/9ad36f7a2cce60488e6ec52283efb32efddaf93a/ext/node/polyfills/internal/crypto/sig.ts#L543-L579","documentation":"One-shot crypto.verify() explicitly rejects x25519, x448, and dh keys with TypeError(\"operation not supported for this keytype\") — these are key-exchange key types with no verification operation. The branch runs after ed25519/ed448 handling and before digest selection, so it fires regardless of the algorithm argument.","triggerScenarios":"crypto.verify(null, data, sig, x25519KeyObject); a DH public key from generateKeyPair(\"dh\") used for verification; picking an Enc-key (OKP X25519) from a JWKS when an Ed25519 Sig-key was intended.","commonSituations":"Key-type confusion in JWT libraries between OKP curves (X25519 for ECDH vs Ed25519 for signatures); mTLS code reusing an ECDH key pair for signing; JWKS selection by kty only without checking crv/use.","solutions":["Verify only with signing keys: ed25519, rsa, ecdsa (ec), dsa, or rsa-pss.","Check key.asymmetricKeyType (or the JWK kty/crv/use) before calling and reject exchange keys with a clear error.","When generating keys for signature flows, use generateKeyPair(\"ed25519\") or rsa — never x25519/x448/dh."],"exampleFix":"// before\nconst { publicKey } = crypto.generateKeyPairSync(\"x25519\");\ncrypto.verify(null, data, publicKey, sig); // throws: operation not supported for this keytype\n\n// after\nconst { publicKey } = crypto.generateKeyPairSync(\"ed25519\");\ncrypto.verify(null, data, publicKey, sig);","handlingStrategy":"type-guard","validationCode":"const SIGNING_KEY_TYPES = new Set([\"rsa\", \"rsa-pss\", \"ec\", \"ed25519\", \"ed448\", \"dsa\"]);\nfunction assertVerifyKey(key) {\n  const t = key.asymmetricKeyType;\n  if (!SIGNING_KEY_TYPES.has(t)) {\n    throw new Error(`cannot verify with key type \"${t}\" (exchange keys cannot verify)`);\n  }\n}\nassertVerifyKey(pubKey);\nconst ok = crypto.verify(alg, data, pubKey, sig);","typeGuard":"const isSigningKey = (key) => {\n  const t = key.asymmetricKeyType;\n  return t !== \"x25519\" && t !== \"x448\" && t !== \"dh\";\n};","tryCatchPattern":"try {\n  ok = crypto.verify(alg, data, pubKey, sig);\n} catch (e) {\n  if (e instanceof TypeError && /not supported for this keytype/.test(e.message)) {\n    throw new Error(`key of type ${pubKey.asymmetricKeyType} cannot verify signatures`);\n  }\n  throw e;\n}","preventionTips":["When selecting from a JWKS, filter by use: \"sig\" and correct crv — X25519 and Ed25519 are both OKP.","Never reuse ECDH (x25519/x448) or DH pairs for signing or verification.","Check key.asymmetricKeyType before routing keys into sign/verify code."],"tags":["crypto","verification","key-type","unsupported-operation"],"backgroundTag":"unsupported-key-type","analyzedSha":"9ad36f7a2cce60488e6ec52283efb32efddaf93a","analyzedAt":"2026-08-20T13:07:44.778Z","contentChangedAt":"2026-08-20T13:07:44.778Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}