{"record":{"id":"b15fae2a55a05555","repo":"ory/hydra","slug":"invalid-elliptic-curve-key-size-this-algorithm-do","errorCode":null,"errorMessage":"invalid elliptic curve key size, this algorithm does not support arbitrary size","messagePattern":"invalid elliptic curve key size, this algorithm does not support arbitrary size","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"oryx/josex/generate.go","lineNumber":43,"sourceCode":"\t\"crypto/rsa\"\n\t\"errors\"\n\t\"fmt\"\n\n\t\"github.com/go-jose/go-jose/v3\"\n)\n\n// NewSigningKey generates a keypair for corresponding SignatureAlgorithm.\nfunc NewSigningKey(alg jose.SignatureAlgorithm, bits int) (crypto.PublicKey, crypto.PrivateKey, error) {\n\tswitch alg {\n\tcase jose.ES256, jose.ES384, jose.ES512, jose.EdDSA:\n\t\tkeylen := map[jose.SignatureAlgorithm]int{\n\t\t\tjose.ES256: 256,\n\t\t\tjose.ES384: 384,\n\t\t\tjose.ES512: 521, // sic!\n\t\t\tjose.EdDSA: 256,\n\t\t}\n\t\tif bits != 0 && bits != keylen[alg] {\n\t\t\treturn nil, nil, errors.New(\"invalid elliptic curve key size, this algorithm does not support arbitrary size\")\n\t\t}\n\tcase jose.RS256, jose.RS384, jose.RS512, jose.PS256, jose.PS384, jose.PS512:\n\t\tif bits == 0 {\n\t\t\tbits = 2048\n\t\t}\n\t\tif bits < 2048 {\n\t\t\treturn nil, nil, errors.New(\"invalid key size for RSA key, 2048 or more is required\")\n\t\t}\n\t}\n\tswitch alg {\n\tcase jose.ES256:\n\t\tkey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)\n\t\tif err != nil {\n\t\t\treturn nil, nil, err\n\t\t}\n\t\treturn key.Public(), key, err\n\tcase jose.ES384:\n\t\tkey, err := ecdsa.GenerateKey(elliptic.P384(), rand.Reader)","sourceCodeStart":25,"sourceCodeEnd":61,"githubUrl":"https://github.com/ory/hydra/blob/4174065ffb052799890f7480f5360a877a67ffc1/oryx/josex/generate.go#L25-L61","documentation":"josex.NewSigningKey validates the `bits` parameter before generating an EC or Ed25519 signing key. Elliptic-curve algorithms (ES256/ES384/ES512/EdDSA) map to fixed curve sizes (256, 384, 521, 256 respectively — note ES512 uses P-521, not 512), so a non-zero bits value that does not exactly equal the required size for the given algorithm is rejected with this error. The library enforces this because ECDSA and Ed25519 keys cannot be generated at arbitrary bit lengths.","triggerScenarios":"Calling josex.NewSigningKey(alg, bits) with a non-zero bits that mismatches the alg: e.g. NewSigningKey(jose.ES256, 512), NewSigningKey(jose.ES512, 512) (the classic off-by-one — ES512 requires 521), NewSigningKey(jose.ES384, 256), or NewSigningKey(jose.EdDSA, 521). bits == 0 is allowed (means 'default for algorithm').","commonSituations":"Developers assuming ES512 maps to a 512-bit key and passing 512 (it needs 521 because P-521 is the curve); reusing a single 'keySize' config value across RSA and EC algorithms; porting code that picked a generic security level like 384 for ES256; wiring the bits flag from CLI/config without validating per-algorithm constraints.","solutions":["Set bits to the exact value required by the algorithm: 256 for ES256/EdDSA, 384 for ES384, 521 (not 512) for ES512","Pass bits = 0 to let the library use the correct default size for the algorithm","If the algorithm is RSA (RS256/RS384/RS512/PS256/PS384/PS512), this error does not apply — verify you are not accidentally routing an EC algorithm into an RSA-sized bits value","Derive bits programmatically from the algorithm (switch on alg) instead of hardcoding one size for all algorithms"],"exampleFix":"// before\nkey, _, err := josex.NewSigningKey(jose.ES512, 512)\n// after\nkey, _, err := josex.NewSigningKey(jose.ES512, 521) // P-521, not 512\n// or simply omit the size:\nkey, _, err := josex.NewSigningKey(jose.ES512, 0)","handlingStrategy":"validation","validationCode":"func validBitsForSigning(alg jose.SignatureAlgorithm, bits int) error {\n\tkeylen := map[jose.SignatureAlgorithm]int{\n\t\tjose.ES256: 256, jose.ES384: 384, jose.ES512: 521, jose.EdDSA: 256,\n\t}\n\tswitch alg {\n\tcase jose.ES256, jose.ES384, jose.ES512, jose.EdDSA:\n\t\tif bits != 0 && bits != keylen[alg] {\n\t\t\treturn fmt.Errorf(\"%s requires bits=%d (got %d)\", alg, keylen[alg], bits)\n\t\t}\n\tcase jose.RS256, jose.RS384, jose.RS512, jose.PS256, jose.PS384, jose.PS512:\n\t\tif bits < 2048 {\n\t\t\treturn fmt.Errorf(\"RSA requires bits>=2048 (got %d)\", bits)\n\t\t}\n\t}\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":"pub, priv, err := josex.NewSigningKey(alg, bits)\nif err != nil {\n\tif err.Error() == \"invalid elliptic curve key size, this algorithm does not support arbitrary size\" {\n\t\tbits = 0 // fall back to algorithm default\n\t\tpub, priv, err = josex.NewSigningKey(alg, bits)\n\t}\n\tif err != nil {\n\t\treturn fmt.Errorf(\"generating signing key: %w\", err)\n\t}\n}","preventionTips":["Remember ES512 uses P-521, so pass 521 (or 0), never 512","Pass bits=0 whenever you do not need an explicit size — the library picks the right default","Keep a per-algorithm size map in your config loader instead of a single global key-size setting","Unit-test key generation for every algorithm your app supports"],"tags":["go","jose","crypto","ecdsa","key-generation"],"backgroundTag":"invalid-key-size","analyzedSha":"4174065ffb052799890f7480f5360a877a67ffc1","analyzedAt":"2026-09-03T14:52:41.581Z","contentChangedAt":"2026-09-03T14:52:41.581Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}