{"record":{"id":"bb96f29d3f6228d4","repo":"ipfs/kubo","slug":"unrecognized-key-type-s","errorCode":null,"errorMessage":"unrecognized key type: %s","messagePattern":"unrecognized key type: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"config/init.go","lineNumber":280,"sourceCode":"\t\tfmt.Fprintf(out, \"generating ED25519 keypair...\")\n\t\tpriv, pub, err := crypto.GenerateEd25519Key(rand.Reader)\n\t\tif err != nil {\n\t\t\treturn ident, err\n\t\t}\n\n\t\tsk = priv\n\t\tpk = pub\n\tcase \"secp256k1\":\n\t\tfmt.Fprintf(out, \"generating secp256k1 keypair...\")\n\t\tpriv, pub, err := crypto.GenerateSecp256k1Key(rand.Reader)\n\t\tif err != nil {\n\t\t\treturn ident, err\n\t\t}\n\n\t\tsk = priv\n\t\tpk = pub\n\tdefault:\n\t\treturn ident, fmt.Errorf(\"unrecognized key type: %s\", settings.Algorithm)\n\t}\n\tfmt.Fprintf(out, \"done\\n\")\n\n\t// currently storing key unencrypted. in the future we need to encrypt it.\n\t// TODO(security)\n\tskbytes, err := crypto.MarshalPrivateKey(sk)\n\tif err != nil {\n\t\treturn ident, err\n\t}\n\tident.PrivKey = base64.StdEncoding.EncodeToString(skbytes)\n\n\tid, err := peer.IDFromPublicKey(pk)\n\tif err != nil {\n\t\treturn ident, err\n\t}\n\tident.PeerID = id.String()\n\tfmt.Fprintf(out, \"peer identity: %s\\n\", ident.PeerID)\n\treturn ident, nil","sourceCodeStart":262,"sourceCodeEnd":298,"githubUrl":"https://github.com/ipfs/kubo/blob/329838acdfafae224582930457efe80aa217afc0/config/init.go#L262-L298","documentation":"CreateIdentity generates a keypair for a new node identity (ipfs init, key rotation, 'ipfs key generate'). Its switch only supports 'rsa', 'ed25519', and 'secp256k1'; any other Algorithm from KeyGenerateOptions reaches the default branch and returns this error before any key material is created.","triggerScenarios":"Running 'ipfs init --algorithm <name>' or 'ipfs key gen <name> --type <t>' / 'ipfs key rotate --type <t>' with a type outside the three supported ones — e.g. 'ecdsa', 'RSA' (case-sensitive check), 'ed', or an empty/misspelled value.","commonSituations":"Using key type names from other tools (openssl 'rsa2048', 'ECDSA'); wrong casing since the switch is case-sensitive; scripting key generation with an unvalidated variable.","solutions":["Use a supported algorithm: --type ed25519 (recommended default), rsa, or secp256k1 — e.g. ipfs key gen mykey --type ed25519","Check spelling and casing: the comparison is exact lowercase ('rsa', 'ed25519', 'secp256k1'), so 'RSA' fails","For ipfs init, either drop --algorithm (defaults to ed25519) or pass an explicit supported value"],"exampleFix":"// before\nipfs key gen mykey --type ecdsa\n// after\nipfs key gen mykey --type ed25519","handlingStrategy":"validation","validationCode":"allowed := map[string]bool{\"rsa\": true, \"ed25519\": true, \"secp256k1\": true}\nif !allowed[algo] {\n\treturn fmt.Errorf(\"key algorithm %q unsupported; use rsa|ed25519|secp256k1\", algo)\n}","typeGuard":"func isSupportedKeyAlgo(algo string) bool {\n\tswitch algo {\n\tcase \"rsa\", \"ed25519\", \"secp256k1\":\n\t\treturn true\n\t}\n\treturn false\n}","tryCatchPattern":"ident, err := config.CreateIdentity(os.Stdout, opts)\nif err != nil {\n\tif strings.HasPrefix(err.Error(), \"unrecognized key type\") {\n\t\treturn fmt.Errorf(\"unsupported --type; use ed25519, rsa, or secp256k1\")\n\t}\n\treturn err\n}","preventionTips":["Default to ed25519 and omit --algorithm/--type unless RSA or secp256k1 is required","Remember the comparison is exact lowercase; normalize input with strings.ToLower before passing","Do not reuse key type names from openssl or other tools"],"tags":["config","crypto","keys","identity"],"backgroundTag":"unsupported-key-type","analyzedSha":"329838acdfafae224582930457efe80aa217afc0","analyzedAt":"2026-09-03T18:30:52.135Z","contentChangedAt":"2026-09-03T18:30:52.135Z","schemaVersion":2},"datasetVersion":"2026-09-11T00:17:11.886Z"}