{"record":{"id":"d897386c22b01938","repo":"gchq/CyberChef","slug":"did-not-provide-passphrase-with-locked-private-key","errorCode":null,"errorMessage":"Did not provide passphrase with locked private key.","messagePattern":"Did not provide passphrase with locked private key\\.","errorType":"validation","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/lib/PGP.mjs","lineNumber":91,"sourceCode":"* @param {string} privateKey\n* @param {string} [passphrase]\n* @returns {Object}\n*/\nexport async function importPrivateKey(privateKey, passphrase) {\n    try {\n        const key = await promisify(kbpgp.KeyManager.import_from_armored_pgp)({\n            armored: privateKey,\n            opts: {\n                \"no_check_keys\": true\n            }\n        });\n        if (key.is_pgp_locked()) {\n            if (passphrase) {\n                await promisify(key.unlock_pgp.bind(key))({\n                    passphrase\n                });\n            } else {\n                throw new OperationError(\"Did not provide passphrase with locked private key.\");\n            }\n        }\n        return key;\n    } catch (err) {\n        throw new OperationError(`Could not import private key: ${err}`);\n    }\n}\n\n/**\n * Import public key\n *\n * @param {string} publicKey\n * @returns {Object}\n */\nexport async function importPublicKey (publicKey) {\n    try {\n        const key = await promisify(kbpgp.KeyManager.import_from_armored_pgp)({\n            armored: publicKey,","sourceCodeStart":73,"sourceCodeEnd":109,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/lib/PGP.mjs#L73-L109","documentation":"importPrivateKey detects that the supplied PGP secret key is passphrase-locked (key.is_pgp_locked() === true) but the caller did not pass a passphrase. Without unlocking, the key material is unusable for signing or decryption, so the import aborts with an explicit cause rather than a downstream obscure failure.","triggerScenarios":"Calling importPrivateKey(armoredPrivateKey) or importPrivateKey(armoredPrivateKey, '') / undefined when the armored key was generated with a passphrase. Also if the passphrase argument is omitted entirely.","commonSituations":"User pastes a locked private key but leaves the passphrase field blank in the UI; passphrase stored in a separate secret manager that was not loaded; recipe/automation script hardcoded to skip the passphrase argument; key was just generated and locked by default.","solutions":["Provide the passphrase: importPrivateKey(privateKey, passphrase).","Source the passphrase from a secure prompt or secret store rather than hardcoding.","If you never want a passphrase, regenerate the key without one (kbpgp KeyManager.generate).","Detect the locked state in your UI and surface a passphrase input before calling import."],"exampleFix":"// before\nconst key = await PGP.importPrivateKey(armored); // locked key, no passphrase\n\n// after\nconst key = await PGP.importPrivateKey(armored, passphrase);\n// or prompt:\nconst passphrase = await promptUser('Private key passphrase');\nconst key = await PGP.importPrivateKey(armored, passphrase);","handlingStrategy":"validation","validationCode":"async function importPrivateKeySafe(armored, passphrase) {\n  // first import without unlocking to probe the locked state\n  const probe = await importKbpgpKey(armored);\n  if (probe.is_pgp_locked() && !passphrase) {\n    throw new Error('This key is locked; a passphrase is required.');\n  }\n  return PGP.importPrivateKey(armored, passphrase);\n}","typeGuard":null,"tryCatchPattern":"try {\n  return await PGP.importPrivateKey(armored, passphrase);\n} catch (e) {\n  if (/Did not provide passphrase/.test(e.message)) {\n    passphrase = await promptUser('Private key passphrase');\n    return PGP.importPrivateKey(armored, passphrase);\n  }\n  throw e;\n}","preventionTips":["Always supply a passphrase argument when importing a locked key.","Probe is_pgp_locked() up-front and surface a passphrase prompt in the UI.","Store the passphrase in a secret manager rather than asking the user repeatedly.","If you never intend to lock the key, generate it without a passphrase."],"tags":["cryptography","pgp","key-management","authentication"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}