{"record":{"id":"d8afa47fd05947b7","repo":"gchq/CyberChef","slug":"unsupported-jwk-key-type-inputjson-kty","errorCode":null,"errorMessage":"Unsupported JWK key type '${inputJson.kty}'","messagePattern":"Unsupported JWK key type '(.+?)'","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/operations/JWKToPem.mjs","lineNumber":66,"sourceCode":"            // list of keys => transform all keys\n            keys = inputJson;\n        } else if (Array.isArray(inputJson.keys)) {\n            // JSON Web Key Set => transform all keys\n            keys = inputJson.keys;\n        } else if (typeof inputJson === \"object\") {\n            // single key\n            keys.push(inputJson);\n        } else {\n            throw new OperationError(\"Input is not a JSON Web Key\");\n        }\n\n        let output = \"\";\n        for (let i=0; i<keys.length; i++) {\n            const jwk = keys[i];\n            if (typeof jwk.kty !== \"string\") {\n                throw new OperationError(\"Invalid JWK format\");\n            } else if (\"|RSA|EC|\".indexOf(jwk.kty) === -1) {\n                throw new OperationError(`Unsupported JWK key type '${inputJson.kty}'`);\n            }\n\n            const key = r.KEYUTIL.getKey(jwk);\n            const pem = key.isPrivate ? r.KEYUTIL.getPEM(key, \"PKCS8PRV\") : r.KEYUTIL.getPEM(key);\n\n            // PEM ends with '\\n', so a new key always starts on a new line\n            output += pem;\n        }\n\n        return output;\n    }\n}\n\nexport default PEMToJWK;\n","sourceCodeStart":48,"sourceCodeEnd":81,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/operations/JWKToPem.mjs#L48-L81","documentation":"Thrown when a key's kty is a string but not one of the two supported types (RSA or EC). NOTE: there is a bug in the message - it interpolates inputJson.kty instead of jwk.kty, so when iterating a JWKS the reported value is the wrong one (often 'undefined'). Supported kty values like 'oct' (symmetric) or 'OKP' (EdDSA) trigger this.","triggerScenarios":"A symmetric key (kty 'oct'), an Octet Key Pair (kty 'OKP'), or any future/proprietary kty value. Feeding a JWKS that mixes supported RSA/EC keys with unsupported oct keys.","commonSituations":"Trying to convert a symmetric 'oct' key meant for HMAC, or an Ed25519 'OKP' key. CyberChef's JWK-to-PEM only wires RSA and EC through jsrsasign.","solutions":["Use only RSA or EC keys with this operation.","For symmetric (oct) keys, extract 'k' and base64url-decode it instead.","For OKP/EdDSA keys, use a dedicated Ed25519 conversion path.","Filter the key set to kty in {'RSA','EC'} before calling."],"exampleFix":"// before: symmetric key (unsupported)\nchef.JWKToPem(JSON.stringify({ kty: 'oct', k: 'GawgguFyGrWKav7AX4VKUg' }));\n// after: use an RSA/EC JWK, or handle oct separately\nchef.JWKToPem(JSON.stringify({ kty: 'EC', crv: 'P-256', x: '...', y: '...' }));","handlingStrategy":"validation","validationCode":"const SUPPORTED_KTY = new Set(['RSA', 'EC']);\nfunction filterSupportedKty(keys) {\n  const arr = Array.isArray(keys) ? keys : [keys];\n  const supported = arr.filter(k => k && SUPPORTED_KTY.has(k.kty));\n  if (supported.length !== arr.length) {\n    throw new Error('Only RSA/EC keys are supported; found: ' +\n      arr.map(k => k && k.kty).join(', '));\n  }\n  return supported;\n}","typeGuard":"function isSupportedKty(jwk) {\n  return jwk !== null && typeof jwk === 'object' &&\n    (jwk.kty === 'RSA' || jwk.kty === 'EC');\n}","tryCatchPattern":"try {\n  return chef.JWKToPem(input);\n} catch (e) {\n  if (/Unsupported JWK key type/.test(e.message))\n    throw new Error('Use only RSA/EC keys; note the reported kty may be wrong due to a message bug');\n  throw e;\n}","preventionTips":["Restrict keys to kty RSA or EC for this operation.","Handle oct/OKP keys with dedicated paths, not JWK-to-PEM.","Be aware the error message may report inputJson.kty (often undefined) instead of the offending key's kty."],"tags":["jwk","crypto","key","validation","bug"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}