{"record":{"id":"dcf828411de26253","repo":"eclipse-vertx/vert.x","slug":"invalid-der-expected-version-field-to-have-valu","errorCode":null,"errorMessage":"Invalid DER: expected 'version' field to have value '1' but found '%d'","messagePattern":"Invalid DER: expected 'version' field to have value '1' but found '(.+?)'","errorType":"exception","errorClass":"VertxException","httpStatus":null,"severity":"error","filePath":"vertx-core/src/main/java/io/vertx/core/net/impl/pkcs1/PrivateKeyParser.java","lineNumber":166,"sourceCode":"   */\n  public static ECPrivateKeySpec getECKeySpec(byte[] keyBytes) throws VertxException {\n    DerParser parser = new DerParser(keyBytes);\n\n    Asn1Object sequence = parser.read();\n    if (sequence.getType() != DerParser.SEQUENCE) {\n      throw new VertxException(\"Invalid DER: not a sequence\");\n    }\n\n    // Parse inside the sequence\n    parser = sequence.getParser();\n\n    Asn1Object version = parser.read();\n    if (version.getType() != DerParser.INTEGER) {\n      throw new VertxException(String.format(\n          \"Invalid DER: 'version' field must be of type INTEGER (2) but found type `%d`\",\n          version.getType()));\n    } else if (version.getInteger().intValue() != 1) {\n      throw new VertxException(String.format(\n          \"Invalid DER: expected 'version' field to have value '1' but found '%d'\",\n          version.getInteger().intValue()));\n    }\n    byte[] privateValue = parser.read().getValue();\n    parser = parser.read().getParser();\n    Asn1Object params = parser.read();\n    // ECParameters are mandatory according to RFC 5915, Section 3\n    if (params.getType() != DerParser.OBJECT_IDENTIFIER) {\n      throw new VertxException(String.format(\n          \"Invalid DER: expected to find an OBJECT_IDENTIFIER (6) in 'parameters' but found type '%d'\",\n          params.getType()));\n    }\n    byte[] namedCurveOid = params.getValue();\n    ECParameterSpec spec = getECParameterSpec(oidToString(namedCurveOid));\n    return new ECPrivateKeySpec(new BigInteger(1, privateValue), spec);\n  }\n\n  /**","sourceCodeStart":148,"sourceCodeEnd":184,"githubUrl":"https://github.com/eclipse-vertx/vert.x/blob/fb308bd8c3f12c79f4ae89bef67fadf6c80d036e/vertx-core/src/main/java/io/vertx/core/net/impl/pkcs1/PrivateKeyParser.java#L148-L184","documentation":"Thrown by getECKeySpec when the version INTEGER inside the ECPrivateKey SEQUENCE has a value other than 1. RFC 5915 defines exactly one version (1) for EC private keys, so any other value means the input is not a valid EC private key structure.","triggerScenarios":"Feeding a DER blob whose leading INTEGER is not 1 — e.g. an RSA private key (which also starts with an INTEGER but usually with value 0) parsed as EC, or hand-modified key data.","commonSituations":"Pointing an EC key loader at RSA key material (both start with SEQUENCE + INTEGER); custom key generators writing an unexpected version value.","solutions":["Verify the key algorithm matches the parser being used; parse RSA keys with getRSAKeySpec instead.","Re-export the EC key: openssl ecparam -genkey / openssl ec -outform DER.","Check that no manual editing or truncation altered the version field.","Validate with openssl asn1parse -i that version = 1."],"exampleFix":"// before\nECPrivateKeySpec spec = PrivateKeyParser.getECKeySpec(rsaKeyDerBytes);\n// after\nRSAPrivateCrtKeySpec spec = PrivateKeyParser.getRSAKeySpec(rsaKeyDerBytes);","handlingStrategy":"validation","validationCode":"openssl asn1parse -inform DER -in key.der\n// confirm first INTEGER (version) is 1 before calling the parser;\n// in code, check the key actually is EC before choosing getECKeySpec:\nif (algorithm != null && !algorithm.equals(\"EC\")) {\n    throw new IllegalArgumentException(\"Expected EC key, got \" + algorithm);\n}","typeGuard":null,"tryCatchPattern":"try {\n    return PrivateKeyParser.getECKeySpec(der);\n} catch (VertxException e) {\n    if (e.getMessage().contains(\"'version' field to have value\")) {\n        throw new KeyFormatException(\"Key is not an RFC 5915 EC private key: \" + e.getMessage());\n    }\n    throw e;\n}","preventionTips":["Match parser to key algorithm (RSA keys go to getRSAKeySpec)","Never hand-edit DER bytes","Run openssl ec -check on keys before deployment"],"tags":["der","asn1","ec","version-field","key-mismatch"],"backgroundTag":"invalid-argument-value","analyzedSha":"fb308bd8c3f12c79f4ae89bef67fadf6c80d036e","analyzedAt":"2026-09-06T11:37:12.241Z","contentChangedAt":"2026-09-06T11:37:12.241Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}