{"record":{"id":"e14680f26b126104","repo":"slackhq/nebula","slug":"invalid-curve-s-e14680","errorCode":null,"errorMessage":"invalid curve: %s","messagePattern":"invalid curve: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cert/cert_v2.go","lineNumber":199,"sourceCode":"\t\t\t// the call to PublicKey below will panic slice bounds out of range otherwise\n\t\t\tif len(key) != ed25519.PrivateKeySize {\n\t\t\t\treturn ErrInvalidPrivateKey\n\t\t\t}\n\n\t\t\tif !ed25519.PublicKey(c.publicKey).Equal(ed25519.PrivateKey(key).Public()) {\n\t\t\t\treturn ErrPublicPrivateKeyMismatch\n\t\t\t}\n\t\tcase Curve_P256:\n\t\t\tprivkey, err := ecdh.P256().NewPrivateKey(key)\n\t\t\tif err != nil {\n\t\t\t\treturn ErrInvalidPrivateKey\n\t\t\t}\n\t\t\tpub := privkey.PublicKey().Bytes()\n\t\t\tif !bytes.Equal(pub, c.publicKey) {\n\t\t\t\treturn ErrPublicPrivateKeyMismatch\n\t\t\t}\n\t\tdefault:\n\t\t\treturn fmt.Errorf(\"invalid curve: %s\", curve)\n\t\t}\n\t\treturn nil\n\t}\n\n\tvar pub []byte\n\tswitch curve {\n\tcase Curve_CURVE25519:\n\t\tvar err error\n\t\tpub, err = curve25519.X25519(key, curve25519.Basepoint)\n\t\tif err != nil {\n\t\t\treturn ErrInvalidPrivateKey\n\t\t}\n\tcase Curve_P256:\n\t\tprivkey, err := ecdh.P256().NewPrivateKey(key)\n\t\tif err != nil {\n\t\t\treturn ErrInvalidPrivateKey\n\t\t}\n\t\tpub = privkey.PublicKey().Bytes()","sourceCodeStart":181,"sourceCodeEnd":217,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cert/cert_v2.go#L181-L217","documentation":"VerifyPrivateKey validates that a private key matches a CA certificate. The switch over curve only handles Curve_CURVE25519 and Curve_P256; any other curve value reaches this default branch. It means the caller passed a curve the library cannot verify, not that the key bytes are wrong.","triggerScenarios":"Calling certificateV2.VerifyPrivateKey(curve, key) on a CA certificate with any Curve value other than Curve_CURVE25519 or Curve_P256 (e.g. an unmarshalled proto enum with an out-of-range or reserved value).","commonSituations":"Certificates deserialized from a newer/older protobuf with an unknown curve number, hand-constructed certificates in tests, or code that forwards a raw integer cast to Curve without checking.","solutions":["Only call VerifyPrivateKey with Curve_CURVE25519 or Curve_P256; check the curve value before calling.","Ensure the certificate was produced by a compatible version of this library; re-generate certificates with supported curves.","Re-serialize/re-parse the certificate with a current proto schema if the curve value came from decoding an unknown enum number."],"exampleFix":"// before\nerr := caCert.VerifyPrivateKey(cert.Curve(3), keyBytes)\n// after\nif curve != cert.Curve_CURVE25519 && curve != cert.Curve_P256 {\n    return fmt.Errorf(\"unsupported curve %v\", curve)\n}\nerr := caCert.VerifyPrivateKey(curve, keyBytes)","handlingStrategy":"validation","validationCode":"if curve != cert.Curve_CURVE25519 && curve != cert.Curve_P256 {\n    return fmt.Errorf(\"curve %v unsupported by VerifyPrivateKey\", curve)\n}\nerr := caCert.VerifyPrivateKey(curve, keyBytes)","typeGuard":"func supportedCurve(c cert.Curve) bool {\n    return c == cert.Curve_CURVE25519 || c == cert.Curve_P256\n}","tryCatchPattern":"if err := caCert.VerifyPrivateKey(curve, key); err != nil {\n    if strings.HasPrefix(err.Error(), \"invalid curve:\") {\n        return fmt.Errorf(\"unsupported curve %v; use CURVE25519 or P256\", curve)\n    }\n    return err\n}","preventionTips":["Only use curve values defined in the current proto schema you compiled against.","Validate enum values after unmarshalling certificates from untrusted sources.","Keep certificate generation and verification on the same library version."],"tags":["certificate","curve","validation"],"backgroundTag":"unsupported-crypto-curve","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}