{"record":{"id":"ecee011135d2a94c","repo":"OpenNHP/opennhp","slug":"invalid-input-key","errorCode":null,"errorMessage":"invalid input key","messagePattern":"invalid input key","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"endpoints/agent/main/main.go","lineNumber":105,"sourceCode":"\t\t},\n\t\tAction: func(c *cli.Context) error {\n\t\t\tprivKey, err := base64.StdEncoding.DecodeString(c.Args().First())\n\t\t\tif err != nil {\n\t\t\t\tif c.Bool(\"json\") {\n\t\t\t\t\tjson.NewEncoder(os.Stdout).Encode(map[string]interface{}{\n\t\t\t\t\t\t\"error\": err.Error(),\n\t\t\t\t\t})\n\t\t\t\t\treturn nil\n\t\t\t\t}\n\t\t\t\treturn err\n\t\t\t}\n\t\t\teccType := core.ECC_SM2\n\t\t\tif c.Bool(\"curve\") {\n\t\t\t\teccType = core.ECC_CURVE25519\n\t\t\t}\n\t\t\te := core.ECDHFromKey(eccType, privKey)\n\t\t\tif e == nil {\n\t\t\t\terr := fmt.Errorf(\"invalid input key\")\n\t\t\t\tif c.Bool(\"json\") {\n\t\t\t\t\tjson.NewEncoder(os.Stdout).Encode(map[string]interface{}{\n\t\t\t\t\t\t\"error\": err.Error(),\n\t\t\t\t\t})\n\t\t\t\t\treturn nil\n\t\t\t\t}\n\t\t\t\treturn err\n\t\t\t}\n\t\t\tpub := e.PublicKeyBase64()\n\t\t\tif c.Bool(\"json\") {\n\t\t\t\tjson.NewEncoder(os.Stdout).Encode(map[string]string{\n\t\t\t\t\t\"publicKey\": pub,\n\t\t\t\t})\n\t\t\t} else {\n\t\t\t\tfmt.Println(\"Public key: \", pub)\n\t\t\t}\n\t\t\treturn nil\n\t\t},","sourceCodeStart":87,"sourceCodeEnd":123,"githubUrl":"https://github.com/OpenNHP/opennhp/blob/6e04ca5ff03222a699c24205cd4bf8fee9af7ffe/endpoints/agent/main/main.go#L87-L123","documentation":"The `keygen`/key-import command builds an ECDH key object from a provided private key via core.ECDHFromKey. If the key bytes are invalid for the selected curve (SM2 or Curve25519), ECDHFromKey returns nil and the command reports \"invalid input key\", emitting JSON when --json is set.","triggerScenarios":"Running the keygen/import command (c.Bool(\"curve\") selects ECC_CURVE25519, otherwise ECC_SM2) with privKey that is empty, wrong length, not base64/hex decodable, or not a valid scalar for the chosen curve.","commonSituations":"Pasting an SM2 private key while passing --curve (mismatched key vs curve); copying a truncated key from a terminal; supplying a public key where a private key is expected; whitespace/newlines embedded in the key string.","solutions":["Regenerate the key with `nhp-agent keygen --curve` (or `--sm2`) instead of importing a hand-copied one.","Match the flag to the key type: only pass --curve for Curve25519 keys; drop it for SM2 keys.","Trim whitespace and confirm the key's encoding/length matches the curve (32 bytes for Curve25519).","Check the JSON output's \"error\" field and re-encode the key correctly before retrying."],"exampleFix":"// before\n./nhp-agent keygen --curve   # but key is SM2 -> ECDHFromKey returns nil\n\n// after\n./nhp-agent keygen           # SM2 key without --curve, or use a Curve25519 key with --curve","handlingStrategy":"validation","validationCode":"keyBytes, err := base64.StdEncoding.DecodeString(privKeyStr)\nif err != nil || len(keyBytes) != 32 {\n    return fmt.Errorf(\"private key must be base64 32-byte scalar\")\n}","typeGuard":null,"tryCatchPattern":"e := core.ECDHFromKey(eccType, privKey)\nif e == nil {\n    return fmt.Errorf(\"invalid %s private key\", eccTypeName(eccType))\n}","preventionTips":["Generate keys with the daemon's own keygen instead of importing hand-copied keys.","Match the --curve flag to the key type (Curve25519 vs SM2).","Trim whitespace/newlines from pasted keys."],"tags":["cli","cryptography","keygen","go"],"backgroundTag":"invalid-argument-value","analyzedSha":"6e04ca5ff03222a699c24205cd4bf8fee9af7ffe","analyzedAt":"2026-09-07T15:44:59.941Z","contentChangedAt":"2026-09-07T15:44:59.941Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}