{"record":{"id":"f25e4ce9a0e039ed","repo":"apache/pulsar","slug":"logctx-unsupported-key-type-pubkey-getalgorith","errorCode":null,"errorMessage":"${logCtx}Unsupported key type ${pubKey.getAlgorithm()} for key ${keyName}","messagePattern":"(.+?)Unsupported key type (.+?) for key (.+?)","errorType":"exception","errorClass":"PulsarClientException.CryptoException","httpStatus":null,"severity":"error","filePath":"pulsar-client-messagecrypto-bc/src/main/java/org/apache/pulsar/client/impl/crypto/MessageCryptoBc.java","lineNumber":402,"sourceCode":"            String msg = logCtx + \"Failed to load public key \" + keyName + \". \" + e.getMessage();\n            log.error(msg);\n            throw new PulsarClientException.CryptoException(msg);\n        }\n\n        Cipher dataKeyCipher;\n        byte[] encryptedKey;\n        try {\n            AlgorithmParameterSpec params = null;\n            // Encrypt data key using public key\n            if (RSA.equals(pubKey.getAlgorithm())) {\n                dataKeyCipher = Cipher.getInstance(RSA_TRANS, bcProvider());\n            } else if (ECDSA.equals(pubKey.getAlgorithm())) {\n                dataKeyCipher = Cipher.getInstance(ECIES, bcProvider());\n                params = createIESParameterSpec();\n            } else {\n                String msg = logCtx + \"Unsupported key type \" + pubKey.getAlgorithm() + \" for key \" + keyName;\n                log.error(msg);\n                throw new PulsarClientException.CryptoException(msg);\n            }\n            if (params != null) {\n                dataKeyCipher.init(Cipher.ENCRYPT_MODE, pubKey, params);\n            } else {\n                dataKeyCipher.init(Cipher.ENCRYPT_MODE, pubKey);\n            }\n            encryptedKey = dataKeyCipher.doFinal(encryptionKey.getEncoded());\n        } catch (IllegalBlockSizeException | BadPaddingException | NoSuchAlgorithmException\n                 | NoSuchPaddingException | InvalidKeyException | InvalidAlgorithmParameterException e) {\n            log.error().attr(\"logCtx\", logCtx).attr(\"keyName\", keyName)\n                    .exceptionMessage(e).log(\"Failed to encrypt data key\");\n            throw new PulsarClientException.CryptoException(e.getMessage());\n        }\n        EncryptionKeyInfo eki = new EncryptionKeyInfo(encryptedKey, keyInfo.getMetadata());\n        encryptedDataKeyMap.put(keyName, eki);\n    }\n\n    // required since Bouncycastle 1.72 when using ECIES, it is required to pass in an IESParameterSpec","sourceCodeStart":384,"sourceCodeEnd":420,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-client-messagecrypto-bc/src/main/java/org/apache/pulsar/client/impl/crypto/MessageCryptoBc.java#L384-L420","documentation":"After successfully loading the key, addPublicKeyCipher selects a cipher by the key's algorithm: RSA and ECDSA are supported (RSA/ECB/OAEPWithSHA-1AndMGF1Padding and ECIES respectively). If pubKey.getAlgorithm() is anything else (e.g. DSA, Ed25519, or an unrecognized string), the library cannot encrypt the data key and throws CryptoException naming the unsupported algorithm and key.","triggerScenarios":"Calling addEncryptionKey with a key whose parsed algorithm is neither 'RSA' nor 'EC' (ECDSA) — for example a DSA public key, an EdDSA/Ed25519 key, or a provider returning a non-standard algorithm string.","commonSituations":"Generating keys with modern tooling that defaults to Ed25519; using DSA keys from legacy setups; providing a key type Pulsar's end-to-end encryption does not support (it supports RSA and ECDSA only); keys produced by a provider whose getAlgorithm() returns a custom alias.","solutions":["Regenerate the key pair as RSA: openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out private.pem","Or use EC on a named curve: openssl ecparam -name prime256v1 -genkey -noout -out private.pem","Check the algorithm string with openssl pkey -pubin -in key.pem -text -noout and confirm it is RSA or EC","If using a custom KeyReader, ensure the key bytes decode to a standard RSA/EC PublicKey"],"exampleFix":"// before: ed25519 key unsupported by Pulsar E2E encryption\nssh-keygen or openssl genpkey -algorithm ED25519 ... \n// after: use RSA\nopenssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out private.pem","handlingStrategy":"validation","validationCode":"// Confirm the key algorithm is supported before enabling encryption\nPublicKey pubKey = KeyFactory.getInstance(\"RSA\")\n        .generatePublic(new X509EncodedKeySpec(keyInfo.getKey())); // or EC\nString alg = pubKey.getAlgorithm();\nif (!alg.equals(\"RSA\") && !alg.equals(\"EC\")) {\n    throw new IllegalStateException(\"Unsupported key algorithm for Pulsar E2E encryption: \" + alg);\n}","typeGuard":null,"tryCatchPattern":"try {\n    crypto.addPublicKeyCipher(keyName, keyReader);\n} catch (PulsarClientException.CryptoException e) {\n    if (e.getMessage().contains(\"Unsupported key type\")) {\n        throw new IllegalStateException(\"Regenerate \" + keyName + \" as RSA or EC key\", e);\n    }\n    throw e;\n}","preventionTips":["Standardize on RSA-2048 or EC prime256v1 keys for Pulsar end-to-end encryption","Do not use Ed25519/DSA keys — Pulsar's MessageCryptoBc supports only RSA and ECDSA","Print the algorithm (openssl pkey -pubin -text -noout) when provisioning new keys","Document key-generation commands in your ops runbook to prevent tooling defaults like Ed25519"],"tags":["crypto","key-type","unsupported-algorithm","encryption"],"backgroundTag":"unsupported-key-algorithm","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}