{"record":{"id":"f78030fb9f378546","repo":"TechnitiumSoftware/DnsServer","slug":"the-eddsa-keytype-dnssecprivatekeytype-keysi-f78030","errorCode":null,"errorMessage":"The EdDSA ({(keyType == DnssecPrivateKeyType.KeySigningKey ? \"KSK\" : \"ZSK\")}) private key must be for Ed448 curve.","messagePattern":"The EdDSA \\((.+?)\\) private key must be for Ed448 curve\\.","errorType":"exception","errorClass":"ArgumentException","httpStatus":null,"severity":"error","filePath":"DnsServerCore/Dns/Dnssec/DnssecPrivateKey.cs","lineNumber":273,"sourceCode":"                            throw new ArgumentException($\"The ECDSA ({(keyType == DnssecPrivateKeyType.KeySigningKey ? \"KSK\" : \"ZSK\")}) private key must have key size of 384 bits.\", nameof(pemPrivateKey));\n\n                        return new DnssecEcdsaPrivateKey(algorithm, keyType, ecdsa.ExportParameters(true));\n                    }\n\n                case DnssecAlgorithm.ED25519:\n                    using (PemReader pemReader = new PemReader(new StringReader(pemPrivateKey)))\n                    {\n                        if (pemReader.ReadObject() is not Ed25519PrivateKeyParameters privateKey)\n                            throw new ArgumentException($\"The EdDSA ({(keyType == DnssecPrivateKeyType.KeySigningKey ? \"KSK\" : \"ZSK\")}) private key must be for Ed25519 curve.\", nameof(pemPrivateKey));\n\n                        return new DnssecEddsaPrivateKey(keyType, privateKey);\n                    }\n\n                case DnssecAlgorithm.ED448:\n                    using (PemReader pemReader = new PemReader(new StringReader(pemPrivateKey)))\n                    {\n                        if (pemReader.ReadObject() is not Ed448PrivateKeyParameters privateKey)\n                            throw new ArgumentException($\"The EdDSA ({(keyType == DnssecPrivateKeyType.KeySigningKey ? \"KSK\" : \"ZSK\")}) private key must be for Ed448 curve.\", nameof(pemPrivateKey));\n\n                        return new DnssecEddsaPrivateKey(keyType, privateKey);\n                    }\n\n                default:\n                    throw new NotSupportedException(\"DNSSEC algorithm is not supported: \" + algorithm.ToString());\n            }\n        }\n\n        public static DnssecPrivateKey ReadFrom(BinaryReader bR)\n        {\n            if (Encoding.ASCII.GetString(bR.BaseStream.ReadExactly(2)) != \"DK\")\n                throw new InvalidDataException(\"DNSSEC private key format is invalid.\");\n\n            int version = bR.ReadByte();\n            switch (version)\n            {\n                case 1:","sourceCodeStart":255,"sourceCodeEnd":291,"githubUrl":"https://github.com/TechnitiumSoftware/DnsServer/blob/d0484b6c1e7439cdc53d67d81e9c876cda2ad756/DnsServerCore/Dns/Dnssec/DnssecPrivateKey.cs#L255-L291","documentation":"Thrown by DnssecPrivateKey.Create (PEM overload) for DnssecAlgorithm.ED448 when the PEM does not decode to an Ed448PrivateKeyParameters object. Symmetric to the ED25519 case: the wrong curve or key type fails the pattern match.","triggerScenarios":"Calling Create(ED448, keyType, pem) where pem is an Ed25519 key, an EC key, or otherwise not a valid Ed448 private key PEM.","commonSituations":"Using an Ed25519 PEM with the ED448 algorithm; Ed448 tooling being rare so the wrong file is grabbed; malformed PEM.","solutions":["Generate an Ed448 key (requires an Ed448-capable OpenSSL build): openssl genpkey -algorithm Ed448 -out key.pem.","If the PEM is actually Ed25519, call Create with DnssecAlgorithm.ED25519.","Verify the PEM decodes to Ed448PrivateKeyParameters before assignment."],"exampleFix":"// before: pem is an Ed25519 key\nvar key = DnssecPrivateKey.Create(DnssecAlgorithm.ED448, kt, ed25519Pem); // throws\n\n// after\nvar key = DnssecPrivateKey.Create(DnssecAlgorithm.ED25519, kt, ed25519Pem);","handlingStrategy":"validation","validationCode":"using var pr = new PemReader(new StringReader(pem));\nif (pr.ReadObject() is not Ed448PrivateKeyParameters)\n    throw new InvalidOperationException(\"PEM is not an Ed448 private key.\");\nvar key = DnssecPrivateKey.Create(DnssecAlgorithm.ED448, keyType, pem);","typeGuard":"static bool PemIsEd448(string pem)\n{\n    try { using var pr = new PemReader(new StringReader(pem)); return pr.ReadObject() is Ed448PrivateKeyParameters; }\n    catch { return false; }\n}","tryCatchPattern":"try { return DnssecPrivateKey.Create(DnssecAlgorithm.ED448, keyType, pem); }\ncatch (ArgumentException ex) when (ex.ParamName == nameof(pem))\n{ throw new InvalidOperationException(\"PEM is not Ed448; verify the key or use ED25519.\", ex); }","preventionTips":["Generate Ed448 keys only with Ed448-capable OpenSSL builds.","Keep Ed25519 and Ed448 key files clearly separated.","Validate the PEM object type before calling Create."],"tags":["dns","dnssec","crypto","eddsa","ed448","pem"],"backgroundTag":null,"analyzedSha":"d0484b6c1e7439cdc53d67d81e9c876cda2ad756","analyzedAt":"2026-08-13T22:57:35.508Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}