{"record":{"id":"f93750622fa3b4fc","repo":"ipfs/kubo","slug":"ec-private-key-not-in-the-valid-range-for-secp256k","errorCode":null,"errorMessage":"EC private key not in the valid range for secp256k1","messagePattern":"EC private key not in the valid range for secp256k1","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/commands/keystore.go","lineNumber":1080,"sourceCode":"\tvar wrapper pkcs8Key\n\tif _, err := asn1.Unmarshal(der, &wrapper); err != nil {\n\t\treturn nil, err\n\t}\n\tvar ec ecPrivateKey\n\tif _, err := asn1.Unmarshal(wrapper.PrivateKey, &ec); err != nil {\n\t\treturn nil, fmt.Errorf(\"invalid EC private key: %w\", err)\n\t}\n\tif ec.Version != 1 {\n\t\treturn nil, fmt.Errorf(\"unsupported EC private key version %d\", ec.Version)\n\t}\n\tif len(ec.PrivateKey) > 32 {\n\t\treturn nil, errors.New(\"invalid EC private key length\")\n\t}\n\tvar buf [32]byte\n\tcopy(buf[32-len(ec.PrivateKey):], ec.PrivateKey)\n\tvar scalar secp256k1.ModNScalar\n\tif overflow := scalar.SetBytes(&buf); overflow != 0 || scalar.IsZero() {\n\t\treturn nil, errors.New(\"EC private key not in the valid range for secp256k1\")\n\t}\n\treturn secp256k1.NewPrivateKey(&scalar), nil\n}\n","sourceCodeStart":1062,"sourceCodeEnd":1084,"githubUrl":"https://github.com/ipfs/kubo/blob/329838acdfafae224582930457efe80aa217afc0/core/commands/keystore.go#L1062-L1084","documentation":"Range validation in parseSecp256k1PrivateKey during PEM/PKCS8 import: after zero-padding the 32-byte secret, secp256k1.ModNScalar.SetBytes reports overflow, meaning the private scalar is greater than or equal to the secp256k1 group order N. Mathematically such a value is not a valid private key, so the DER input is malformed or was produced by a broken encoder.","triggerScenarios":"Thrown at core/commands/keystore.go:1080 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Regenerate the key with a conformant secp256k1 library and re-export","Verify the source file's integrity (checksum/truncation)","Import the key in libp2p-protobuf-cleartext format instead if that is its true encoding"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"329838acdfafae224582930457efe80aa217afc0","analyzedAt":"2026-09-03T18:30:52.135Z","contentChangedAt":"2026-09-03T18:30:52.135Z","schemaVersion":2},"datasetVersion":"2026-09-11T00:17:11.886Z"}