{"record":{"id":"fb16a4048137bf02","repo":"jwtk/jjwt","slug":"the-keytype-key-s-size-ecparameterspec-order","errorCode":null,"errorMessage":"The ${keyType} key's size (ECParameterSpec order) is ${size} bits which is not secure enough for the ${name} algorithm.  The JWT JWA Specification (RFC 7518, Section 3.4) states that keys used with ${name} MUST have a size >= ${minKeyLength} bits.  Consider using the ${Keys} class's 'keyPairFor(SignatureAlgorithm.${name})' method to create a key pair guaranteed to be secure enough for ${name}.  See https://tools.ietf.org/html/rfc7518#section-3.4 for more information.","messagePattern":"The (.+?) key's size \\(ECParameterSpec order\\) is (.+?) bits which is not secure enough for the (.+?) algorithm\\.  The JWT JWA Specification \\(RFC 7518, Section 3\\.4\\) states that keys used with (.+?) MUST have a size >= (.+?) bits\\.  Consider using the (.+?) class's 'keyPairFor\\(SignatureAlgorithm\\.(.+?)\\)' method to create a key pair guaranteed to be secure enough for (.+?)\\.  See https://tools\\.ietf\\.org/html/rfc7518#section-3\\.4 for more information\\.","errorType":"exception","errorClass":"WeakKeyException","httpStatus":null,"severity":"error","filePath":"api/src/main/java/io/jsonwebtoken/SignatureAlgorithm.java","lineNumber":428,"sourceCode":"            if (isEllipticCurve()) {\n\n                if (!(key instanceof ECKey)) {\n                    String msg = familyName + \" \" + keyType(signing) + \" keys must be ECKey instances.\";\n                    throw new InvalidKeyException(msg);\n                }\n\n                ECKey ecKey = (ECKey) key;\n                int size = ecKey.getParams().getOrder().bitLength();\n                if (size < this.minKeyLength) {\n                    String msg = \"The \" + keyType(signing) + \" key's size (ECParameterSpec order) is \" + size +\n                            \" bits which is not secure enough for the \" + name() + \" algorithm.  The JWT \" +\n                            \"JWA Specification (RFC 7518, Section 3.4) states that keys used with \" +\n                            name() + \" MUST have a size >= \" + this.minKeyLength +\n                            \" bits.  Consider using the \" + Keys.class.getName() + \" class's \" +\n                            \"'keyPairFor(SignatureAlgorithm.\" + name() + \")' method to create a key pair guaranteed \" +\n                            \"to be secure enough for \" + name() + \".  See \" +\n                            \"https://tools.ietf.org/html/rfc7518#section-3.4 for more information.\";\n                    throw new WeakKeyException(msg);\n                }\n\n            } else { //RSA\n\n                if (!(key instanceof RSAKey)) {\n                    String msg = familyName + \" \" + keyType(signing) + \" keys must be RSAKey instances.\";\n                    throw new InvalidKeyException(msg);\n                }\n\n                RSAKey rsaKey = (RSAKey) key;\n                int size = rsaKey.getModulus().bitLength();\n                if (size < this.minKeyLength) {\n\n                    String section = name().startsWith(\"P\") ? \"3.5\" : \"3.3\";\n\n                    String msg = \"The \" + keyType(signing) + \" key's size is \" + size + \" bits which is not secure \" +\n                            \"enough for the \" + name() + \" algorithm.  The JWT JWA Specification (RFC 7518, Section \" +\n                            section + \") states that keys used with \" + name() + \" MUST have a size >= \" +","sourceCodeStart":410,"sourceCodeEnd":446,"githubUrl":"https://github.com/jwtk/jjwt/blob/fb71496164c71442d08adec4571d9616ed5e1b8d/api/src/main/java/io/jsonwebtoken/SignatureAlgorithm.java#L410-L446","documentation":"Error \"The ${keyType} key's size (ECParameterSpec order) is ${size} bits which is not secure enough for the ${name} algorithm.  The JWT JWA Specification (RFC 7518, Section 3.4) states that keys used with ${name} MUST have a size >= ${minKeyLength} bits.  Consider using the ${Keys} class's 'keyPairFor(SignatureAlgorithm.${name})' method to create a key pair guaranteed to be secure enough for ${name}.  See https://tools.ietf.org/html/rfc7518#section-3.4 for more information.\" thrown in jwtk/jjwt.","triggerScenarios":"Thrown at api/src/main/java/io/jsonwebtoken/SignatureAlgorithm.java:428 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Generate a compliant EC key pair with Keys.keyPairFor(SignatureAlgorithm.ES256) (P-256) / ES384 (P-384) / ES512 (P-521).","Use an EC key whose curve order is at least the algorithm's minKeyLength bits; ES256 requires >=256 bits (e.g. secp256r1), not smaller curves like secp256k1 for ES256 validation rules here.","Select the ES* algorithm that matches the curve you already have (larger curves need the larger ES* variants)."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"fb71496164c71442d08adec4571d9616ed5e1b8d","analyzedAt":"2026-09-09T00:33:09.982Z","contentChangedAt":"2026-09-09T00:33:09.982Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}