{"record":{"id":"fcee44c1cbf90e94","repo":"getsops/sops","slug":"could-not-create-encrypted-ssh-identity-w","errorCode":null,"errorMessage":"could not create encrypted SSH identity: %w","messagePattern":"could not create encrypted SSH identity: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"age/ssh_parse.go","lineNumber":76,"sourceCode":"\tid, err := agessh.ParseIdentity(contents)\n\tif sshErr, ok := err.(*ssh.PassphraseMissingError); ok {\n\t\tpubKey := sshErr.PublicKey\n\t\tif pubKey == nil {\n\t\t\tpubKey, err = readPublicKeyFile(keyPath)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, err\n\t\t\t}\n\t\t}\n\t\tpassphrasePrompt := func() ([]byte, error) {\n\t\t\tpass, err := pluginTerminalUI.RequestValue(\"\", fmt.Sprintf(\"Enter passphrase for %q:\", keyPath), true)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"could not read passphrase for %q: %v\", keyPath, err)\n\t\t\t}\n\t\t\treturn []byte(pass), nil\n\t\t}\n\t\ti, err := agessh.NewEncryptedSSHIdentity(pubKey, contents, passphrasePrompt)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"could not create encrypted SSH identity: %w\", err)\n\t\t}\n\t\treturn i, nil\n\t}\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"malformed SSH identity in %q: %w\", keyPath, err)\n\t}\n\treturn id, nil\n}\n","sourceCodeStart":58,"sourceCodeEnd":85,"githubUrl":"https://github.com/getsops/sops/blob/13442bb98183887d7a9ac09ec8ab0564673a59d8/age/ssh_parse.go#L58-L85","documentation":"sops wraps agessh.NewEncryptedSSHIdentity to turn an age-encrypted SSH private key file into an age identity. This error means the key file was read and the public key parsed, but the encrypted-SSH-identity object could not be constructed, almost always because the public key blob is not one of the supported SSH key types (ssh-ed25519 or RSA) or the blob is corrupt.","triggerScenarios":"Calling parseSSHIdentityFromPrivateKeyFile (via loadAgeSSHIdentities) on an SSH private key whose parsed public key is unsupported (e.g. ECDSA or ed25519-sk), or a pubKey/contents pair that fails agessh.NewEncryptedSSHIdentity validation.","commonSituations":"Pointing SOPS_AGE_SSH_PRIVATE_KEY_FILE or an ssh recipient/identity at an ECDSA SSH key; corrupted or truncated key file; a key generated with a newer/algorithms the age ssh library doesn't accept; using an OpenSSH key with unsupported cipher features.","solutions":["Replace the SSH key with an ed25519 (or RSA) key: ssh-keygen -t ed25519 and use the new key file","Verify the key file is a complete, valid OpenSSH private key: ssh-keygen -y -f <keyfile> prints the public key without error","Check that the age binary and sops versions support the key type; upgrade sops if using a newer key format","Convert the workflow to a native age key (age-keygen) instead of SSH keys"],"exampleFix":"// before\nssh-keygen -t ecdsa -f ~/.ssh/id_ecdsa  # unsupported by age\n// after\nssh-keygen -t ed25519 -f ~/.ssh/id_ed25519 # supported by agessh","handlingStrategy":"validation","validationCode":"pub, err := os.ReadFile(keyPath)\nif err != nil { return err }\nout, err := exec.Command(\"ssh-keygen\", \"-y\", \"-f\", keyPath).Output()\nif err != nil { return fmt.Errorf(\"not a usable SSH private key: %w\", err) }\nkt := strings.Fields(string(out)) // must be ssh-ed25519 or ssh-rsa\nif len(kt) < 2 || (kt[len(kt)-1] != \"ssh-ed25519\" && kt[len(kt)-1] != \"ssh-rsa\") {\n    return fmt.Errorf(\"unsupported key type %q for age SSH identity\", kt[len(kt)-1])\n}","typeGuard":"func isAgeSupportedSSHKey(pubKeyLine string) bool {\n    f := strings.Fields(pubKeyLine)\n    return len(f) >= 2 && (f[len(f)-1] == \"ssh-ed25519\" || f[len(f)-1] == \"ssh-rsa\")\n}","tryCatchPattern":"i, err := loadAgeSSHIdentities(paths)\nif err != nil {\n    var uerr *UnsupportedSSHKeyError\n    if errors.As(err, &uerr) { /* regenerate as ed25519 */ }\n    return err\n}","preventionTips":["Generate age SSH identities only with ssh-keygen -t ed25519","Validate keys with ssh-keygen -y before configuring sops","Keep sops and age tooling up to date"],"tags":["age","ssh","key-parsing","unsupported-key-type"],"backgroundTag":"unsupported-ssh-key-type","analyzedSha":"13442bb98183887d7a9ac09ec8ab0564673a59d8","analyzedAt":"2026-09-01T03:53:00.447Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}