{"record":{"id":"fd5ea65618bc5f47","repo":"TechnitiumSoftware/DnsServer","slug":"the-ecdsa-keytype-dnssecprivatekeytype-keysi","errorCode":null,"errorMessage":"The ECDSA ({(keyType == DnssecPrivateKeyType.KeySigningKey ? \"KSK\" : \"ZSK\")}) private key must have key size of 256 bits.","messagePattern":"The ECDSA \\((.+?)\\) private key must have key size of 256 bits\\.","errorType":"exception","errorClass":"ArgumentException","httpStatus":null,"severity":"error","filePath":"DnsServerCore/Dns/Dnssec/DnssecPrivateKey.cs","lineNumber":244,"sourceCode":"                case DnssecAlgorithm.RSASHA256:\n                case DnssecAlgorithm.RSASHA512:\n                    using (RSA rsa = RSA.Create())\n                    {\n                        rsa.ImportFromPem(pemPrivateKey);\n\n                        if ((rsa.KeySize < 1024) || (rsa.KeySize > 4096))\n                            throw new ArgumentOutOfRangeException(nameof(pemPrivateKey), $\"Valid RSA ({(keyType == DnssecPrivateKeyType.KeySigningKey ? \"KSK\" : \"ZSK\")}) private key size range is between 1024-4096 bits.\");\n\n                        return new DnssecRsaPrivateKey(algorithm, keyType, rsa.KeySize, rsa.ExportParameters(true));\n                    }\n\n                case DnssecAlgorithm.ECDSAP256SHA256:\n                    using (ECDsa ecdsa = ECDsa.Create())\n                    {\n                        ecdsa.ImportFromPem(pemPrivateKey);\n\n                        if (ecdsa.KeySize != 256)\n                            throw new ArgumentException($\"The ECDSA ({(keyType == DnssecPrivateKeyType.KeySigningKey ? \"KSK\" : \"ZSK\")}) private key must have key size of 256 bits.\", nameof(pemPrivateKey));\n\n                        return new DnssecEcdsaPrivateKey(algorithm, keyType, ecdsa.ExportParameters(true));\n                    }\n\n                case DnssecAlgorithm.ECDSAP384SHA384:\n                    using (ECDsa ecdsa = ECDsa.Create())\n                    {\n                        ecdsa.ImportFromPem(pemPrivateKey);\n\n                        if (ecdsa.KeySize != 384)\n                            throw new ArgumentException($\"The ECDSA ({(keyType == DnssecPrivateKeyType.KeySigningKey ? \"KSK\" : \"ZSK\")}) private key must have key size of 384 bits.\", nameof(pemPrivateKey));\n\n                        return new DnssecEcdsaPrivateKey(algorithm, keyType, ecdsa.ExportParameters(true));\n                    }\n\n                case DnssecAlgorithm.ED25519:\n                    using (PemReader pemReader = new PemReader(new StringReader(pemPrivateKey)))\n                    {","sourceCodeStart":226,"sourceCodeEnd":262,"githubUrl":"https://github.com/TechnitiumSoftware/DnsServer/blob/d0484b6c1e7439cdc53d67d81e9c876cda2ad756/DnsServerCore/Dns/Dnssec/DnssecPrivateKey.cs#L226-L262","documentation":"Thrown by DnssecPrivateKey.Create (PEM overload) for DnssecAlgorithm.ECDSAP256SHA256 when the imported ECDsa key's KeySize is not exactly 256 bits. The P-256 curve fixes the size, so a mismatch means the PEM is for the wrong curve (e.g. P-384) and the signature would be invalid for this algorithm.","triggerScenarios":"Calling Create(ECDSAP256SHA256, keyType, pem) where the PEM decodes to a non-P-256 EC key (e.g. a P-384 or secp256k1 key).","commonSituations":"Selecting the wrong algorithm for the PEM; reusing a P-384 key for a P-256 algorithm; PEM generated with a non-nist curve.","solutions":["Regenerate a P-256 key: openssl ecparam -name prime256v1 -genkey -noout -out key.pem.","If the PEM is genuinely P-384, use DnssecAlgorithm.ECDSAP384SHA384 instead.","Match the DnssecAlgorithm to the curve the PEM was generated on."],"exampleFix":"// before: pem is a P-384 key\nvar key = DnssecPrivateKey.Create(DnssecAlgorithm.ECDSAP256SHA256, kt, p384Pem); // throws\n\n// after\nvar key = DnssecPrivateKey.Create(DnssecAlgorithm.ECDSAP384SHA384, kt, p384Pem);","handlingStrategy":"validation","validationCode":"using var ecdsa = ECDsa.Create();\necdsa.ImportFromPem(pem);\nif (ecdsa.KeySize != 256)\n    throw new InvalidOperationException($\"ECDSA key is {ecdsa.KeySize} bits; ECDSAP256SHA256 requires 256 (P-256).\");\nvar key = DnssecPrivateKey.Create(DnssecAlgorithm.ECDSAP256SHA256, keyType, pem);","typeGuard":"static bool PemIsP256(string pem)\n{\n    try { using var e = ECDsa.Create(); e.ImportFromPem(pem); return e.KeySize == 256; }\n    catch { return false; }\n}","tryCatchPattern":"try { return DnssecPrivateKey.Create(DnssecAlgorithm.ECDSAP256SHA256, keyType, pem); }\ncatch (ArgumentException ex) when (ex.ParamName == nameof(pem))\n{ throw new InvalidOperationException(\"PEM is not a P-256 key; check the curve or use ECDSAP384SHA384.\", ex); }","preventionTips":["Generate keys on prime256v1 for the P-256 algorithm.","Match the DnssecAlgorithm to the curve that produced the PEM.","Label key files with their curve to avoid mismatches."],"tags":["dns","dnssec","crypto","ecdsa","pem","key-size"],"backgroundTag":null,"analyzedSha":"d0484b6c1e7439cdc53d67d81e9c876cda2ad756","analyzedAt":"2026-08-13T22:57:35.508Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}