denoland/deno · error · Error

Failed to get ECDH private key

Error message

Failed to get ECDH private key

What it means

getPrivateKey() throws when the ECDH instance's private key buffer (#privbuf) is null. A fresh crypto.createECDH(curve) object holds only the curve choice; the private key exists only after generateKeys() or setPrivateKey() has run, and getPrivateKey() refuses to hand back nothing.

Source

Thrown at ext/node/polyfills/internal/crypto/diffiehellman.ts:1515

    );
    this.#pubbuf = pubbuf;
    this.#privbuf = privbuf;

    if (format === "hybrid") {
      const compressedBuf = Buffer.from(op_node_ecdh_encode_pubkey(
        this.#curve.name,
        pubbuf,
        true,
      ));
      pubbuf[0] = compressedBuf[0] + 4;
    }

    return ecdhEncode(pubbuf, encoding ?? "buffer");
  }

  getPrivateKey(encoding?: any): Buffer | string {
    if (this.#privbuf === null) {
      throw new Error("Failed to get ECDH private key");
    }
    return ecdhEncode(this.#privbuf, encoding ?? "buffer");
  }

  getPublicKey(
    encoding?: any,
    format: any = "uncompressed",
  ): Buffer | string {
    if (this.#pubbuf === null) {
      throw new Error("Failed to get ECDH public key");
    }
    validateEcdhFormat(format);
    const pubbuf = Buffer.from(op_node_ecdh_encode_pubkey(
      this.#curve.name,
      this.#pubbuf,
      format === "compressed",
    ));
    if (format === "hybrid") {

View on GitHub (pinned to 9ad36f7a2c)

Solutions

1. Call ecdh.generateKeys() (or ecdh.setPrivateKey(priv)) before ecdh.getPrivateKey()
2. Initialize key material in the same function that creates the ECDH object so the two cannot be separated
3. Wrap key export in a helper that generates on first use if the private key is missing

Example fix

// before
const ecdh = crypto.createECDH('prime256v1');
store.save('priv', ecdh.getPrivateKey('hex'));

// after
const ecdh = crypto.createECDH('prime256v1');
ecdh.generateKeys();
store.save('priv', ecdh.getPrivateKey('hex'));

function exportPrivateKey(ecdh: crypto.ECDH, curve: string): string {
  try {
    return ecdh.getPrivateKey('hex');
  } catch {
    ecdh.generateKeys();
    return ecdh.getPrivateKey('hex');
  }
}

When it happens

Trigger: const ecdh = crypto.createECDH('prime256v1'); ecdh.getPrivateKey(); with no prior generateKeys()/setPrivateKey(). Also after a failed setPrivateKey() that threw before assigning #privbuf.

Common situations: Serialization helpers that dump keys right after construction; refactors that move generateKeys() into a conditional branch that does not always execute; copying tutorial code that omitted the generateKeys step.

Related errors

• ERR_CRYPTO_ECDH_INVALID_PUBLIC_KEY
• Failed to get ECDH public key
• operation not supported for this keytype
• ERR_CRYPTO_ECDH_INVALID_FORMAT
• Invalid EC curve name

AI-assisted analysis of denoland/deno@9ad36f7a2c (2026-08-20). Data as JSON: /api/errors/394d8b6f5b5e819d. Report an issue: GitHub.