denoland/deno · error · Error

Failed to get ECDH public key

Error message

Failed to get ECDH public key

What it means

getPublicKey() throws when the instance's public key buffer (#pubbuf) is null. The public key is populated by generateKeys(), by setPrivateKey() (which derives it), or by the deprecated setPublicKey(); calling getPublicKey() before any of those leaves nothing to return.

Source

Thrown at ext/node/polyfills/internal/crypto/diffiehellman.ts:1525

      pubbuf[0] = compressedBuf[0] + 4;
    }

    return ecdhEncode(pubbuf, encoding ?? "buffer");
  }

  getPrivateKey(encoding?: any): Buffer | string {
    if (this.#privbuf === null) {
      throw new Error("Failed to get ECDH private key");
    }
    return ecdhEncode(this.#privbuf, encoding ?? "buffer");
  }

  getPublicKey(
    encoding?: any,
    format: any = "uncompressed",
  ): Buffer | string {
    if (this.#pubbuf === null) {
      throw new Error("Failed to get ECDH public key");
    }
    validateEcdhFormat(format);
    const pubbuf = Buffer.from(op_node_ecdh_encode_pubkey(
      this.#curve.name,
      this.#pubbuf,
      format === "compressed",
    ));
    if (format === "hybrid") {
      const compressedBuf = Buffer.from(op_node_ecdh_encode_pubkey(
        this.#curve.name,
        this.#pubbuf,
        true,
      ));
      pubbuf[0] = compressedBuf[0] + 4;
    }
    return ecdhEncode(pubbuf, encoding ?? "buffer");
  }

View on GitHub (pinned to 9ad36f7a2c)

Solutions

1. Call ecdh.generateKeys() immediately after createECDH() and before any getPublicKey()
2. If importing an existing key, call setPrivateKey(priv) — it computes and stores the public key
3. Audit factory/builder functions to guarantee a key exists before the object is returned

Example fix

// before
const ecdh = crypto.createECDH('prime256v1');
sendHello(ecdh.getPublicKey());

// after
const ecdh = crypto.createECDH('prime256v1');
ecdh.generateKeys();
sendHello(ecdh.getPublicKey());

function getPub(ecdh: crypto.ECDH): Buffer {
  try {
    return ecdh.getPublicKey();
  } catch {
    ecdh.generateKeys();
    return ecdh.getPublicKey();
  }
}

When it happens

Trigger: createECDH(curve).getPublicKey() before generateKeys(); getPublicKey() after only failed key-import attempts; instances built by constructor injection where the key-setup call was skipped.

Common situations: Server boot code that exports its public key for handshake messages before the key pair is generated; unit tests constructing ECDH objects via a factory that forgets generateKeys(); order-of-initialization bugs in DI containers.

Related errors

• ERR_CRYPTO_ECDH_INVALID_PUBLIC_KEY
• Failed to get ECDH private key
• operation not supported for this keytype
• ERR_CRYPTO_ECDH_INVALID_FORMAT
• Invalid EC curve name

AI-assisted analysis of denoland/deno@9ad36f7a2c (2026-08-20). Data as JSON: /api/errors/e800aac59f2a83d0. Report an issue: GitHub.