eclipse-vertx/vert.x · error · VertxException

Invalid DER: expected 'version' field to have value '1' but

Error message

Invalid DER: expected 'version' field to have value '1' but found '%d'

What it means

Thrown by getECKeySpec when the version INTEGER inside the ECPrivateKey SEQUENCE has a value other than 1. RFC 5915 defines exactly one version (1) for EC private keys, so any other value means the input is not a valid EC private key structure.

Source

Thrown at vertx-core/src/main/java/io/vertx/core/net/impl/pkcs1/PrivateKeyParser.java:166

   */
  public static ECPrivateKeySpec getECKeySpec(byte[] keyBytes) throws VertxException {
    DerParser parser = new DerParser(keyBytes);

    Asn1Object sequence = parser.read();
    if (sequence.getType() != DerParser.SEQUENCE) {
      throw new VertxException("Invalid DER: not a sequence");
    }

    // Parse inside the sequence
    parser = sequence.getParser();

    Asn1Object version = parser.read();
    if (version.getType() != DerParser.INTEGER) {
      throw new VertxException(String.format(
          "Invalid DER: 'version' field must be of type INTEGER (2) but found type `%d`",
          version.getType()));
    } else if (version.getInteger().intValue() != 1) {
      throw new VertxException(String.format(
          "Invalid DER: expected 'version' field to have value '1' but found '%d'",
          version.getInteger().intValue()));
    }
    byte[] privateValue = parser.read().getValue();
    parser = parser.read().getParser();
    Asn1Object params = parser.read();
    // ECParameters are mandatory according to RFC 5915, Section 3
    if (params.getType() != DerParser.OBJECT_IDENTIFIER) {
      throw new VertxException(String.format(
          "Invalid DER: expected to find an OBJECT_IDENTIFIER (6) in 'parameters' but found type '%d'",
          params.getType()));
    }
    byte[] namedCurveOid = params.getValue();
    ECParameterSpec spec = getECParameterSpec(oidToString(namedCurveOid));
    return new ECPrivateKeySpec(new BigInteger(1, privateValue), spec);
  }

  /**

View on GitHub (pinned to fb308bd8c3)

Solutions

  1. Verify the key algorithm matches the parser being used; parse RSA keys with getRSAKeySpec instead.
  2. Re-export the EC key: openssl ecparam -genkey / openssl ec -outform DER.
  3. Check that no manual editing or truncation altered the version field.
  4. Validate with openssl asn1parse -i that version = 1.

Example fix

// before
ECPrivateKeySpec spec = PrivateKeyParser.getECKeySpec(rsaKeyDerBytes);
// after
RSAPrivateCrtKeySpec spec = PrivateKeyParser.getRSAKeySpec(rsaKeyDerBytes);
Defensive patterns

Strategy: validation

Validate before calling

openssl asn1parse -inform DER -in key.der
// confirm first INTEGER (version) is 1 before calling the parser;
// in code, check the key actually is EC before choosing getECKeySpec:
if (algorithm != null && !algorithm.equals("EC")) {
    throw new IllegalArgumentException("Expected EC key, got " + algorithm);
}

Try / catch

try {
    return PrivateKeyParser.getECKeySpec(der);
} catch (VertxException e) {
    if (e.getMessage().contains("'version' field to have value")) {
        throw new KeyFormatException("Key is not an RFC 5915 EC private key: " + e.getMessage());
    }
    throw e;
}

Prevention

When it happens

Trigger: Feeding a DER blob whose leading INTEGER is not 1 — e.g. an RSA private key (which also starts with an INTEGER but usually with value 0) parsed as EC, or hand-modified key data.

Common situations: Pointing an EC key loader at RSA key material (both start with SEQUENCE + INTEGER); custom key generators writing an unexpected version value.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

AI-assisted analysis of eclipse-vertx/vert.x@fb308bd8c3 (2026-09-06). Data as JSON: /api/errors/dcf828411de26253. Report an issue: GitHub.