gchq/CyberChef · error · OperationError

Could not identify a key manager.

Error message

Could not identify a key manager.

What it means

Same condition as 529 but in PGPVerify.run: kbpgp.unbox succeeded and get_data_signer() returned a signer, but get_key_manager() is null/falsy - the signing key could not be bound to an imported manager. Like 529, this throw (line 99) is inside the surrounding try and is re-wrapped by the catch at line 104, surfacing as 'Couldn't verify message: ...'.

Source

Thrown at src/core/operations/PGPVerify.mjs:99

                        }
                        if (signer.comment) {
                            text += `(${signer.comment}) `;
                        }
                        if (signer.email) {
                            text += `<${signer.email}>`;
                        }
                        text += "\n";
                    }
                    text += [
                        `PGP key ID: ${km.get_pgp_short_key_id()}`,
                        `PGP fingerprint: ${km.get_pgp_fingerprint().toString("hex")}`,
                        `Signed on ${new Date(ds.sig.when_generated() * 1000).toUTCString()}`,
                        "----------------------------------\n"
                    ].join("\n");
                    text += unboxedLiterals.toString();
                    return text.trim();
                } else {
                    throw new OperationError("Could not identify a key manager.");
                }
            } else {
                throw new OperationError("The data does not appear to be signed.");
            }
        } catch (err) {
            throw new OperationError(`Couldn't verify message: ${err}`);
        }
    }

}

export default PGPVerify;

View on GitHub (pinned to 4290ea7539)

Solutions

1. Supply the exact signer public key matching the signature's key ID.
2. Import the full public key (primary + signing subkey).
3. Cross-check the key fingerprint against the signature issuer.

if (!/-----BEGIN PGP PUBLIC KEY BLOCK-----/.test(publicKey)) {
    throw new Error('Supply the signer armoured public key before running.');
}

try {
    out = await chef.PGPVerify(msg, [pub]);
} catch (e) {
    if (/identify a key manager|verify message/.test(e.message)) {
        // signing key missing - supply the correct signer public key
    } else throw e;
}

When it happens

Trigger: The signing key is not the one supplied, or the supplied key lacks the signing subkey; the signature references a key absent from the keyring; the data_signer has no resolvable key manager.

Common situations: Wrong or outdated signer public key; only an encryption subkey supplied; key fingerprint mismatch with the signature's issuer.

Related errors

• Could not identify a key manager.
• The data does not appear to be signed.
• Couldn't verify message: ${err}
• Enter the private key of the recipient.
• Couldn't decrypt message with provided private key: ${err}

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/171ba5da3871ed28. Report an issue: GitHub.