gchq/CyberChef · error · OperationError

Could not identify a key manager.

Error message

Could not identify a key manager.

What it means

After kbpgp.unbox succeeds and get_data_signer() returns a signer, get_key_manager() is called to retrieve the signing key. If it returns null/falsy the operation cannot report who signed, so it throws. Note: this throw (line 112) sits inside the surrounding try/catch at line 117, so it is re-wrapped and surfaces to the user as 'Couldn't verify message: ...' rather than this verbatim text.

Source

Thrown at src/core/operations/PGPDecryptAndVerify.mjs:112

                        }
                        if (signer.comment) {
                            text += `(${signer.comment}) `;
                        }
                        if (signer.email) {
                            text += `<${signer.email}>`;
                        }
                        text += "\n";
                    }
                    text += [
                        `PGP key ID: ${km.get_pgp_short_key_id()}`,
                        `PGP fingerprint: ${km.get_pgp_fingerprint().toString("hex")}`,
                        `Signed on ${new Date(ds.sig.when_generated() * 1000).toUTCString()}`,
                        "----------------------------------\n"
                    ].join("\n");
                    text += unboxedLiterals.toString();
                    return text.trim();
                } else {
                    throw new OperationError("Could not identify a key manager.");
                }
            } else {
                throw new OperationError("The data does not appear to be signed.");
            }
        } catch (err) {
            throw new OperationError(`Couldn't verify message: ${err}`);
        }
    }

}

export default PGPDecryptAndVerify;

View on GitHub (pinned to 4290ea7539)

Solutions

1. Ensure the signer's correct public key is supplied in the 'Public key of signer' argument.
2. Confirm the supplied public key matches the key ID / fingerprint embedded in the signature.
3. Import the full public key (primary + signing subkey), not just an encryption subkey.

if (!/-----BEGIN PGP PUBLIC KEY BLOCK-----/.test(publicKey)) {
    throw new Error('Supply the signer armoured public key before running.');
}

try {
    out = await chef.PGPDecryptAndVerify(msg, [pub, priv, pass]);
} catch (e) {
    if (/identify a key manager|verify message/.test(e.message)) {
        // signing key missing from keyring - supply the correct signer public key
    } else throw e;
}

When it happens

Trigger: A signature packet exists but its issuer key manager cannot be resolved - the signing key is not in the keyring, the signature references a key ID kbpgp cannot bind to an imported manager, or the data_signer has no attached key manager object.

Common situations: Signer's public key not supplied or a different key than the one that signed; keyring contains only an encryption subkey, not the signing subkey; third-party-signed message where the signing key was never imported.

Related errors

• The data does not appear to be signed.
• Couldn't verify message: ${err}
• Could not identify a key manager.
• Enter the private key of the recipient.
• Couldn't decrypt message with provided private key: ${err}

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/46d3b38aadf9f810. Report an issue: GitHub.