gchq/CyberChef · error · OperationError

Couldn't sign message: ${err}

Error message

Couldn't sign message: ${err}

What it means

Catch-all around kbpgp.box with sign_with only (no encryption) in PGPSign.run. The private key imported and unlocked fine, but the sign-only box call failed. The appended err holds the kbpgp cause.

Source

Thrown at src/core/operations/PGPSign.mjs:75

     *
     * @throws {OperationError} if failed private key import or failed encryption
     */
    async run(input, args) {
        const message = input,
            [privateKey, passphrase] = args;
        let signedMessage;

        if (!privateKey) throw new OperationError("Enter the private key of the signer.");
        const privKey = await importPrivateKey(privateKey, passphrase);

        try {
            signedMessage = await promisify(kbpgp.box)({
                "msg": message,
                "sign_with": privKey,
                "asp": ASP
            });
        } catch (err) {
            throw new OperationError(`Couldn't sign message: ${err}`);
        }

        return signedMessage;
    }

}

export default PGPSign;

View on GitHub (pinned to 4290ea7539)

Solutions

1. Use a private key that has a signing subkey / signing capability.
2. Re-export and validate the key material.
3. Reduce the message size and retry.

if (!/-----BEGIN PGP PRIVATE KEY BLOCK-----/.test(privateKey)) {
    throw new Error('Signer argument is not an armoured PGP private key.');
}

const isArmouredPrivateKey = (s) =>
    typeof s === 'string' && /-----BEGIN PGP PRIVATE KEY BLOCK-----/.test(s);

try {
    signed = await chef.PGPSign(msg, [priv, pass]);
} catch (e) {
    if (/Couldn't sign/.test(e.message)) { /* inspect suffix for kbpgp cause */ }
    else throw e;
}

When it happens

Trigger: Private key has no signing capability/subkey (encryption-only key); corrupt key material that imports but cannot sign; very large message; kbpgp internal error.

Common situations: Encryption-only key used to sign; subkey capabilities not understood; key exported without its signing subkey.

Related errors

• Couldn't sign message: ${err}
• Enter the private key of the recipient.
• Couldn't decrypt message with provided private key: ${err}
• Enter the public key of the signer.
• Could not identify a key manager.

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/54d80f192ddd26dd. Report an issue: GitHub.