gchq/CyberChef · error · OperationError

Couldn't sign message: ${err}

Error message

Couldn't sign message: ${err}

What it means

Catch-all around kbpgp.box with both encrypt_for and sign_with in PGPEncryptAndSign.run. Both keys imported successfully, but the combined encrypt + sign call rejected. The appended err holds the kbpgp cause.

Source

Thrown at src/core/operations/PGPEncryptAndSign.mjs:86

    async run(input, args) {
        const message = input,
            [privateKey, passphrase, publicKey] = args;
        let signedMessage;

        if (!privateKey) throw new OperationError("Enter the private key of the signer.");
        if (!publicKey) throw new OperationError("Enter the public key of the recipient.");
        const privKey = await importPrivateKey(privateKey, passphrase);
        const pubKey = await importPublicKey(publicKey);

        try {
            signedMessage = await promisify(kbpgp.box)({
                "msg": message,
                "encrypt_for": pubKey,
                "sign_with": privKey,
                "asp": ASP
            });
        } catch (err) {
            throw new OperationError(`Couldn't sign message: ${err}`);
        }

        return signedMessage;
    }

}

export default PGPEncryptAndSign;

View on GitHub (pinned to 4290ea7539)

Solutions

1. Verify the signer private key can sign (has a signing subkey / signing capability).
2. Verify the recipient public key can encrypt (has an encryption subkey).
3. Re-check the passphrase and reduce the message size.

if (!/-----BEGIN PGP PRIVATE KEY BLOCK-----/.test(privateKey)) throw new Error('Signer private key missing');
if (!/-----BEGIN PGP PUBLIC KEY BLOCK-----/.test(publicKey)) throw new Error('Recipient public key missing');

try {
    out = await chef.PGPEncryptAndSign(msg, [priv, pass, pub]);
} catch (e) {
    if (/Couldn't sign/.test(e.message)) { /* inspect suffix for kbpgp cause */ }
    else throw e;
}

When it happens

Trigger: Signer private key has no signing capability/subkey; recipient public key has no encryption subkey; passphrase-unlocked key is actually wrong; large message; kbpgp internal error during the combined operation.

Common situations: Signer key is encryption-only; recipient key is signing-only; wrong passphrase producing a 'valid but wrong' key; key capability mismatch between the two parties.

Related errors

• Couldn't sign message: ${err}
• Enter the private key of the recipient.
• Couldn't decrypt message with provided private key: ${err}
• Enter the public key of the signer.
• Could not identify a key manager.

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/72e711b352d59c58. Report an issue: GitHub.