gchq/CyberChef · error · OperationError

Couldn't verify message: ${err}

Error message

Couldn't verify message: ${err}

What it means

A catch-all wrapper around the entire kbpgp verification flow. Any exception thrown inside the try block — whether from kbpgp.unbox itself or from the inner OperationError throws at lines 99 and 102 — is caught here and re-thrown with a 'Couldn't verify message:' prefix. This means inner errors (key manager not found, no signature detected) are ultimately surfaced through this wrapper.

Source

Thrown at src/core/operations/PGPVerify.mjs:105

                        }
                        text += "\n";
                    }
                    text += [
                        `PGP key ID: ${km.get_pgp_short_key_id()}`,
                        `PGP fingerprint: ${km.get_pgp_fingerprint().toString("hex")}`,
                        `Signed on ${new Date(ds.sig.when_generated() * 1000).toUTCString()}`,
                        "----------------------------------\n"
                    ].join("\n");
                    text += unboxedLiterals.toString();
                    return text.trim();
                } else {
                    throw new OperationError("Could not identify a key manager.");
                }
            } else {
                throw new OperationError("The data does not appear to be signed.");
            }
        } catch (err) {
            throw new OperationError(`Couldn't verify message: ${err}`);
        }
    }

}

export default PGPVerify;

View on GitHub (pinned to 4290ea7539)

Solutions

1. Read the full error text after the colon — it contains the specific kbpgp failure reason that caused the catch to fire
2. Verify the public key argument matches the key that signed the message
3. Ensure the input is valid ASCII-armored PGP (not binary OpenPGP, not random text)
4. If the appended message says 'does not appear to be signed', the message lacks a signature — switch to PGP Sign or PGP Encrypt & Sign

// Pre-check: is the input ASCII-armored PGP?
const ARMOR_RE = /^-----BEGIN PGP (MESSAGE|SIGNED MESSAGE|PUBLIC KEY)-----/;
if (!ARMOR_RE.test(input.trim())) {
  throw new Error("Input is not ASCII-armored PGP data.");
}

try {
  const result = await chef.pgpVerify(input, [publicKey]);
} catch (e) {
  const msg = e.message;
  // The full reason is embedded after the colon
  console.error("PGP verification failed:", msg);
  if (/wrong key|no key/i.test(msg)) {
    // public key mismatch — prompt for correct key
  }
}

When it happens

Trigger: kbpgp.unbox rejects due to: wrong public key (signature was made with a different key), corrupt ASCII armor, malformed or unsupported PGP packet structure, or kbpgp internal assertion failures. Also catches and re-wraps the inner throws for 'Could not identify a key manager' and 'The data does not appear to be signed'.

Common situations: The provided public key does not correspond to the signer who created the message. The input is not a valid PGP message at all (random text). Version or format incompatibility between kbpgp and the PGP tool that produced the message.

Related errors

• The data does not appear to be signed.
• Could not identify a key manager.
• The data does not appear to be signed.
• Couldn't verify message: ${err}
• Could not identify a key manager.

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/6e3af89c030c1b15. Report an issue: GitHub.