gchq/CyberChef · error · OperationError

DSA keys are not supported for JWK

Error message

DSA keys are not supported for JWK

What it means

PEMToJWK parses the key via jsrsasign KEYUTIL.getKey, then checks key.type. If it equals 'DSA' the operation throws because RFC 7517/7518 (JWK) registers no DSA key type - only RSA, EC, oct, and OKP are defined. There is no JWK serialization path for DSA.

Source

Thrown at src/core/operations/PEMToJWK.mjs:64

        while ((match = regex.exec(input)) !== null) {
            // find corresponding end tag
            const indexBase64 = match.index + match[0].length;
            const header = input.substring(match.index, indexBase64);
            const footer = `-----END ${match[1]}-----`;
            const indexFooter = input.indexOf(footer, indexBase64);
            if (indexFooter === -1) {
                throw new OperationError(`PEM footer '${footer}' not found`);
            }

            const pem = input.substring(match.index, indexFooter + footer.length);
            if (match[1].indexOf("KEY") !== -1) {
                if (header === "-----BEGIN RSA PUBLIC KEY-----") {
                    throw new OperationError("Unsupported RSA public key format. Only PKCS#8 is supported.");
                }

                const key = r.KEYUTIL.getKey(pem);
                if (key.type === "DSA") {
                    throw new OperationError("DSA keys are not supported for JWK");
                }
                const jwk = r.KEYUTIL.getJWKFromKey(key);
                if (output.length > 0) {
                    output += "\n";
                }
                output += JSON.stringify(jwk);
            } else if (match[1] === "CERTIFICATE") {
                const cert = new r.X509();
                cert.readCertPEM(pem);
                const key = cert.getPublicKey();
                const jwk = r.KEYUTIL.getJWKFromKey(key);
                if (output.length > 0) {
                    output += "\n";
                }
                output += JSON.stringify(jwk);
            } else {
                throw new OperationError(`Unsupported PEM type '${match[1]}'`);
            }

View on GitHub (pinned to 4290ea7539)

Solutions

  1. Use an RSA or EC key instead - only those produce JWK output here.
  2. If you need raw DSA parameters, extract them with a DSA-aware tool rather than JWK.
  3. Confirm the key algorithm: 'openssl pkey -in key.pem -text -noout' prints the type.

Example fix

// before (unsupported)
-----BEGIN DSA PRIVATE KEY-----
...
// after (use EC or RSA)
-----BEGIN EC PRIVATE KEY-----
...
Defensive patterns

Strategy: validation

Validate before calling

function guessKeyType(pem) {
    if (/DSA/.test(pem)) return 'DSA';
    if (/EC PRIVATE|EC PUBLIC/.test(pem)) return 'EC';
    return /RSA/.test(pem) ? 'RSA' : 'unknown';
}

Prevention

When it happens

Trigger: User supplies a DSA private or public key (e.g. '-----BEGIN DSA PRIVATE KEY-----' or a PKCS#8-wrapped DSA key). jsrsasign parses it, sets key.type to 'DSA', and this guard rejects it.

Common situations: Legacy DSA keys from SSH/OpenSSL; DSA certificates or CA keys; DSA keys encountered while batch-converting a key bundle to JWK.

Related errors

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/736420ffa589ba72. Report an issue: GitHub.