gchq/CyberChef · error · OperationError

Please enter a private key.

Error message

Please enter a private key.

What it means

Thrown in ECDSASign.run when keyPem.replace('-----BEGIN EC PRIVATE KEY-----', '').length === 0. The operation's default key arg is literally '-----BEGIN EC PRIVATE KEY-----', so this check exists almost entirely to detect that the user has not replaced the placeholder header with a real key. It fires when, after removing the header line, nothing remains.

Source

Thrown at src/core/operations/ECDSASign.mjs:69

                    "ASN.1 HEX",
                    "P1363 HEX",
                    "JSON Web Signature",
                    "Raw JSON"
                ]
            }
        ];
    }

    /**
     * @param {string} input
     * @param {Object[]} args
     * @returns {string}
     */
    run(input, args) {
        const [keyPem, mdAlgo, outputFormat] = args;

        if (keyPem.replace("-----BEGIN EC PRIVATE KEY-----", "").length === 0) {
            throw new OperationError("Please enter a private key.");
        }

        const internalAlgorithmName = mdAlgo.replace("-", "") + "withECDSA";
        const sig = new r.KJUR.crypto.Signature({ alg: internalAlgorithmName });
        const key = r.KEYUTIL.getKey(keyPem);
        if (key.type !== "EC") {
            throw new OperationError("Provided key is not an EC key.");
        }
        if (!key.isPrivate) {
            throw new OperationError("Provided key is not a private key.");
        }
        sig.init(key);
        const signatureASN1Hex = sig.signString(input);

        let result;
        switch (outputFormat) {
            case "ASN.1 HEX":
                result = signatureASN1Hex;

View on GitHub (pinned to 4290ea7539)

Solutions

1. Paste a complete EC private key PEM: BEGIN line, base64 body, END line.
2. If loading from a recipe, ensure the full PEM text was saved, not just the header.
3. Generate an EC key (P-256/P-384/P-521) with openssl ecparam -genkey if you do not have one.

Example fix

// before (placeholder, triggers the error)
const key = '-----BEGIN EC PRIVATE KEY-----';
// after (full PEM)
const key = '-----BEGIN EC PRIVATE KEY-----\nMHcCAQEE...full base64...\n-----END EC PRIVATE KEY-----';

function hasPemBody(pem, header) {
  const after = pem.replace(header, "");
  return after.trim().length > 0 && pem.includes(header.replace("BEGIN", "END"));
}
if (!hasPemBody(keyPem, "-----BEGIN EC PRIVATE KEY-----")) throw new Error("paste a full EC private key");

const looksLikeEcPrivateKey = (p) => /-----BEGIN EC PRIVATE KEY-----[\s\S]+-----END EC PRIVATE KEY-----/.test(p);

When it happens

Trigger: The 'ECDSA Private Key (PEM)' field still holds the placeholder header with no base64 body, or the user pasted only the header line.

Common situations: First-time use where the placeholder was never overwritten; pasting a key missing the base64 block and END line; a recipe saved before the key was entered.

Related errors

• Provided key is not an EC key.
• Provided key is not a private key.
• Please enter a public key.
• Provided key is not an EC key.
• Provided key is not a public key.

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/f419d80407dc66be. Report an issue: GitHub.