gchq/CyberChef · error · OperationError

Provided key is not a public key.

Error message

Provided key is not a public key.

What it means

Thrown in ECDSAVerify.run when the EC key has !key.isPublic. The previous guard already ensured key.type === 'EC'; this one requires the public half for verification. A private EC key parses fine but has isPublic === false, so verification with it is rejected (the operation enforces public-key usage even though jsrsasign could technically verify with a private key).

Source

Thrown at src/core/operations/ECDSAVerify.mjs:151

                    throw new OperationError('No "r" value in the signature JSON');
                }
                if (!inputJson.s) {
                    throw new OperationError('No "s" value in the signature JSON');
                }
                signatureASN1Hex = r.KJUR.crypto.ECDSA.hexRSSigToASN1Sig(inputJson.r, inputJson.s);
                break;
            }
        }

        // verify signature
        const internalAlgorithmName = mdAlgo.replace("-", "") + "withECDSA";
        const sig = new r.KJUR.crypto.Signature({ alg: internalAlgorithmName });
        const key = r.KEYUTIL.getKey(keyPem);
        if (key.type !== "EC") {
            throw new OperationError("Provided key is not an EC key.");
        }
        if (!key.isPublic) {
            throw new OperationError("Provided key is not a public key.");
        }
        sig.init(key);
        const messageStr = Utils.convertToByteString(msg, msgFormat);
        sig.updateString(messageStr);
        const result = sig.verify(signatureASN1Hex);
        return result ? "Verified OK" : "Verification Failure";
    }
}

export default ECDSAVerify;

View on GitHub (pinned to 4290ea7539)

Solutions

1. Paste the EC PUBLIC key PEM (-----BEGIN PUBLIC KEY-----).
2. If you intend to sign, use ECDSA Sign with the private key instead.
3. Derive the public key from the private key if needed (openssl ec -pubout).

Example fix

// before: EC private key (isPublic === false)
const key = ecPrivateKeyPem;
// after: EC public key
const key = ecPublicKeyPem; // key.isPublic === true

import r from "jsrsasign";
const key = r.KEYUTIL.getKey(keyPem);
if (key.type === "EC" && !key.isPublic) throw new Error("provided EC key is private; verification needs the public key");

const isEcPublicKey = (k) => k && k.type === "EC" && k.isPublic === true;

When it happens

Trigger: The user pasted an EC PRIVATE key into the public-key field. key.type === 'EC' passes, but isPublic is false.

Common situations: Mixing up private and public keys when verifying; pasting the signer's private key instead of the public key.

Related errors

• Provided key is not an EC key.
• Provided key is not a private key.
• Provided key is not an EC key.
• Please enter a private key.
• Please enter a public key.

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/39e68968d381df89. Report an issue: GitHub.