gchq/CyberChef · error · OperationError

Provided key is not an EC key.

Error message

Provided key is not an EC key.

What it means

Thrown in ECDSAVerify.run after r.KEYUTIL.getKey(keyPem) parses the PEM but key.type !== 'EC'. KEYUTIL.getKey accepts RSA/EC/DSA; ECDSA Verify requires an EC key, so a non-EC public key is rejected before verification. Fires only when getKey succeeded; an unparseable PEM throws a jsrsasign error earlier.

Source

Thrown at src/core/operations/ECDSAVerify.mjs:148

            case "Raw JSON": {
                if (!inputJson) inputJson = JSON.parse(input);
                if (!inputJson.r) {
                    throw new OperationError('No "r" value in the signature JSON');
                }
                if (!inputJson.s) {
                    throw new OperationError('No "s" value in the signature JSON');
                }
                signatureASN1Hex = r.KJUR.crypto.ECDSA.hexRSSigToASN1Sig(inputJson.r, inputJson.s);
                break;
            }
        }

        // verify signature
        const internalAlgorithmName = mdAlgo.replace("-", "") + "withECDSA";
        const sig = new r.KJUR.crypto.Signature({ alg: internalAlgorithmName });
        const key = r.KEYUTIL.getKey(keyPem);
        if (key.type !== "EC") {
            throw new OperationError("Provided key is not an EC key.");
        }
        if (!key.isPublic) {
            throw new OperationError("Provided key is not a public key.");
        }
        sig.init(key);
        const messageStr = Utils.convertToByteString(msg, msgFormat);
        sig.updateString(messageStr);
        const result = sig.verify(signatureASN1Hex);
        return result ? "Verified OK" : "Verification Failure";
    }
}

export default ECDSAVerify;

View on GitHub (pinned to 4290ea7539)

Solutions

1. Provide an EC public key matching the curve used to sign (P-256/P-384/P-521).
2. If the key is RSA, use the RSA Verify operation instead.
3. Extract the EC public key from the signer's certificate with openssl.

Example fix

// before: RSA public key -> key.type === 'RSA'
const key = rsaPublicKeyPem;
// after: EC public key
const key = ecPublicKeyPem; // key.type === 'EC'

import r from "jsrsasign";
const key = r.KEYUTIL.getKey(keyPem);
if (key.type !== "EC") throw new Error("key is not EC; use the appropriate verify operation");

const isEcKey = (k) => k && k.type === "EC";

When it happens

Trigger: An RSA or DSA public key (PEM) was pasted into the ECDSA public-key field. getKey parses it, key.type returns 'RSA'/'DSA', failing the guard.

Common situations: Pasting the wrong certificate's public key (RSA server cert) into the ECDSA verifier; a PKCS#8 public key for a non-EC algorithm.

Related errors

• Provided key is not an EC key.
• Provided key is not a private key.
• Provided key is not a public key.
• Please enter a private key.
• Please enter a public key.

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/5c63e838f3d6acf7. Report an issue: GitHub.