gchq/CyberChef · error · OperationError

Provided key is not an EC key.

Error message

Provided key is not an EC key.

What it means

Thrown in ECDSASign.run after r.KEYUTIL.getKey(keyPem) parses the PEM but the key object has key.type !== 'EC'. jsrsasign's KEYUTIL.getKey accepts RSA, EC, and DSA keys, returning a key whose .type names the family. This operation is ECDSA-only, so any non-EC key is rejected before signing. It fires only when getKey did not throw; a malformed PEM would surface a jsrsasign exception earlier.

Source

Thrown at src/core/operations/ECDSASign.mjs:76

    }

    /**
     * @param {string} input
     * @param {Object[]} args
     * @returns {string}
     */
    run(input, args) {
        const [keyPem, mdAlgo, outputFormat] = args;

        if (keyPem.replace("-----BEGIN EC PRIVATE KEY-----", "").length === 0) {
            throw new OperationError("Please enter a private key.");
        }

        const internalAlgorithmName = mdAlgo.replace("-", "") + "withECDSA";
        const sig = new r.KJUR.crypto.Signature({ alg: internalAlgorithmName });
        const key = r.KEYUTIL.getKey(keyPem);
        if (key.type !== "EC") {
            throw new OperationError("Provided key is not an EC key.");
        }
        if (!key.isPrivate) {
            throw new OperationError("Provided key is not a private key.");
        }
        sig.init(key);
        const signatureASN1Hex = sig.signString(input);

        let result;
        switch (outputFormat) {
            case "ASN.1 HEX":
                result = signatureASN1Hex;
                break;
            case "P1363 HEX":
                result = r.KJUR.crypto.ECDSA.asn1SigToConcatSig(signatureASN1Hex);
                break;
            case "JSON Web Signature":
                result = r.KJUR.crypto.ECDSA.asn1SigToConcatSig(signatureASN1Hex);
                result = toBase64(fromHex(result), "A-Za-z0-9-_");  // base64url

View on GitHub (pinned to 4290ea7539)

Solutions

1. Provide a genuine EC private key (prime256v1/secp384r1/secp521r1).
2. If you only have an RSA key, use the RSA Sign operation instead.
3. Convert the key to EC PEM with openssl if appropriate, or generate a fresh EC keypair.

Example fix

// before: RSA key pasted into the ECDSA field
const key = rsaPrivateKeyPem;   // key.type === 'RSA'
// after: EC key
const key = ecPrivateKeyPem;    // key.type === 'EC'

// Pre-check the key family with jsrsasign before invoking the operation.
import r from "jsrsasign";
const key = r.KEYUTIL.getKey(keyPem);
if (key.type !== "EC") throw new Error("key is not EC; use the RSA/DSA sign operation instead");

const isEcKey = (k) => k && k.type === "EC";

When it happens

Trigger: The user pasted an RSA or DSA private key into the ECDSA key field, or an EC key wrapped in a container jsrsasign labels differently. getKey parses it without error but key.type is 'RSA'/'DSA' rather than 'EC'.

Common situations: Copying an RSA key from a server cert into the ECDSA field; a PKCS#8 generic private key whose algorithm is not EC; confusing EC and RSA key generation.

Related errors

• Provided key is not a private key.
• Provided key is not an EC key.
• Provided key is not a public key.
• Please enter a private key.
• Please enter a public key.

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/6bcd23187de3ba69. Report an issue: GitHub.