gchq/CyberChef · error · OperationError

Signature format could not be detected

Error message

Signature format could not be detected

What it means

Thrown in ECDSASignatureConversion.run when inputFormat is still 'Auto' after auto-detection. In Auto the code first tries JSON.parse (Raw JSON) then fromBase64 with the URL-safe alphabet (JSON Web Signature); both probes are in try/catch that silently swallow errors. If neither sets inputFormat, the switch hits case 'Auto'. The input matched neither a JSON object nor a base64url concatenation signature.

Source

Thrown at src/core/operations/ECDSASignatureConversion.mjs:98

                } else {
                    inputFormat = "P1363 HEX";
                }
            }
        }

        let inputBase64;
        if (inputFormat === "Auto") {
            try {
                inputBase64 = fromBase64(input, "A-Za-z0-9-_", false);
                inputFormat = "JSON Web Signature";
            } catch {}
        }

        // convert input to ASN.1 hex
        let signatureASN1Hex;
        switch (inputFormat) {
            case "Auto":
                throw new OperationError("Signature format could not be detected");
            case "ASN.1 HEX":
                signatureASN1Hex = input;
                break;
            case "P1363 HEX":
                signatureASN1Hex = r.KJUR.crypto.ECDSA.concatSigToASN1Sig(input);
                break;
            case "JSON Web Signature":
                if (!inputBase64) inputBase64 = fromBase64(input, "A-Za-z0-9-_");
                signatureASN1Hex = r.KJUR.crypto.ECDSA.concatSigToASN1Sig(toHexFast(inputBase64));
                break;
            case "Raw JSON": {
                if (!inputJson) inputJson = JSON.parse(input);
                if (!inputJson.r) {
                    throw new OperationError('No "r" value in the signature JSON');
                }
                if (!inputJson.s) {
                    throw new OperationError('No "s" value in the signature JSON');
                }

View on GitHub (pinned to 4290ea7539)

Solutions

  1. Switch Input Format from 'Auto' to the explicit format you have (ASN.1 HEX / P1363 HEX / Raw JSON / JSON Web Signature).
  2. For JWS, ensure the signature is base64url (- and _, no padding) not standard base64.
  3. For Raw JSON, ensure valid JSON with r and s fields.
  4. Trim stray whitespace/newlines from the signature.

Example fix

// before: ASN.1 hex signature with format on Auto -> throws
run(asn1HexSig, ['Auto', ...]);
// after: declare the format explicitly
run(asn1HexSig, ['ASN.1 HEX', ...]);
Defensive patterns

Strategy: validation

Validate before calling

function detectSigFormat(sig) {
  try { const o = JSON.parse(sig); if (o && typeof o === "object") return "Raw JSON"; } catch {}
  try { fromBase64(sig, "A-Za-z0-9-_", false); return "JSON Web Signature"; } catch {}
  if (/^[0-9a-fA-F]+$/.test(sig)) return "ASN.1 HEX"; // best-effort; let user confirm
  throw new Error("could not auto-detect; set the format explicitly");
}

Try / catch

try { run(sig, ["Auto", ...]); }
catch (e) { if (String(e).includes("format could not be detected")) run(sig, ["ASN.1 HEX", ...]); else throw e; }

Prevention

When it happens

Trigger: Input Format is 'Auto' and the signature is not valid JSON, not valid base64url, or is an ASN.1 HEX string (Auto cannot identify ASN.1 hex because it looks like arbitrary hex). The JSON and base64 probes both swallow their failures, leaving inputFormat unchanged.

Common situations: Pasting an ASN.1 HEX signature while leaving format on Auto (Auto recognises only Raw JSON and JWS); malformed/truncated JSON; standard (+/) base64 instead of URL-safe (-_) which the fromBase64 alphabet rejects.

Related errors

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/c09c1e0ab3ad12b3. Report an issue: GitHub.