gchq/CyberChef · error · OperationError

Unsupported JWK key type '${inputJson.kty}'

Error message

Unsupported JWK key type '${inputJson.kty}'

What it means

Thrown when a key's kty is a string but not one of the two supported types (RSA or EC). NOTE: there is a bug in the message - it interpolates inputJson.kty instead of jwk.kty, so when iterating a JWKS the reported value is the wrong one (often 'undefined'). Supported kty values like 'oct' (symmetric) or 'OKP' (EdDSA) trigger this.

Source

Thrown at src/core/operations/JWKToPem.mjs:66

            // list of keys => transform all keys
            keys = inputJson;
        } else if (Array.isArray(inputJson.keys)) {
            // JSON Web Key Set => transform all keys
            keys = inputJson.keys;
        } else if (typeof inputJson === "object") {
            // single key
            keys.push(inputJson);
        } else {
            throw new OperationError("Input is not a JSON Web Key");
        }

        let output = "";
        for (let i=0; i<keys.length; i++) {
            const jwk = keys[i];
            if (typeof jwk.kty !== "string") {
                throw new OperationError("Invalid JWK format");
            } else if ("|RSA|EC|".indexOf(jwk.kty) === -1) {
                throw new OperationError(`Unsupported JWK key type '${inputJson.kty}'`);
            }

            const key = r.KEYUTIL.getKey(jwk);
            const pem = key.isPrivate ? r.KEYUTIL.getPEM(key, "PKCS8PRV") : r.KEYUTIL.getPEM(key);

            // PEM ends with '\n', so a new key always starts on a new line
            output += pem;
        }

        return output;
    }
}

export default PEMToJWK;

View on GitHub (pinned to 4290ea7539)

Solutions

1. Use only RSA or EC keys with this operation.
2. For symmetric (oct) keys, extract 'k' and base64url-decode it instead.
3. For OKP/EdDSA keys, use a dedicated Ed25519 conversion path.
4. Filter the key set to kty in {'RSA','EC'} before calling.

Example fix

// before: symmetric key (unsupported)
chef.JWKToPem(JSON.stringify({ kty: 'oct', k: 'GawgguFyGrWKav7AX4VKUg' }));
// after: use an RSA/EC JWK, or handle oct separately
chef.JWKToPem(JSON.stringify({ kty: 'EC', crv: 'P-256', x: '...', y: '...' }));

const SUPPORTED_KTY = new Set(['RSA', 'EC']);
function filterSupportedKty(keys) {
  const arr = Array.isArray(keys) ? keys : [keys];
  const supported = arr.filter(k => k && SUPPORTED_KTY.has(k.kty));
  if (supported.length !== arr.length) {
    throw new Error('Only RSA/EC keys are supported; found: ' +
      arr.map(k => k && k.kty).join(', '));
  }
  return supported;
}

function isSupportedKty(jwk) {
  return jwk !== null && typeof jwk === 'object' &&
    (jwk.kty === 'RSA' || jwk.kty === 'EC');
}

try {
  return chef.JWKToPem(input);
} catch (e) {
  if (/Unsupported JWK key type/.test(e.message))
    throw new Error('Use only RSA/EC keys; note the reported kty may be wrong due to a message bug');
  throw e;
}

When it happens

Trigger: A symmetric key (kty 'oct'), an Octet Key Pair (kty 'OKP'), or any future/proprietary kty value. Feeding a JWKS that mixes supported RSA/EC keys with unsupported oct keys.

Common situations: Trying to convert a symmetric 'oct' key meant for HMAC, or an Ed25519 'OKP' key. CyberChef's JWK-to-PEM only wires RSA and EC through jsrsasign.

Related errors

• Invalid JWK format
• Input is not a JSON Web Key
• Input private key must be in hex; and should be 32 bytes
• Invalid Public Key - Ensure each component is 32 bytes in si
• Invalid key length: ${key.length} bytes SM4 uses a key leng

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/d8afa47fd05947b7. Report an issue: GitHub.