gravitational/teleport · error

public key representation has unexpected length (%v bytes)

Error message

public key representation has unexpected length (%v bytes)

What it means

ECDSAPublicKeyFromRaw validates the raw Apple public key bytes: the length is not a multiple of 2 plus 1 (the expected '0x04 || X || Y' uncompressed-point layout), so the representation does not match an uncompressed ECDSA point.

Source

Thrown at lib/darwin/pub_key.go:39

import (
	"crypto/ecdsa"
	"crypto/elliptic"
	"fmt"
	"math/big"
)

// ECDSAPublicKeyFromRaw reads an ECDSA public key from a raw Apple public key,
// as returned by SecKeyCopyExternalRepresentation.
func ECDSAPublicKeyFromRaw(pubKeyRaw []byte) (*ecdsa.PublicKey, error) {
	// Verify key length to avoid a potential panic below.
	// 3 is the smallest number that clears it, but in practice 65 is the more
	// common length.
	// Apple's docs make no guarantees, hence no assumptions are made here.
	switch l := len(pubKeyRaw); {
	case l < 3:
		return nil, fmt.Errorf("public key representation too small (%v bytes)", l)
	case l%2 != 1: // 0x4+keyLen+keyLen is always odd, see explanation below.
		return nil, fmt.Errorf("public key representation has unexpected length (%v bytes)", l)
	case pubKeyRaw[0] != 0x04: // See explanation below.
		return nil, fmt.Errorf("public key representation starts with unexpected byte (%#x vs 0x4)", pubKeyRaw[0])
	}

	// "For an elliptic curve public key, the format follows the ANSI X9.63
	// standard using a byte string of 04 || X || Y. (...) All of these
	// representations use constant size integers, including leading zeros as
	// needed."
	// https://developer.apple.com/documentation/security/1643698-seckeycopyexternalrepresentation?language=objc
	pubKeyRaw = pubKeyRaw[1:] // skip 0x4
	l := len(pubKeyRaw) / 2
	x := pubKeyRaw[:l]
	y := pubKeyRaw[l:]

	return &ecdsa.PublicKey{
		Curve: elliptic.P256(),
		X:     (&big.Int{}).SetBytes(x),
		Y:     (&big.Int{}).SetBytes(y),

View on GitHub (pinned to 1283425b60)

Solutions

1. Verify the credential is an ECDSA public key obtained via SecKeyCopyExternalRepresentation
2. Re-register the Touch ID/Apple credential to obtain a well-formed raw representation

When it happens

Trigger: Thrown at lib/darwin/pub_key.go:39 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/f5e227d21e0953b1. Report an issue: GitHub.