ipfs/kubo · error

converting libp2p private key to std Go key: %w

Error message

converting libp2p private key to std Go key: %w

What it means

Failure in the PEM export path of `ipfs key export`: crypto.PrivKeyToStdKey could not convert the stored libp2p private key into a standard Go key type. It fires when the stored key is of a type the converter does not support (the keystore normally only holds rsa, ed25519, and secp256k1), or when the serialized key bytes are malformed/corrupted.

Source

Thrown at core/commands/keystore.go:231

		// (this makes export work when ipfs daemon is already running)
		ksp := filepath.Join(cfgRoot, "keystore")
		ks, err := keystore.NewFSKeystore(ksp)
		if err != nil {
			return err
		}

		sk, err := ks.Get(name)
		if err != nil {
			return fmt.Errorf("key with name '%s' doesn't exist", name)
		}

		exportFormat, _ := req.Options[keyFormatOptionName].(string)
		var formattedKey []byte
		switch exportFormat {
		case keyFormatPemCleartextOption:
			stdKey, err := crypto.PrivKeyToStdKey(sk)
			if err != nil {
				return fmt.Errorf("converting libp2p private key to std Go key: %w", err)
			}
			// For some reason the ed25519.PrivateKey does not use pointer
			// receivers, so we need to convert it for MarshalPKCS8PrivateKey.
			// (We should probably change this upstream in PrivKeyToStdKey).
			if ed25519KeyPointer, ok := stdKey.(*ed25519.PrivateKey); ok {
				stdKey = *ed25519KeyPointer
			}
			if secpKey, ok := stdKey.(*crypto.Secp256k1PrivateKey); ok {
				// crypto/x509 does not support the secp256k1 curve
				formattedKey, err = marshalSecp256k1PrivateKey(secpKey)
			} else {
				// This function supports a restricted list of public key algorithms,
				// but we generate and use only the RSA and ed25519 types that are on that list.
				formattedKey, err = x509.MarshalPKCS8PrivateKey(stdKey)
			}
			if err != nil {
				return fmt.Errorf("marshalling key to PKCS8 format: %w", err)
			}

View on GitHub (pinned to 329838acdf)

Solutions

1. Export with --format=libp2p-protobuf-cleartext, which serializes the key without the std-conversion step
2. Regenerate the key with ipfs key gen --type=rsa|ed25519|secp256k1 if it is corrupted or of an exotic type
3. Report upstream if a freshly generated supported key type hits this

When it happens

Trigger: Thrown at core/commands/keystore.go:231 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ipfs/kubo@329838acdf (2026-09-03). Data as JSON: /api/errors/a08e6a1d953f37bc. Report an issue: GitHub.