ipfs/kubo · error

converting std Go key to libp2p key: %w

Error message

converting std Go key to libp2p key: %w

What it means

The PKCS8 key parsed successfully but go-libp2p's crypto.KeyPairFromStdKey could not convert the standard Go key into a libp2p private key. This happens for key types libp2p does not support (e.g. ECDSA/unknown types from PKCS8) or an internal conversion failure.

Source

Thrown at core/commands/keystore.go:511

			if pemBlock.Type != "PRIVATE KEY" {
				return fmt.Errorf("expected PRIVATE KEY type in PEM block but got: %s", pemBlock.Type)
			}

			stdKey, err := parsePKCS8PrivateKey(pemBlock.Bytes)
			if err != nil {
				return fmt.Errorf("parsing PKCS8 format: %w", err)
			}

			// In case ed25519.PrivateKey is returned we need the pointer for
			// conversion to libp2p (see export command for more details).
			if ed25519KeyPointer, ok := stdKey.(ed25519.PrivateKey); ok {
				stdKey = &ed25519KeyPointer
			}

			sk, _, err = crypto.KeyPairFromStdKey(stdKey)
			if err != nil {
				return fmt.Errorf("converting std Go key to libp2p key: %w", err)
			}
		case keyFormatLibp2pCleartextOption:
			sk, err = crypto.UnmarshalPrivateKey(data)
			if err != nil {
				// check if data is PEM, if so, provide user with hint
				pemBlock, _ := pem.Decode(data)
				if pemBlock != nil {
					return fmt.Errorf("unexpected PEM block for format=%s: try again with format=%s", keyFormatLibp2pCleartextOption, keyFormatPemCleartextOption)
				}
				return fmt.Errorf("unable to unmarshall format=%s: %w", keyFormatLibp2pCleartextOption, err)
			}

		default:
			return fmt.Errorf("unrecognized import format: %s", importFormat)
		}

		// We only allow importing keys of the same type we generate (see list in
		// https://github.com/ipfs/interface-go-ipfs-core/blob/1c3d8fc/options/key.go#L58-L60),

View on GitHub (pinned to 329838acdf)

Solutions

  1. Check the key algorithm with `openssl pkey -in key.pem -noout -text`; if it is EC or another unsupported type, generate an Ed25519 or RSA key instead
  2. Regenerate: `openssl genpkey -algorithm ED25519 -out key.pem` and re-import
  3. If the key must be kept, re-derive an RSA/Ed25519 key you control and use it for IPNS naming

Example fix

// before
$ openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -out key.pem
$ ipfs key import mykey -f pem-pkcs8-cleartext key.pem
// after
$ openssl genpkey -algorithm ED25519 -out key.pem
$ ipfs key import mykey -f pem-pkcs8-cleartext key.pem
Defensive patterns

Strategy: type-guard

Validate before calling

block, _ := pem.Decode(data)
_ = block
// pre-check algorithm: only RSA and Ed25519 are convertible to libp2p
txt, _ := exec.Command("openssl", "pkey", "-in", "key.pem", "-noout", "-text").Output()
if bytes.Contains(txt, []byte("ED25519")) || bytes.Contains(txt, []byte("Private-Key: (")) && !bytes.Contains(txt, []byte("ASN1 OID")) {
    // likely RSA or Ed25519: proceed
}

Type guard

func isLibp2pConvertible(stdKey interface{}) bool {
    switch k := stdKey.(type) {
    case *rsa.PrivateKey:
        return true
    case ed25519.PrivateKey, *ed25519.PrivateKey:
        return true
    default:
        _ = k
        return false
    }
}

Prevention

When it happens

Trigger: `ipfs key import name -f pem-pkcs8-cleartext` with a PKCS8 ECDSA (or other unsupported-algorithm) key; KeyPairFromStdKey only maps *rsa.PrivateKey, ed25519.PrivateKey(*), and ecdsa it rejects/errors on.

Common situations: Importing an openssl EC key (`openssl genpkey -algorithm EC ...`) or a key type produced by another stack that Go parses but libp2p cannot represent.

Related errors

AI-assisted analysis of ipfs/kubo@329838acdf (2026-09-03). Data as JSON: /api/errors/b2b2f529f53afaa8. Report an issue: GitHub.