ipfs/kubo · error

creating identity (%v)

Error message

creating identity (%v)

What it means

doRotate generates the new node identity via config.CreateIdentity using either the explicit key-size option or the requested algorithm (e.g. ed25519, rsa). If key generation fails — unsupported algorithm, bad key size for RSA, or entropy source failure — the error is wrapped as "creating identity (%v)".

Source

Thrown at core/commands/keystore.go:798

	cfg, err := repo.Config()
	if err != nil {
		return fmt.Errorf("reading config from repo (%v)", err)
	}

	// Generate new identity
	var identity config.Identity
	if nBitsGiven {
		identity, err = config.CreateIdentity(out, []options.KeyGenerateOption{
			options.Key.Size(nBitsForKeypair),
			options.Key.Type(algorithm),
		})
	} else {
		identity, err = config.CreateIdentity(out, []options.KeyGenerateOption{
			options.Key.Type(algorithm),
		})
	}
	if err != nil {
		return fmt.Errorf("creating identity (%v)", err)
	}

	// Save old identity to keystore
	oldPrivKey, err := cfg.Identity.DecodePrivateKey("")
	if err != nil {
		return fmt.Errorf("decoding old private key (%v)", err)
	}
	keystore := repo.Keystore()
	if err := keystore.Put(oldKey, oldPrivKey); err != nil {
		return fmt.Errorf("saving old key in keystore (%v)", err)
	}

	// Update identity
	cfg.Identity = identity

	// Write config file to repo
	if err = repo.SetConfig(cfg); err != nil {
		return fmt.Errorf("saving new key to config (%v)", err)

View on GitHub (pinned to 329838acdf)

Solutions

1. Use a supported algorithm: `ipfs key rotate -t ed25519` (recommended, no size needed)
2. For RSA use `ipfs key rotate -t rsa -s 4096` (2048 or 4096 bits)
3. Check `ipfs key gen -t <type>` with the same type to validate the algorithm name before rotating
4. Read the wrapped error for the exact cause reported by go-libp2p crypto

Example fix

// before
ipfs key rotate -t rsa -s 1024
// after
ipfs key rotate -t rsa -s 4096

// validate algorithm first with key gen on a scratch name
ipfs key gen _probe -t ed25519 && ipfs key rm _probe
// then rotate
ipfs key rotate -t ed25519 --old-key=old-self

if err := doRotate(...); err != nil {
    if strings.Contains(err.Error(), "creating identity") {
        // fall back to a known-good algorithm: -t ed25519
    }
}

When it happens

Trigger: `ipfs key rotate -t <unsupported-type>`; `ipfs key rotate -t rsa -s 1024` (below accepted minimum); `-s` supplied without `-t rsa` misuse; invalid algorithm string passed via keyStoreTypeOptionName.

Common situations: Typo in algorithm name (e.g. `-t ED25519` vs expected casing); requesting RSA sizes the crypto library rejects; rotating on a system where crypto/rand fails (rare, e.g. broken getrandom).

Related errors

• unrecognized key type: %s
• cannot set Identity.PeerID to a value that does not match th
• failed to decode PrivKey: %w
• decoding old private key (%v)
• supernode routing was never fully implemented and has been r

AI-assisted analysis of ipfs/kubo@329838acdf (2026-09-03). Data as JSON: /api/errors/94c6f5cdc1337d3d. Report an issue: GitHub.