ipfs/kubo · critical

decoding old private key (%v)

Error message

decoding old private key (%v)

What it means

Before overwriting the identity, doRotate decodes the current node's private key from cfg.Identity.PrivKey using cfg.Identity.DecodePrivateKey(""). Failure to parse the base64-encoded stored key is wrapped as "decoding old private key (%v)". This means the repo's existing identity is unusable, and rotation cannot back it up.

Source

Thrown at core/commands/keystore.go:804

	var identity config.Identity
	if nBitsGiven {
		identity, err = config.CreateIdentity(out, []options.KeyGenerateOption{
			options.Key.Size(nBitsForKeypair),
			options.Key.Type(algorithm),
		})
	} else {
		identity, err = config.CreateIdentity(out, []options.KeyGenerateOption{
			options.Key.Type(algorithm),
		})
	}
	if err != nil {
		return fmt.Errorf("creating identity (%v)", err)
	}

	// Save old identity to keystore
	oldPrivKey, err := cfg.Identity.DecodePrivateKey("")
	if err != nil {
		return fmt.Errorf("decoding old private key (%v)", err)
	}
	keystore := repo.Keystore()
	if err := keystore.Put(oldKey, oldPrivKey); err != nil {
		return fmt.Errorf("saving old key in keystore (%v)", err)
	}

	// Update identity
	cfg.Identity = identity

	// Write config file to repo
	if err = repo.SetConfig(cfg); err != nil {
		return fmt.Errorf("saving new key to config (%v)", err)
	}
	return nil
}

func keyOutputListEncoders() cmds.EncoderFunc {
	return cmds.MakeTypedEncoder(func(req *cmds.Request, w io.Writer, list *KeyOutputList) error {

View on GitHub (pinned to 329838acdf)

Solutions

1. Verify PrivKey is intact base64 (`base64 -d <<< "$KEY" >/dev/null && echo ok`)
2. Restore Identity.PrivKey from a config backup — do NOT proceed with rotate without the old key, it will be lost
3. If the old key is unrecoverable and the node is disposable, back up config, replace Identity with a fresh key (`ipfs init` style generation) instead of using key rotate
4. Never hand-edit the PrivKey field

key=$(jq -r .Identity.PrivKey "$IPFS_PATH/config")
echo "$key" | base64 -d > /dev/null && echo "PrivKey decodes OK" || echo "PrivKey corrupted"

if err := doRotate(...); err != nil {
    if strings.Contains(err.Error(), "decoding old private key") {
        // STOP: do not retry blindly; restore Identity.PrivKey from backup first
    }
}

When it happens

Trigger: Identity.PrivKey in config is corrupted, truncated, hand-edited, or not valid base64/libp2p protobuf key encoding; config from a different format/version.

Common situations: Manual config edits that mangled the PrivKey string; copy-paste of config between machines dropping characters; very old repo formats; disk corruption.

Related errors

• unrecognized key type: %s
• failed to decode PrivKey: %w
• cannot set Identity.PeerID to a value that does not match th
• failed to get PrivKey
• private key in config was not a string

AI-assisted analysis of ipfs/kubo@329838acdf (2026-09-03). Data as JSON: /api/errors/06cb3aefc828e03b. Report an issue: GitHub.