ipfs/kubo · error

EC private key not in the valid range for secp256k1

Error message

EC private key not in the valid range for secp256k1

What it means

Range validation in parseSecp256k1PrivateKey during PEM/PKCS8 import: after zero-padding the 32-byte secret, secp256k1.ModNScalar.SetBytes reports overflow, meaning the private scalar is greater than or equal to the secp256k1 group order N. Mathematically such a value is not a valid private key, so the DER input is malformed or was produced by a broken encoder.

Source

Thrown at core/commands/keystore.go:1080

	var wrapper pkcs8Key
	if _, err := asn1.Unmarshal(der, &wrapper); err != nil {
		return nil, err
	}
	var ec ecPrivateKey
	if _, err := asn1.Unmarshal(wrapper.PrivateKey, &ec); err != nil {
		return nil, fmt.Errorf("invalid EC private key: %w", err)
	}
	if ec.Version != 1 {
		return nil, fmt.Errorf("unsupported EC private key version %d", ec.Version)
	}
	if len(ec.PrivateKey) > 32 {
		return nil, errors.New("invalid EC private key length")
	}
	var buf [32]byte
	copy(buf[32-len(ec.PrivateKey):], ec.PrivateKey)
	var scalar secp256k1.ModNScalar
	if overflow := scalar.SetBytes(&buf); overflow != 0 || scalar.IsZero() {
		return nil, errors.New("EC private key not in the valid range for secp256k1")
	}
	return secp256k1.NewPrivateKey(&scalar), nil
}

View on GitHub (pinned to 329838acdf)

Solutions

1. Regenerate the key with a conformant secp256k1 library and re-export
2. Verify the source file's integrity (checksum/truncation)
3. Import the key in libp2p-protobuf-cleartext format instead if that is its true encoding

When it happens

Trigger: Thrown at core/commands/keystore.go:1080 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ipfs/kubo@329838acdf (2026-09-03). Data as JSON: /api/errors/f93750622fa3b4fc. Report an issue: GitHub.