ipfs/kubo · error

invalid EC private key length

Error message

invalid EC private key length

What it means

Structural validation in parseSecp256k1PrivateKey during PEM/PKCS8 import: the ECPrivateKey ASN.1 structure parsed successfully but its privateKey OCTET STRING is longer than the 32 bytes a secp256k1 scalar requires. This means the DER claims secp256k1 (by OID) but carries an oversized secret — the input key file is malformed or not actually a secp256k1 key.

Source

Thrown at core/commands/keystore.go:1074

		return false
	}
	return curve.Equal(oidNamedCurveSecp256k1)
}

func parseSecp256k1PrivateKey(der []byte) (*secp256k1.PrivateKey, error) {
	var wrapper pkcs8Key
	if _, err := asn1.Unmarshal(der, &wrapper); err != nil {
		return nil, err
	}
	var ec ecPrivateKey
	if _, err := asn1.Unmarshal(wrapper.PrivateKey, &ec); err != nil {
		return nil, fmt.Errorf("invalid EC private key: %w", err)
	}
	if ec.Version != 1 {
		return nil, fmt.Errorf("unsupported EC private key version %d", ec.Version)
	}
	if len(ec.PrivateKey) > 32 {
		return nil, errors.New("invalid EC private key length")
	}
	var buf [32]byte
	copy(buf[32-len(ec.PrivateKey):], ec.PrivateKey)
	var scalar secp256k1.ModNScalar
	if overflow := scalar.SetBytes(&buf); overflow != 0 || scalar.IsZero() {
		return nil, errors.New("EC private key not in the valid range for secp256k1")
	}
	return secp256k1.NewPrivateKey(&scalar), nil
}

View on GitHub (pinned to 329838acdf)

Solutions

1. Regenerate or re-export the key with a correct secp256k1 PEM encoder
2. Confirm the file was not truncated or hand-edited
3. Use the correct --format for the file's actual encoding

When it happens

Trigger: Thrown at core/commands/keystore.go:1074 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ipfs/kubo@329838acdf (2026-09-03). Data as JSON: /api/errors/00fcdf6efe44e6a1. Report an issue: GitHub.