ipfs/kubo · error

invalid EC private key: %w

Error message

invalid EC private key: %w

What it means

parseSecp256k1PrivateKey parses a DER/PKCS#8-encoded secp256k1 private key. After unwrapping the PKCS#8 structure, it ASN.1-decodes the inner EC private key structure; if that decode fails (malformed DER, wrong structure), the error is wrapped as "invalid EC private key: %w". This is part of local key import/export parsing for keystore keys.

Source

Thrown at core/commands/keystore.go:1068

	}
	if !wrapper.Algo.Algorithm.Equal(oidPublicKeyECDSA) {
		return false
	}
	var curve asn1.ObjectIdentifier
	if _, err := asn1.Unmarshal(wrapper.Algo.Parameters.FullBytes, &curve); err != nil {
		return false
	}
	return curve.Equal(oidNamedCurveSecp256k1)
}

func parseSecp256k1PrivateKey(der []byte) (*secp256k1.PrivateKey, error) {
	var wrapper pkcs8Key
	if _, err := asn1.Unmarshal(der, &wrapper); err != nil {
		return nil, err
	}
	var ec ecPrivateKey
	if _, err := asn1.Unmarshal(wrapper.PrivateKey, &ec); err != nil {
		return nil, fmt.Errorf("invalid EC private key: %w", err)
	}
	if ec.Version != 1 {
		return nil, fmt.Errorf("unsupported EC private key version %d", ec.Version)
	}
	if len(ec.PrivateKey) > 32 {
		return nil, errors.New("invalid EC private key length")
	}
	var buf [32]byte
	copy(buf[32-len(ec.PrivateKey):], ec.PrivateKey)
	var scalar secp256k1.ModNScalar
	if overflow := scalar.SetBytes(&buf); overflow != 0 || scalar.IsZero() {
		return nil, errors.New("EC private key not in the valid range for secp256k1")
	}
	return secp256k1.NewPrivateKey(&scalar), nil
}

View on GitHub (pinned to 329838acdf)

Solutions

1. Re-export the key correctly: `openssl ecparam -name secp256k1 -genkey` then convert to PKCS#8 with `openssl pkcs8 -topk8 -nocrypt`
2. Check the input file is not truncated (`openssl asn1parse -in key.pem`)
3. Ensure the curve is secp256k1, not prime256v1 or another EC curve
4. If importing into ipfs, try `ipfs key import <name> key.pem` with the PEM-wrapped PKCS#8 form

// validate key before ipfs key import
if openssl asn1parse -in key.pem > /dev/null 2>&1; then
  echo "DER structure OK"
else
  echo "not valid ASN.1/DER"
fi

_, err := parsePKCS8PrivateKey(der)
if err != nil {
    var perr error
    if _, err2 := parseSecp256k1PrivateKey(der); err2 != nil {
        // input is not a parseable secp256k1 PKCS#8 key: re-export with openssl
    }
    _ = perr
}

When it happens

Trigger: Importing a key file (`ipfs key import`) whose bytes are not valid ASN.1 EC private key structure; truncated or corrupted PEM/DER file; passing an Ed25519 or RSA PKCS#8 blob where an EC secp256k1 body is expected.

Common situations: Hand-converted key files (openssl output in wrong format, e.g. `openssl ec` vs secp256k1 curve mismatch); exporting from another tool with different encoding; corrupted backup file.

Related errors

• unsupported EC private key version %d
• parsing PKCS8 format: %w
• unrecognized key type: %s
• failed to decode PrivKey: %w
• failed to derive PeerID from PrivKey: %w

AI-assisted analysis of ipfs/kubo@329838acdf (2026-09-03). Data as JSON: /api/errors/ac8f62de4abc5687. Report an issue: GitHub.