ipfs/kubo · error

invalid key size %d: %s keys are always %d bits

Error message

invalid key size %d: %s keys are always %d bits

What it means

This error is thrown by CheckKeySize in the IPFS interface options package when an RSA or secp256k1 key is requested with a bit size that does not match the algorithm's fixed requirement. secp256k1 keys must always be a fixed size (secp256k1KeyBits), and RSA keys must meet the algorithm's required size. The library validates this early (during option construction in CreateIdentity) so key generation fails fast with a clear message instead of deep in crypto code.

Source

Thrown at core/coreiface/options/key.go:110

// CheckKeySize validates a requested key size for the given algorithm. RSA
// accepts any size (callers apply DefaultRSALen when it is unset). ed25519 and
// secp256k1 have a fixed size, so a size is accepted only when it is unset (-1)
// or equals that size, and rejected otherwise.
func CheckKeySize(algorithm string, size int) error {
	if size == -1 {
		return nil
	}
	var fixed int
	switch algorithm {
	case "ed25519":
		fixed = ed25519KeyBits
	case "secp256k1":
		fixed = secp256k1KeyBits
	default:
		return nil
	}
	if size != fixed {
		return fmt.Errorf("invalid key size %d: %s keys are always %d bits", size, algorithm, fixed)
	}
	return nil
}

// Force is an option for Key.Rename which specifies whether to allow to
// replace existing keys.
func (keyOpts) Force(force bool) KeyRenameOption {
	return func(settings *KeyRenameSettings) error {
		settings.Force = force
		return nil
	}
}

View on GitHub (pinned to 329838acdf)

Solutions

1. For secp256k1, remove the Key.Size option entirely or set it to exactly secp256k1KeyBits (256) — secp256k1 has one valid size
2. For RSA, use one of the documented valid sizes (e.g. 2048, 4096)
3. Validate user/config-supplied key sizes against the algorithm before calling CreateIdentity
4. Use options.Key.Type to confirm which algorithm you are requesting, since the required size depends on it

Example fix

// before
opts, err := options.CreateIdentity("my-key",
    options.Key.Type(options.Ed25519Key),
    options.Key.Size(2048)) // wrong: fixed-size algorithm
// after
opts, err := options.CreateIdentity("my-key",
    options.Key.Type(options.Secp256k1Key),
    options.Key.Size(256)) // secp256k1KeyBits

const secp256k1KeyBits = 256
func validKeySize(algorithm string, size int) error {
    switch algorithm {
    case "secp256k1":
        if size != secp256k1KeyBits {
            return fmt.Errorf("secp256k1 requires %d-bit keys, got %d", secp256k1KeyBits, size)
        }
    case "rsa":
        if size < 2048 {
            return fmt.Errorf("rsa key size %d too small", size)
        }
    }
    return nil
}

opts, err := options.CreateIdentity(name, optfs...)
if err != nil {
    var cerr *fmt.Errorf // treat as user-input validation failure
    return fmt.Errorf("identity options rejected: %w", err)
}

When it happens

Trigger: Calling CreateIdentity with opts.Key.Size set to a value that does not equal secp256k1KeyBits for algorithm "secp256k1", or passing an invalid size for RSA keys. Any caller that passes a user-supplied key size without checking it against the algorithm's fixed bit length will produce this error.

Common situations: Hardcoding a generic key size like 2048 or 4096 for secp256k1 (which only supports its single fixed bit size); copying RSA key-size configuration into a secp256k1 identity; reading key size from config or CLI flags without validating per-algorithm constraints.

Related errors

• invalid type '%s', must be one of {direct, indirect, recursi
• assets: could load Asset '%s': %s
• pin check failed: %w
• r.String()
• ipfs api address could not be found

AI-assisted analysis of ipfs/kubo@329838acdf (2026-09-03). Data as JSON: /api/errors/a95b62af5b5dee96. Report an issue: GitHub.