ipfs/kubo · error

marshalling key to PKCS8 format: %w

Error message

marshalling key to PKCS8 format: %w

What it means

Failure in the PEM export path of `ipfs key export` after the libp2p key was converted: x509.MarshalPKCS8PrivateKey (or the local secp256k1 marshaller) rejected the standard Go key. This means the private key bytes are structurally invalid for its claimed algorithm, practically indicating keystore corruption or an unsupported key shape rather than a user input mistake.

Source

Thrown at core/commands/keystore.go:248

			if err != nil {
				return fmt.Errorf("converting libp2p private key to std Go key: %w", err)
			}
			// For some reason the ed25519.PrivateKey does not use pointer
			// receivers, so we need to convert it for MarshalPKCS8PrivateKey.
			// (We should probably change this upstream in PrivKeyToStdKey).
			if ed25519KeyPointer, ok := stdKey.(*ed25519.PrivateKey); ok {
				stdKey = *ed25519KeyPointer
			}
			if secpKey, ok := stdKey.(*crypto.Secp256k1PrivateKey); ok {
				// crypto/x509 does not support the secp256k1 curve
				formattedKey, err = marshalSecp256k1PrivateKey(secpKey)
			} else {
				// This function supports a restricted list of public key algorithms,
				// but we generate and use only the RSA and ed25519 types that are on that list.
				formattedKey, err = x509.MarshalPKCS8PrivateKey(stdKey)
			}
			if err != nil {
				return fmt.Errorf("marshalling key to PKCS8 format: %w", err)
			}

		case keyFormatLibp2pCleartextOption:
			formattedKey, err = crypto.MarshalPrivateKey(sk)
			if err != nil {
				return err
			}
		default:
			return fmt.Errorf("unrecognized export format: %s", exportFormat)
		}

		return res.Emit(bytes.NewReader(formattedKey))
	},
	PostRun: cmds.PostRunMap{
		cmds.CLI: func(res cmds.Response, re cmds.ResponseEmitter) error {
			req := res.Request()

			v, err := res.Next()

View on GitHub (pinned to 329838acdf)

Solutions

1. Regenerate the key with ipfs key gen and re-import dependent resources
2. Export with --format=libp2p-protobuf-cleartext to bypass PKCS8 marshalling
3. Verify the keystore file under <IPFS_PATH>/keystore is not truncated or corrupted

When it happens

Trigger: Thrown at core/commands/keystore.go:248 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ipfs/kubo@329838acdf (2026-09-03). Data as JSON: /api/errors/d4169654deaf3cb4. Report an issue: GitHub.