ipfs/kubo · error

unrecognized key type: %s

Error message

unrecognized key type: %s

What it means

CreateIdentity generates a keypair for a new node identity (ipfs init, key rotation, 'ipfs key generate'). Its switch only supports 'rsa', 'ed25519', and 'secp256k1'; any other Algorithm from KeyGenerateOptions reaches the default branch and returns this error before any key material is created.

Source

Thrown at config/init.go:280

		fmt.Fprintf(out, "generating ED25519 keypair...")
		priv, pub, err := crypto.GenerateEd25519Key(rand.Reader)
		if err != nil {
			return ident, err
		}

		sk = priv
		pk = pub
	case "secp256k1":
		fmt.Fprintf(out, "generating secp256k1 keypair...")
		priv, pub, err := crypto.GenerateSecp256k1Key(rand.Reader)
		if err != nil {
			return ident, err
		}

		sk = priv
		pk = pub
	default:
		return ident, fmt.Errorf("unrecognized key type: %s", settings.Algorithm)
	}
	fmt.Fprintf(out, "done\n")

	// currently storing key unencrypted. in the future we need to encrypt it.
	// TODO(security)
	skbytes, err := crypto.MarshalPrivateKey(sk)
	if err != nil {
		return ident, err
	}
	ident.PrivKey = base64.StdEncoding.EncodeToString(skbytes)

	id, err := peer.IDFromPublicKey(pk)
	if err != nil {
		return ident, err
	}
	ident.PeerID = id.String()
	fmt.Fprintf(out, "peer identity: %s\n", ident.PeerID)
	return ident, nil

View on GitHub (pinned to 329838acdf)

Solutions

1. Use a supported algorithm: --type ed25519 (recommended default), rsa, or secp256k1 — e.g. ipfs key gen mykey --type ed25519
2. Check spelling and casing: the comparison is exact lowercase ('rsa', 'ed25519', 'secp256k1'), so 'RSA' fails
3. For ipfs init, either drop --algorithm (defaults to ed25519) or pass an explicit supported value

Example fix

// before
ipfs key gen mykey --type ecdsa
// after
ipfs key gen mykey --type ed25519

allowed := map[string]bool{"rsa": true, "ed25519": true, "secp256k1": true}
if !allowed[algo] {
	return fmt.Errorf("key algorithm %q unsupported; use rsa|ed25519|secp256k1", algo)
}

func isSupportedKeyAlgo(algo string) bool {
	switch algo {
	case "rsa", "ed25519", "secp256k1":
		return true
	}
	return false
}

ident, err := config.CreateIdentity(os.Stdout, opts)
if err != nil {
	if strings.HasPrefix(err.Error(), "unrecognized key type") {
		return fmt.Errorf("unsupported --type; use ed25519, rsa, or secp256k1")
	}
	return err
}

When it happens

Trigger: Running 'ipfs init --algorithm <name>' or 'ipfs key gen <name> --type <t>' / 'ipfs key rotate --type <t>' with a type outside the three supported ones — e.g. 'ecdsa', 'RSA' (case-sensitive check), 'ed', or an empty/misspelled value.

Common situations: Using key type names from other tools (openssl 'rsa2048', 'ECDSA'); wrong casing since the switch is case-sensitive; scripting key generation with an unvalidated variable.

Related errors

• failed to decode PrivKey: %w
• decoding old private key (%v)
• cannot set Identity.PeerID to a value that does not match th
• failed to get PrivKey
• private key in config was not a string

AI-assisted analysis of ipfs/kubo@329838acdf (2026-09-03). Data as JSON: /api/errors/bb96f29d3f6228d4. Report an issue: GitHub.