ipfs/kubo · error

unsupported EC private key version %d

Error message

unsupported EC private key version %d

What it means

The ASN.1 ecPrivateKey structure carries a version field that must be 1 (ecPrivateKeyVersion) for secp256k1 keys. parseSecp256k1PrivateKey rejects any other version with "unsupported EC private key version %d", including the numeric version in the message. This guards against parsing structures that decode as ASN.1 but are not valid EC private keys.

Source

Thrown at core/commands/keystore.go:1071

	}
	var curve asn1.ObjectIdentifier
	if _, err := asn1.Unmarshal(wrapper.Algo.Parameters.FullBytes, &curve); err != nil {
		return false
	}
	return curve.Equal(oidNamedCurveSecp256k1)
}

func parseSecp256k1PrivateKey(der []byte) (*secp256k1.PrivateKey, error) {
	var wrapper pkcs8Key
	if _, err := asn1.Unmarshal(der, &wrapper); err != nil {
		return nil, err
	}
	var ec ecPrivateKey
	if _, err := asn1.Unmarshal(wrapper.PrivateKey, &ec); err != nil {
		return nil, fmt.Errorf("invalid EC private key: %w", err)
	}
	if ec.Version != 1 {
		return nil, fmt.Errorf("unsupported EC private key version %d", ec.Version)
	}
	if len(ec.PrivateKey) > 32 {
		return nil, errors.New("invalid EC private key length")
	}
	var buf [32]byte
	copy(buf[32-len(ec.PrivateKey):], ec.PrivateKey)
	var scalar secp256k1.ModNScalar
	if overflow := scalar.SetBytes(&buf); overflow != 0 || scalar.IsZero() {
		return nil, errors.New("EC private key not in the valid range for secp256k1")
	}
	return secp256k1.NewPrivateKey(&scalar), nil
}

View on GitHub (pinned to 329838acdf)

Solutions

1. Re-export the key in standard PKCS#8 (`openssl pkcs8 -topk8 -nocrypt -in key.pem`)
2. Verify the key with `openssl asn1parse -in key.pem` and confirm version INTEGER is 1
3. Ensure the curve is secp256k1 and the file is PEM/DER PKCS#8 as documented for `ipfs key import`

openssl asn1parse -in key.pem | grep 'INTEGER.*:01' || echo "EC version field not 1 - re-export the key"

key, err := parseSecp256k1PrivateKey(der)
if err != nil && strings.Contains(err.Error(), "unsupported EC private key version") {
    // key came from a nonstandard encoder; re-export via openssl pkcs8
}

When it happens

Trigger: Importing a DER blob whose inner structure decodes as ecPrivateKey but with a version other than 1 — often a mis-parsed wrapper or a key from an exotic/nonstandard encoder.

Common situations: Keys exported by nonstandard tools; manually crafted ASN.1; wrong offset parsing of a compound structure that coincidentally decodes; very old or proprietary wallet export formats.

Related errors

• invalid EC private key: %w
• parsing PKCS8 format: %w
• unrecognized key type: %s
• failed to decode PrivKey: %w
• failed to derive PeerID from PrivKey: %w

AI-assisted analysis of ipfs/kubo@329838acdf (2026-09-03). Data as JSON: /api/errors/33c08d628ae1bbc6. Report an issue: GitHub.