jwtk/jjwt · error · InvalidKeyException

Unrecognized RSA or RSASSA-PSS key algorithm name.

Error message

Unrecognized RSA or RSASSA-PSS key algorithm name.

What it means

Thrown as InvalidKeyException by RsaSignatureAlgorithm.validateKey when the Key's algorithm name is not recognized as an RSA family algorithm ('RSA', RSASSA-PSS variants, etc.). jjwt only accepts keys whose JCA algorithm string identifies them as RSA keys for RS*/PS* signature algorithms.

Solutions

Use an RSAPublicKey/RSAPrivateKey with the RSA signature algorithm (check key instanceof java.security.interfaces.RSAPublicKey).
If the provider reports odd algorithm names, reload the key using KeyFactory.getInstance("RSA") so getAlgorithm() returns 'RSA'.
Match the signature algorithm family to the key type (HS* for SecretKey, ES*/EC keys, RS*/PS* for RSA).

Example fix

// before
SecretKey key = Keys.secretKeyFor(SignatureAlgorithm.HS256);
Jwts.builder().signWith(key, Jwts.SIG.RS256); // wrong key family
// after
KeyPair kp = Jwts.SIG.RS256.keyPair().build();
Jwts.builder().signWith(kp.getPrivate(), Jwts.SIG.RS256);

Defensive patterns

Strategy: type-guard

Validate before calling

boolean isRsaKey(Key k) { return k instanceof RSAPublicKey || k instanceof RSAPrivateKey; }

Type guard

boolean isRsaAlgorithmNamed(Key k) { return k instanceof RSAPublicKey || k instanceof RSAPrivateKey; }

Try / catch

try { jwt = Jwts.parser().verifyWith((RSAPublicKey) key).build().parseSignedClaims(token); } catch (InvalidKeyException e) { throw new IllegalArgumentException("RS* algorithms require RSA keys", e); }

Prevention

Match key family to algorithm: RS*/PS* -> RSA keys, ES* -> EC keys, HS* -> SecretKey.
Reload keys via KeyFactory.getInstance("RSA") if providers report odd algorithm names.
Avoid passing raw SecretKey objects into RSA algorithm signers.

When it happens

Trigger: Passing a non-RSA Key (e.g. a SecretKey or EC key, or a key with an unusual/blank getAlgorithm() such as 'OID.1.2.840...' or provider-specific names) to sign with/verify with an RS256/RS384/RS512/PS256/PS384/PS512 algorithm.

Common situations: Mixing key types (using an HMAC secret with RS256); keys loaded via providers that report non-standard algorithm names (some Android/old JDK providers report OID-based names); loading keys with wrong KeyFactory algorithm.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

AI-assisted analysis of jwtk/jjwt@fb71496164 (2026-09-09). Data as JSON: /api/errors/03c2a6c5dae54c8f. Report an issue: GitHub.

Appendix: source

Thrown at impl/src/main/java/io/jsonwebtoken/impl/security/RsaSignatureAlgorithm.java:184

    @Override
    public KeyPairBuilder keyPair() {
        final String jcaName = this.algorithmParameterSpec != null ? PSS_JCA_NAME : "RSA";

        //TODO: JDK 8 or later, for RSASSA-PSS, use the following instead of what is below:
        //
        // AlgorithmParameterSpec keyGenSpec = new RSAKeyGenParameterSpec(this.preferredKeyBitLength,
        //     RSAKeyGenParameterSpec.F4, this.algorithmParameterSpec);
        // return new DefaultKeyPairBuilder(jcaName, keyGenSpec).provider(getProvider()).random(Randoms.secureRandom());
        //

        return new DefaultKeyPairBuilder(jcaName, this.preferredKeyBitLength).random(Randoms.secureRandom());
    }

    @Override
    protected void validateKey(Key key, boolean signing) {
        super.validateKey(key, signing);
        if (!isRsaAlgorithmName(key)) {
            throw new InvalidKeyException("Unrecognized RSA or RSASSA-PSS key algorithm name.");
        }
        int size = KeysBridge.findBitLength(key);
        if (size < 0) return; // https://github.com/jwtk/jjwt/issues/68
        if (size < MIN_KEY_BIT_LENGTH) {
            String id = getId();
            String section = id.startsWith("PS") ? "3.5" : "3.3";
            String msg = "The RSA " + keyType(signing) + " key size (aka modulus bit length) is " + size + " bits " +
                    "which is not secure enough for the " + id + " algorithm.  The JWT JWA Specification " +
                    "(RFC 7518, Section " + section + ") states that RSA keys MUST have a size >= " +
                    MIN_KEY_BIT_LENGTH + " bits.  Consider using the Jwts.SIG." + id +
                    ".keyPair() builder to create a KeyPair guaranteed to be secure enough for " + id + ".  See " +
                    "https://tools.ietf.org/html/rfc7518#section-" + section + " for more information.";
            throw new WeakKeyException(msg);
        }
    }

    @Override
    protected byte[] doDigest(final SecureRequest<InputStream, PrivateKey> request) {

View on GitHub (pinned to fb71496164)