rustdesk/rustdesk-server · error

Invalid Public key

Error message

Invalid Public key

What it means

The decoded public key is passed to sign::PublicKey::from_slice; Ed25519 public keys must be exactly 32 bytes, so a wrong-length decoded buffer yields None and the code bails with "Invalid Public key". The input was valid base64 but not a valid Ed25519 public key.

Solutions

1. Pass the PUBLIC key (decodes to exactly 32 bytes) to the public-key argument.
2. Check decoded length: `echo '<pk>' | base64 -d | wc -c` must print 32.
3. Use the matching pair from the same generated key file rather than mixing keys from different pairs.

Example fix

// before: 64-byte secret key in the public slot
-K '<64-byte-base64-secret-key>'
// after: 32-byte public key
-K '<32-byte-base64-public-key>'

let decoded = base64::decode(pk.trim())?;
assert_eq!(decoded.len(), 32, "Ed25519 public key must decode to 32 bytes, got {}", decoded.len());

fn is_public_key_b64(s: &str) -> bool { base64::decode(s).map(|b| b.len() == 32).unwrap_or(false) }

When it happens

Trigger: A base64 argument that decodes to a byte length other than 32 - e.g. a secret key (64 bytes) pasted into the public-key slot, or a truncated/padded-incorrect key.

Common situations: Swapping -k and -K arguments; using a keypair from a different algorithm; hand-truncating the key; key generated with different encoding (hex).

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• Invalid Secret key
• Invalid secret key
• Invalid public key
• Key pair is INVALID

AI-assisted analysis of rustdesk/rustdesk-server@a7736be5e4 (2026-09-09). Data as JSON: /api/errors/37d7eac4ba898a1b. Report an issue: GitHub.

Appendix: source

Thrown at src/utils.rs:56

        bail!("Invalid secret key");
    }
    let sk1 = sk1.unwrap();

    let secret_key = sign::SecretKey::from_slice(sk1.as_slice());
    if secret_key.is_none() {
        bail!("Invalid Secret key");
    }
    let secret_key = secret_key.unwrap();

    let pk1 = base64::decode(pk);
    if pk1.is_err() {
        bail!("Invalid public key");
    }
    let pk1 = pk1.unwrap();

    let public_key = sign::PublicKey::from_slice(pk1.as_slice());
    if public_key.is_none() {
        bail!("Invalid Public key");
    }
    let public_key = public_key.unwrap();

    let random_data_to_test = b"This is meh.";
    let signed_data = sign::sign(random_data_to_test, &secret_key);
    let verified_data = sign::verify(&signed_data, &public_key);
    if verified_data.is_err() {
        bail!("Key pair is INVALID");
    }
    let verified_data = verified_data.unwrap();

    if random_data_to_test != &verified_data[..] {
        bail!("Key pair is INVALID");
    }

    Ok(())
}

View on GitHub (pinned to a7736be5e4)