key was not 32 bytes, is invalid ECDSA P256 private key

Error message

key was not 32 bytes, is invalid ECDSA P256 private key

What it means

For a Curve_P256 key, the decrypted plaintext must be exactly 32 bytes (an ECDSA P256 private scalar). This error is returned when the decrypted payload length differs, meaning the plaintext is not a valid P256 private key.

Source

Thrown at cert/crypto.go:295

	var bytes []byte
	switch ned.EncryptionMetadata.EncryptionAlgorithm {
	case "AES-256-GCM":
		bytes, err = aes256Decrypt(passphrase, &ned.EncryptionMetadata.Argon2Parameters, ned.Ciphertext)
		if err != nil {
			return curve, nil, r, err
		}
	default:
		return curve, nil, r, fmt.Errorf("unsupported encryption algorithm: %s", ned.EncryptionMetadata.EncryptionAlgorithm)
	}

	switch curve {
	case Curve_CURVE25519:
		if len(bytes) != ed25519.PrivateKeySize {
			return curve, nil, r, fmt.Errorf("key was not %d bytes, is invalid ed25519 private key", ed25519.PrivateKeySize)
		}
	case Curve_P256:
		if len(bytes) != 32 {
			return curve, nil, r, fmt.Errorf("key was not 32 bytes, is invalid ECDSA P256 private key")
		}
	}

	return curve, bytes, r, nil
}

View on GitHub (pinned to dd8f660c0a)

Solutions

Re-obtain or re-copy the encrypted key file — it is likely truncated or corrupted
Verify the key was created as an ECDSA P256 key with correct 32-byte scalar material
Regenerate the signing key with nebula-cert and re-sign affected certificates

Defensive patterns

Strategy: try-catch

Try / catch

curve, key, rest, err := cert.DecryptAndUnmarshalSigningPrivateKey(pass, b)
if err != nil {
	if strings.Contains(err.Error(), "invalid ECDSA P256 private key") {
		return fmt.Errorf("decrypted P256 key is not 32 bytes; key file is corrupt or truncated, restore from backup: %w", err)
	}
	return err
}

Prevention

Store key files with checksums and verify on load
Use atomic file writes when generating or updating keys
Keep a backup of signing keys; a wrong-length plaintext means the file is damaged

When it happens

Trigger: DecryptAndUnmarshalSigningPrivateKey with an EncryptedECDSAP256PrivateKeyBanner whose decrypted ciphertext is not 32 bytes — truncated or corrupted key file, corrupted ciphertext, or wrong data encrypted under the P256 banner.

Common situations: Key files damaged in transfer, partial writes to disk, or tooling that encrypted wrong-length material under an ECDSA banner.

Related errors

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/f71b5e5345bb0426. Report an issue: GitHub.