tailscale/tailscale · error

key hex has the wrong size, got %d want %d

Error message

key hex has the wrong size, got %d want %d

What it means

parseHex reports that after stripping the type prefix, the remaining hex string decodes to a byte count that doesn't exactly fill the destination key array (got vs want sizes in the %d operands). Length is the fault, not content — e.g. a node key hex body that is not 64 characters.

Source

Thrown at types/key/util.go:76

	dst = append(dst, prefix...)
	dst = hex.AppendEncode(dst, key)
	return dst
}

// parseHex decodes a key string of the form "<prefix><hex string>"
// into out. The prefix must match, and the decoded base64 must fit
// exactly into out.
//
// Note the errors in this function deliberately do not echo the
// contents of in, because it might be a private key or part of a
// private key.
func parseHex(out []byte, in, prefix mem.RO) error {
	if !mem.HasPrefix(in, prefix) {
		return fmt.Errorf("key hex string doesn't have expected type prefix %s", prefix.StringCopy())
	}
	in = in.SliceFrom(prefix.Len())
	if want := len(out) * 2; in.Len() != want {
		return fmt.Errorf("key hex has the wrong size, got %d want %d", in.Len(), want)
	}
	for i := range out {
		a, ok1 := fromHexChar(in.At(i*2 + 0))
		b, ok2 := fromHexChar(in.At(i*2 + 1))
		if !ok1 || !ok2 {
			return errors.New("invalid hex character in key")
		}
		out[i] = (a << 4) | b
	}
	return nil
}

// fromHexChar converts a hex character into its value and a success flag.
func fromHexChar(c byte) (byte, bool) {
	switch {
	case '0' <= c && c <= '9':
		return c - '0', true
	case 'a' <= c && c <= 'f':

View on GitHub (pinned to 6e0912f979)

Solutions

1. Use the key's String()/MarshalText output verbatim; it always emits the exact hex length
2. Regenerate the key material if stored data has the wrong size
3. Avoid hand-truncating or concatenating hex key strings

When it happens

Trigger: Thrown at types/key/util.go:76 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of tailscale/tailscale@6e0912f979 (2026-08-18). Data as JSON: /api/errors/6b49fb0bce8e87b3. Report an issue: GitHub.