What causes "unrecognized key kind: %v" in tailscale/tailscale?

Always set Kind: tka.Key25519 when constructing keys

unrecognized key kind: %v

Error message

unrecognized key kind: %v

What it means

Only ed25519 keys (Kind = Key25519) are valid in the current tailnet key authority; StaticValidate rejects any other Kind. Key.Ed25519() similarly refuses non-25519 kinds, so unrecognized kinds surface early whether you are validating or using a key.

Source

Thrown at tka/key.go:131

	}

	// We have an arbitrary upper limit on the amount
	// of metadata that can be associated with a key, so
	// people don't start using it as a key-value store and
	// causing pathological cases due to the number + size of
	// AUMs.
	var metaBytes uint
	for k, v := range k.Meta {
		metaBytes += uint(len(k) + len(v))
	}
	if metaBytes > maxMetaBytes {
		return fmt.Errorf("key metadata too big (%d > %d)", metaBytes, maxMetaBytes)
	}

	switch k.Kind {
	case Key25519:
	default:
		return fmt.Errorf("unrecognized key kind: %v", k.Kind)
	}
	return nil
}

View on GitHub (pinned to 6e0912f979)

Solutions

Always set Kind: tka.Key25519 when constructing keys
Run StaticValidate on deserialized keys and reject/drop AUMs from incompatible versions
Check Kind before calling Ed25519()

Example fix

// before
k := tka.Key{Public: pub, Votes: 1} // Kind left as zero value

// after
k := tka.Key{Kind: tka.Key25519, Public: pub, Votes: 1}

Defensive patterns

Strategy: type-guard

Validate before calling

// After deserializing an AUM, validate its keys before persisting
for _, k := range aum.State.Keys {
    if k.Kind != tka.Key25519 {
        return fmt.Errorf("rejecting AUM with unsupported key kind %v", k.Kind)
    }
}

Type guard

func isSupportedKeyKind(k tka.KeyKind) bool { return k == tka.Key25519 }

Prevention

Always set Kind explicitly when constructing tka.Key literals
Check Kind before calling Key.Ed25519()
Reject AUMs from incompatible implementations instead of best-effort parsing

When it happens

Trigger: Constructing tka.Key with an unset or wrong Kind constant (the zero value is invalid), or deserializing AUMs produced by a newer or different implementation that defined new key kinds.

Common situations: Incomplete Key struct literals; forward-compatibility handling of foreign or future-version AUMs.

Related errors

AI-assisted analysis of tailscale/tailscale@6e0912f979 (2026-08-18). Data as JSON: /api/errors/aca244ead857c788. Report an issue: GitHub.