How to validate a private key?

Question

I could not find any library that, given an hex value, returns true if the given string is a valid ether private key.

Any hints?

Answer 1

As mentioned by Peter, a private key is a random 256 bit blob. It is a common oversight that there're no restrictions.

It has to be valid for the secp256k1 curve, which means two conditions:

• cannot be zero
• must be less than the order of the curve (called n and has a value of ffffffff ffffffff ffffffff fffffffe baaedce6 af48a03b bfd25e8c d0364141)

In Javascript you can use ethereumjs-wallet to do this verification: Wallet.fromPrivateKey(<yourkey>) will throw an exception on an invalid input.

Alternatively you can also use the privateKeyVerify() method from the underlying library secp256k1 or do it manually with the big number library of your choice.

Answer 2

You can also use ethers to check. Like this:

const ethers = require('ethers')

var pk = '0xcaed41dd92c1548cf7536c290e6a1871757fb5fea5721dea3a08c6d4abcd16cf'
let w = new ethers.Wallet(pk)

// Shorter than 32 bytes
pk = '0xcaed41dd92c1548cf7536c290e6a1871757fb5fea5721dea3a08c6d4abcd16'
w = new ethers.Wallet(pk)

// Incorrect hexidecimal string. Change last f to g. G is not hex 
pk = '0xcaed41dd92c1548cf7536c290e6a1871757fb5fea5721dea3a08c6d4abcd16cg'
w = new ethers.Wallet(pk)

The first case is ok and will succeed.

The second one will throw an error

  reason: 'exactly 32 bytes required',
  code: 'INVALID_ARGUMENT',

The third one will also throw an error:

  reason: 'invalid hexidecimal string',
  code: 'INVALID_ARGUMENT',

You can catch this error to validate your privateKey

pk = '0xcaed41dd92c1548cf7536c290e6a1871757fb5fea5721dea3a08c6d4abcd16cg'
try {
    w = new ethers.Wallet(pk)
}
catch (e) {
    console.log('Invalid private key.')
}

Answer 3

important: this answer refers to the public address, not private key, see comments.

Every hex string is a valid Ethereum address.

Currently there are no address checksums implemented, so all the 0x<40 hex digits here> are valid. We are considering adding basic ICAP in Geth 1.4.1 or Geth 1.5 to allow inserting additional information into an address that would prevent mistyping them, but until then as long as it's 40 hex characters, it's valid.