is PKCS8EncodedKeySpec capable to read both PKCS1 and PKCS8 private key

Question

Although the title is a question but I just managed to do this with the same code, while I am just not sure whether PKCS8EncodedKeySpec is designed to do this job, or my private key is generated by accident to make this work(key generated by openssl).

my code(pemPath is pem type private key file path):

try (BufferedReader bufferedReader = new BufferedReader(new FileReader(pemPath))) {
    StringBuilder stringBuilder = new StringBuilder();
    String line;

    while ((line = bufferedReader.readLine()) != null) {
        if (!line.startsWith("--")) {
            stringBuilder.append(line);
        }
    }

    PKCS8EncodedKeySpec priPKCS8 = new PKCS8EncodedKeySpec(
            Base64.getDecoder().decode(stringBuilder.toString()));
    KeyFactory keyFactory = KeyFactory.getInstance("RSA");
    PrivateKey key = keyFactory.generatePrivate(priPKCS8);
}

And also I paste PKCS1 file content:

and PKCS8 file content:

By the way, both private keys succeed to decrypt the same cipher text.
And the openssl command:

openssl genrsa -out rsa_private_key_2048.pem 2048
openssl pkcs8 -topk8 -in rsa_private_key_2048.pem -out pkcs8_rsa_private_key_2048.pem -nocrypt

Java has no support to load pkcs1 keys. How do you loaded it? — pedrofb, Mar 13 '17 at 07:10
@pedrofb I have pasted my code, just ignore the `-----BEGIN RSA PRIVATE KEY-----` and `-----END RSA PRIVATE KEY-----` line, then concatenate the other string, decode the final string with base64 tool to byte array which will be the param of `PKCS8EncodedKeySpec` constructor. Just to clarify, I am using java8. — xuanzhui, Mar 13 '17 at 08:17
Running your example with java8 and `-----BEGIN RSA PRIVATE KEY-----` key throws `Caused by: java.security.InvalidKeyException: IOException : algid parse error, not a sequence`. Ensure you are reading the correct file, because you shouldn't be able to load pkcs1 key — pedrofb, Mar 13 '17 at 09:12
@pedrofb, thanks for your test, I just find that I have a static statement `static { Security.addProvider(new BouncyCastleProvider()); }` which is used for other purpose, it seems to have an impact on the default behavior. After I delete the statement, I get the same error in your comment. — xuanzhui, Mar 13 '17 at 12:50
Bouncycastle is able to load PCKS#1 keys, so your code was using BouncyCastle cryptographic provider instead of JVM default. Summarizing, to load a pkcs1 key you can convert it to pkcs8 using openssl or use Bouncycastle — pedrofb, Mar 13 '17 at 13:17
Check `KeyFactory.getInstance` code, it will iterate over the available providers, during the process there would be exception but would be caught until the capable provider found or the last provider reached. That should be the reason why adding `BouncyCastleProvider` works. — xuanzhui, Mar 13 '17 at 15:07
Here is a solution: https://stackoverflow.com/a/55339208/975386 — Jean-Alexis Aufauvre, Mar 25 '19 at 13:49

score -1 · Answer 1 · answered Feb 20 '19 at 17:01

-1

What if the private key in PEM format(PKCS#1 format)string being passed in a json payload input. PKCS8EncodedKeySpec is currently working for both PKCS#1 and PKCS#8. The provider is SunRsaSign.

answered Feb 20 '19 at 17:01

Vikas Rai

87
12

This does not provide an answer to the question. You can [search for similar questions](//stackoverflow.com/search), or refer to the related and linked questions on the right-hand side of the page to find an answer. If you have a related but different question, [ask a new question](//stackoverflow.com/questions/ask), and include a link to this one to help provide context. See: [Ask questions, get answers, no distractions](//stackoverflow.com/tour) – Zoe Feb 20 '19 at 17:04

is PKCS8EncodedKeySpec capable to read both PKCS1 and PKCS8 private key

1 Answers1