public final class PrivateKey
A private key – paired with a PublicKey to form a key pair. Carries the
algorithm name (“RSA” or “EC”) and the encoded key bytes.
PEM files (-----BEGIN PRIVATE KEY-----) go through fromPem, which
strips the armor and decodes the base64 for you; fromPkcs8 is the lower
level entry point for callers that already hold the DER bytes.
Methods
public static PrivateKey fromPkcs8(String algorithm, byte[] pkcs8Der) | Wraps a PKCS#8 DER blob. |
public static PrivateKey rsa(byte[] pkcs8Der) | Convenience: build an RSA PrivateKey from a fromPkcs8 PKCS#8 blob. |
public static PrivateKey fromPem(String pem) | Parses a PEM-encoded private key, determining the algorithm from the key itself: |
public static PrivateKey fromPem(byte[] pem) | fromPem over the raw bytes of a .pem file, so a stream read with Util.readInputStream can be passed straight in. |
public static PrivateKey fromPem(String algorithm, String pem) | fromPem with the algorithm supplied by the caller rather than read from the key. |
public static PrivateKey fromPem(String algorithm, byte[] pem) | fromPem(String,String) over the raw bytes of a .pem file. |
Inherited methods
From Key
Method details
fromPkcs8
public static PrivateKey fromPkcs8(String algorithm, byte[] pkcs8Der)openssl pkcs8 -topk8 -nocrypt.rsa
public static PrivateKey rsa(byte[] pkcs8Der)PrivateKey from a fromPkcs8 PKCS#8 blob.fromPem
public static PrivateKey fromPem(String pem)Parses a PEM-encoded private key, determining the algorithm from the key itself:
InputStream is = Display.getInstance().getResourceAsStream(MyApp.class, "/private.pem");
PrivateKey key = PrivateKey.fromPem(Util.readInputStream(is));
Accepts a PRIVATE KEY (PKCS#8) block and also the older
RSA PRIVATE KEY (PKCS#1) and EC PRIVATE KEY (SEC1) blocks, which are
rewrapped as PKCS#8 here – so a key straight out of ssh-keygen -m PEM
or openssl ecparam -genkey works without a conversion step, including
the EC PARAMETERS block that command writes ahead of the key: the
first block that actually is a private key is the one used. Bare base64
with no -----BEGIN----- armor is accepted too.
A passphrase-encrypted key (ENCRYPTED PRIVATE KEY) is rejected with a
CryptoException naming the command that decrypts it; so is a key that
is neither RSA nor EC.
The bytes behind a private key are sensitive – do not log the result of
getEncoded().
fromPem
public static PrivateKey fromPem(byte[] pem)fromPem over the raw bytes of a .pem file, so a stream read with
Util.readInputStream can be passed straight in. The bytes are decoded
as UTF-8.fromPem
public static PrivateKey fromPem(String algorithm, String pem)fromPem with the algorithm supplied by the caller rather than read
from the key. Use this only for a key whose algorithm OID this class
does not recognize but the platform does.fromPem
public static PrivateKey fromPem(String algorithm, byte[] pem)fromPem(String,String) over the raw bytes of a .pem file.