Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I have the following private key. I'd like to be able to process it into an instance of ECPrivateKey using Bouncycastle (or the builtin Java security API if bouncycastle isn't necessary).
-----BEGIN EC PRIVATE KEY-----
MIGTAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBHkwdwIBAQQgtqnvswtIdNxKy07B
D3Y9vvlpwvSDqWCvyWmWTNea2ImgCgYIKoZIzj0DAQehRANCAATa0LtPPOI+De/u
RY1vSxR7gFGSoyjaDZyif/sWujLZWEj6Rc2IEl62VfWQD3GeYCEEKP9qzpOGyO+b
HWR98kNd
-----END EC PRIVATE KEY-----
An EC private key is nothing more than a 256-bit integer. You can use openssl to extract the private key (as a 256-bit integer) from the PEM file.
Try saving the PEM file that you posted on your system as private.pem. Then, use the following openssl command to extract the private key from the PEM file:
openssl ec -noout -text -inform PEM -in private.pem
This should produce:
read EC key
Private-Key: (256 bit)
priv:
b6:a9:ef:b3:0b:48:74:dc:4a:cb:4e:c1:0f:76:3d:
be:f9:69:c2:f4:83:a9:60:af:c9:69:96:4c:d7:9a:
d8:89
pub:
04:da:d0:bb:4f:3c:e2:3e:0d:ef:ee:45:8d:6f:4b:
14:7b:80:51:92:a3:28:da:0d:9c:a2:7f:fb:16:ba:
32:d9:58:48:fa:45:cd:88:12:5e:b6:55:f5:90:0f:
71:9e:60:21:04:28:ff:6a:ce:93:86:c8:ef:9b:1d:
64:7d:f2:43:5d
ASN1 OID: prime256v1
NIST CURVE: P-256
As you can see, the private key is displayed as a 256-bit integer in hexadecimal format. With the private key now in its raw format, it should be possible to consume in any environment.
You can use Bouncy Castle to convert the private key into an instance of ECPrivateKey using the following code:
// Create a Bouncy Castle provider
Provider bcProvider = new BouncyCastleProvider();
// Load the private key
String privateKeyString = "-----BEGIN EC PRIVATE KEY-----\nMIGTAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBHkwdwIBAQQgtqnvswtIdNxKy07B\nD3Y9vvlpwvSDqWCvyWmWTNea2ImgCgYIKoZIzj0DAQehRANCAATa0LtPPOI+De/u\nRY1vSxR7gFGSoyjaDZyif/sWujLZWEj6Rc2IEl62VfWQD3GeYCEEKP9qzpOGyO+b\nHWR98kNd\n-----END EC PRIVATE KEY-----";
// Get an instance of ECPrivateKey
ECPrivateKey privateKey
Yes, this is one of the PEM formats used by OpenSSL and supported by BouncyCastle's PEMParser and JcaPEMKeyConverter classes. Like other OpenSSL 'traditional' PEM formats, this actually produces a KeyPair object from which .getPrivate() gives you the privatekey object which implements, among other things, the ECPrivateKey interface.
Without Bouncy, if you get the curve AND numeric value of the raw private key, per mti2935's answer, you can put them in an ECPrivateKeySpec and run them through the generatePrivate() method of a KeyFactory returned from getInstance("EC") -- OR you can take the SEC1-format data from that file, after removing the BEGIN/END lines and de-Base64-ing, and add a fixed-per-curve prefix to make it PKCS8 format, which you can put in PKCS8EncodedKeySpec and feed to a KeyFactory instance as above. For examples of both options (but for a different curve, secp256k1), see my answer at https://stackoverflow.com/questions/48832170/generate-ec-public-key-from-byte-array-private-key-in-native-java-7 (ignoring the parts about using the resulting private key object to compute the public key).
pkey is inconsistent) if you have OpenSSL, you can just do openssl pkcs8 -topk8 -nocrypt -in sec1pem -out pkcs8der -outform der to get a binary file with the correct contents to use as PKCS8EncodedKeySpec.
Sep 5 at 2:37
openssl ec -noout -text -inform PEM -in private.pem openssl pkcs8 -topk8 -nocrypt -in private.pem -out pkcs8der -outform der OUTPUT file gives (first 64chars): 308187020100301306072a8648ce3d020106082a8648ce3d030107046d306b02 But then the code says: java.security.InvalidKeyException: Invalid EC private key Thank you
Sep 5 at 8:07
.ascis commonly used for the PGP format called armored (not ASC), which has BEGIN/END boundary lines and base64 similar to PEM, but not in fact the same and not interchangeable. The file here is PEM, NOT PGP-armored.