Class JcaPrivateKeyReader

java.lang.Object
org.bouncycastle.openssl.jcajce.JcaPrivateKeyReader
public class JcaPrivateKeyReader extends Object
Reads a private key in any of the common OpenSSL on-disk forms and converts it to a JCA PrivateKey, transparently decrypting the password-protected variants.

The following encodings are recognised, on the PEM side by the type PEMParser hands back and on the DER side by the structure of the outermost SEQUENCE:

  • traditional (PKCS#1) RSA keys - -----BEGIN RSA PRIVATE KEY----- and their DER body;
  • PKCS#8 PrivateKeyInfo - -----BEGIN PRIVATE KEY----- and DER;
  • password-protected traditional keys (-----BEGIN ... PRIVATE KEY----- with a Proc-Type/DEK-Info header), decrypted with the supplied password;
  • encrypted PKCS#8 (-----BEGIN ENCRYPTED PRIVATE KEY----- and DER EncryptedPrivateKeyInfo), decrypted with the supplied password.

This is the JCA-aware read-side companion to JcaPKIXIdentityBuilder and lives in the .jcajce package because it produces a PrivateKey. It is a convenience over PEMParser / JcaPEMKeyConverter only - the standards-compliant writers (JcaPKCS8Generator, JcePEMEncryptorBuilder, JceOpenSSLPKCS8EncryptorBuilder) remain the way to emit keys.

  • Constructor Details

    • JcaPrivateKeyReader

      public JcaPrivateKeyReader()
      Base constructor for reading unencrypted keys. Supplying an encrypted key to a reader built this way results in a PEMException.

    • JcaPrivateKeyReader

      public JcaPrivateKeyReader(char[] password)
      Construct a reader carrying the password used to decrypt password-protected keys. The password is ignored when the key turns out to be unencrypted.
      Parameters:
      password - the password to decrypt with, or null if no encrypted key is expected.

  • Method Details

    • setProvider

      public JcaPrivateKeyReader setProvider(Provider provider)

    • setProvider

      public JcaPrivateKeyReader setProvider(String providerName)

    • readKey

      public PrivateKey readKey(File keyFile) throws IOException
      Read a private key from a PEM or DER file, auto-detecting the encoding.
      Parameters:
      keyFile - the file containing the key.
      Returns:
      the recovered private key.
      Throws:
      IOException - on a read, parse, or decryption failure.

    • readKey

      public PrivateKey readKey(InputStream keyStream) throws IOException
      Read a private key from a stream of PEM or DER bytes, auto-detecting the encoding. The stream is fully drained but not closed.
      Parameters:
      keyStream - the stream containing the key.
      Returns:
      the recovered private key.
      Throws:
      IOException - on a read, parse, or decryption failure.

    • readKey

      public PrivateKey readKey(byte[] encoding) throws IOException
      Read a private key from a buffer of PEM or DER bytes, auto-detecting the encoding.
      Parameters:
      encoding - the key bytes.
      Returns:
      the recovered private key.
      Throws:
      IOException - on a parse or decryption failure.

    • readKey

      public PrivateKey readKey(Reader reader) throws IOException
      Read a private key from a PEM reader. The reader is consumed but not closed.
      Parameters:
      reader - a reader positioned at a PEM private key object.
      Returns:
      the recovered private key.
      Throws:
      IOException - on a parse or decryption failure.