pkcs8

README

pkcs8

OpenSSL can generate private keys in both "traditional format" and PKCS#8 format. Newer applications are advised to use more secure PKCS#8 format. Go standard crypto package provides a function to parse private key in PKCS#8 format. There is a limitation to this function. It can only handle unencrypted PKCS#8 private keys. To use this function, the user has to save the private key in file without encryption, which is a bad practice to leave private keys unprotected on file systems. In addition, Go standard package lacks the functions to convert RSA/ECDSA private keys into PKCS#8 format.

pkcs8 package fills the gap here. It implements functions to process private keys in PKCS#8 format, as defined in RFC5208 and RFC5958. It can handle both unencrypted PKCS#8 PrivateKeyInfo format and EncryptedPrivateKeyInfo format with PKCS#5 (v2.0) algorithms.

Godoc

Installation

go get github.com/youmark/pkcs8

Documentation

Overview

Package pkcs8 implements functions to parse and convert private keys in PKCS#8 format, as defined in RFC5208 and RFC5958

Index

• func ConvertPrivateKeyToPKCS8(priv interface{}, v ...[]byte) ([]byte, error)
• func ParsePKCS8PrivateKey(der []byte, v ...[]byte) (interface{}, error)

Functions

func ConvertPrivateKeyToPKCS8

func ConvertPrivateKeyToPKCS8(priv interface{}, v ...[]byte) ([]byte, error)

ConvertPrivateKeyToPKCS8 converts the private key into PKCS#8 format. To encrypt the private key, the password of []byte type should be provided as the second parameter.

The only supported key types are RSA and ECDSA (*rsa.PublicKey or *ecdsa.PublicKey for priv)

func ParsePKCS8PrivateKey

func ParsePKCS8PrivateKey(der []byte, v ...[]byte) (interface{}, error)

ParsePKCS8PrivateKey parses encrypted/unencrypted private keys in PKCS#8 format. To parse encrypted private keys, a password of []byte type should be provided to the function as the second parameter.

The function can decrypt the private key encrypted with AES-256-CBC mode, and stored in PKCS #5 v2.0 format.