pkcs8

README

pkcs8

OpenSSL can generate private keys in both "traditional format" and PKCS#8 format. Newer applications are advised to use more secure PKCS#8 format. Go standard crypto package provides a function to parse private key in PKCS#8 format. There is a limitation to this function. It can only handle unencrypted PKCS#8 private keys. To use this function, the user has to save the private key in file without encryption, which is a bad practice to leave private keys unprotected on file systems. In addition, Go standard package lacks the functions to convert RSA/ECDSA private keys into PKCS#8 format.

pkcs8 package fills the gap here. It implements functions to process private keys in PKCS#8 format, as defined in RFC5208 and RFC5958. It can handle both unencrypted PKCS#8 PrivateKeyInfo format and EncryptedPrivateKeyInfo format with PKCS#5 (v2.0) algorithms.

Godoc

Installation

Supports Go 1.9+

go get github.com/youmark/pkcs8

dependency

This package depends on golang.org/x/crypto/pbkdf2 package. Use the following command to retrive pbkdf2 package

go get golang.org/x/crypto/pbkdf2

Documentation

Overview

Package pkcs8 implements functions to parse and convert private keys in PKCS#8 format, as defined in RFC5208 and RFC5958

Index

• func ConvertPrivateKeyToPKCS8(priv interface{}, v ...[]byte) ([]byte, error)
• func ParsePKCS8PrivateKey(der []byte, v ...[]byte) (interface{}, error)
• func ParsePKCS8PrivateKeyECDSA(der []byte, v ...[]byte) (*ecdsa.PrivateKey, error)
• func ParsePKCS8PrivateKeyRSA(der []byte, v ...[]byte) (*rsa.PrivateKey, error)

Functions

func ConvertPrivateKeyToPKCS8

func ConvertPrivateKeyToPKCS8(priv interface{}, v ...[]byte) ([]byte, error)

ConvertPrivateKeyToPKCS8 converts the private key into PKCS#8 format. To encrypt the private key, the password of []byte type should be provided as the second parameter.

The only supported key types are RSA and ECDSA (*rsa.PublicKey or *ecdsa.PublicKey for priv)

func ParsePKCS8PrivateKey

func ParsePKCS8PrivateKey(der []byte, v ...[]byte) (interface{}, error)

ParsePKCS8PrivateKey parses encrypted/unencrypted private keys in PKCS#8 format. To parse encrypted private keys, a password of []byte type should be provided to the function as the second parameter.

The function can decrypt the private key encrypted with AES-256-CBC mode, and stored in PKCS #5 v2.0 format.

func ParsePKCS8PrivateKeyECDSA

func ParsePKCS8PrivateKeyECDSA(der []byte, v ...[]byte) (*ecdsa.PrivateKey, error)

ParsePKCS8PrivateKeyECDSA parses encrypted/unencrypted private keys in PKCS#8 format. To parse encrypted private keys, a password of []byte type should be provided to the function as the second parameter.

The function can decrypt the private key encrypted with AES-256-CBC mode, and stored in PKCS #5 v2.0 format.

func ParsePKCS8PrivateKeyRSA

func ParsePKCS8PrivateKeyRSA(der []byte, v ...[]byte) (*rsa.PrivateKey, error)

ParsePKCS8PrivateKeyRSA parses encrypted/unencrypted private keys in PKCS#8 format. To parse encrypted private keys, a password of []byte type should be provided to the function as the second parameter.

The function can decrypt the private key encrypted with AES-256-CBC mode, and stored in PKCS #5 v2.0 format.