Bouncycastle can't generate private key - Unknown KeySpec type: java.security.spec.X509EncodedKeySpec

John Baker :

I can't generate private key with bouncycastle due to Unknown KeySpec type: java.security.spec.X509EncodedKeySpec. (However doing same for public key doesn't throw exception and works - why?)

java.security.spec.InvalidKeySpecException: Unknown KeySpec type: java.security.spec.X509EncodedKeySpec at org.bouncycastle.jcajce.provider.asymmetric.rsa.KeyFactorySpi.engineGeneratePrivate(Unknown Source) at java.security.KeyFactory.generatePrivate(KeyFactory.java:366)

        PemReader pemReader = new PemReader(new InputStreamReader(new FileInputStream("private_unencrypted.pem")));
        PemObject pemObject = pemReader.readPemObject();
        pemReader.close();

        KeyFactory keyFactory = KeyFactory.getInstance("RSA", "BC");
        byte[] privateKeyBytes = pemObject.getContent();
        X509EncodedKeySpec x509KeySpec = new X509EncodedKeySpec(privateKeyBytes);
        PrivateKey privateKey = keyFactory.generatePrivate(x509KeySpec);

michalk :

For RSA private keys you should be using PKCS8EncodedKeySpec if your key is encoded in PKCS8 format. PKCS8 format usually looks like :

-----BEGIN PRIVATE KEY-----
base64 encoded der key
-----END PRIVATE KEY-----

If your key is in PKCS1 format and looks like :

-----BEGIN RSA RIVATE KEY-----
base64 der encoded key
-----END RSA PRIVATE KEY-----

you should first convert it to PKCS8 format and then use the class mentioned above.

However doing same for public key doesn't throw exception and works - why?

Because public keys, which are usually part of Certificates, are encoded in X509 format, however private keys are usually encoded in PKCS format.