{"record":{"id":"170fc359c202402a","repo":"eclipse-vertx/vert.x","slug":"invalid-pkcs8-encoding-could-not-read-algorithm-i","errorCode":null,"errorMessage":"Invalid PKCS8 encoding: could not read Algorithm Identifier","messagePattern":"Invalid PKCS8 encoding: could not read Algorithm Identifier","errorType":"exception","errorClass":"VertxException","httpStatus":null,"severity":"error","filePath":"vertx-core/src/main/java/io/vertx/core/net/impl/pkcs1/PrivateKeyParser.java","lineNumber":106,"sourceCode":"   *         algorithm.\n   */\n  public static String getPKCS8EncodedKeyAlgorithm(byte[] encodedKey) {\n\n    DerParser parser = new DerParser(encodedKey);\n    Asn1Object sequence = parser.read();\n    if (sequence.getType() != DerParser.SEQUENCE) {\n      throw new VertxException(\"Invalid PKCS8 encoding: not a sequence\");\n    }\n\n    parser = sequence.getParser();\n    BigInteger version = parser.read().getInteger();\n    if (version.intValue() != 0) {\n        throw new VertxException(\"Unsupported version, expected 0 but found \" + version.intValue());\n    }\n\n    sequence = parser.read();\n    if (sequence.getType() != DerParser.SEQUENCE) {\n        throw new VertxException(\"Invalid PKCS8 encoding: could not read Algorithm Identifier\");\n    }\n\n    parser = sequence.getParser();\n    byte[] algorithmIdentifier = parser.read().getObjectIdentifier();\n    if (Arrays.equals(OID_RSA_PUBLIC_KEY, algorithmIdentifier)) {\n        return \"RSA\";\n    } else if (Arrays.equals(OID_EC_PUBLIC_KEY, algorithmIdentifier)) {\n        return \"EC\";\n    } else {\n        throw new VertxException(\"Unsupported algorithm identifier\");\n    }\n  }\n\n  /**\n   * Converts a DER encoded ECPrivateKey into a Java ECPrivateKeySpec.\n   * <p>\n   * <a href=\"https://datatracker.ietf.org/doc/html/rfc5915#section-3\">\n   * RFC 5915</a> defines the following ASN.1 syntax for an EC private key:","sourceCodeStart":88,"sourceCodeEnd":124,"githubUrl":"https://github.com/eclipse-vertx/vert.x/blob/fb308bd8c3f12c79f4ae89bef67fadf6c80d036e/vertx-core/src/main/java/io/vertx/core/net/impl/pkcs1/PrivateKeyParser.java#L88-L124","documentation":"After the version field, PKCS#8 PrivateKeyInfo must contain an AlgorithmIdentifier SEQUENCE. getPKCS8EncodedKeyAlgorithm throws VertxException('Invalid PKCS8 encoding: could not read Algorithm Identifier') when the second parsed object is not a SEQUENCE, so the key encoding is malformed or truncated.","triggerScenarios":"Passing truncated DER data (cut-off base64), a structure where the algorithm identifier is missing/reordered, or bytes from a foreign ASN.1 format mistakenly treated as PKCS#8.","commonSituations":"PEM files truncated during transfer (missing trailing base64 lines), keys hand-edited, wrong file passed (CSR or certificate fragment).","solutions":["Verify the key with openssl asn1parse -in key.pem; re-export it cleanly","Ensure the full base64 body between BEGIN/END markers is present and decoded","Reconvert: openssl pkcs8 -topk8 -nocrypt -in key.pem -out key8.pem"],"exampleFix":"// before\nString body = pem.substring(pem.indexOf(\"KEY-----\") + 8); // may truncate lines\nbyte[] der = Base64.getMimeDecoder().decode(body);\n// after\n// validate: openssl asn1parse -in key.pem\nbyte[] der = PemReader.read(keyFile); // intact PEM -> DER\nString alg = PrivateKeyParser.getPKCS8EncodedKeyAlgorithm(der);","handlingStrategy":"validation","validationCode":"byte[] der = Base64.getMimeDecoder().decode(fullPemBodyBetweenMarkers);\nif (der.length < 16) throw new IllegalArgumentException(\"key file truncated\");","typeGuard":null,"tryCatchPattern":"try {\n  alg = PrivateKeyParser.getPKCS8EncodedKeyAlgorithm(der);\n} catch (VertxException e) {\n  // verify with openssl asn1parse and re-export the key\n}","preventionTips":["Copy PEM files atomically and verify sizes/checksums","Include all base64 lines between BEGIN/END markers","Validate with openssl asn1parse before loading"],"tags":["pkcs8","der","pki"],"backgroundTag":"invalid-argument-format","analyzedSha":"fb308bd8c3f12c79f4ae89bef67fadf6c80d036e","analyzedAt":"2026-09-06T11:37:12.241Z","contentChangedAt":"2026-09-06T11:37:12.241Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}