{"record":{"id":"1ef78eb57a11e604","repo":"ipfs/kubo","slug":"parsing-pkcs8-format-w","errorCode":null,"errorMessage":"parsing PKCS8 format: %w","messagePattern":"parsing PKCS8 format: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/commands/keystore.go","lineNumber":500,"sourceCode":"\t\t\treturn err\n\t\t}\n\n\t\timportFormat, _ := req.Options[keyFormatOptionName].(string)\n\t\tvar sk crypto.PrivKey\n\t\tswitch importFormat {\n\t\tcase keyFormatPemCleartextOption:\n\t\t\tpemBlock, rest := pem.Decode(data)\n\t\t\tif pemBlock == nil {\n\t\t\t\treturn fmt.Errorf(\"PEM block not found in input data:\\n%s\", rest)\n\t\t\t}\n\n\t\t\tif pemBlock.Type != \"PRIVATE KEY\" {\n\t\t\t\treturn fmt.Errorf(\"expected PRIVATE KEY type in PEM block but got: %s\", pemBlock.Type)\n\t\t\t}\n\n\t\t\tstdKey, err := parsePKCS8PrivateKey(pemBlock.Bytes)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"parsing PKCS8 format: %w\", err)\n\t\t\t}\n\n\t\t\t// In case ed25519.PrivateKey is returned we need the pointer for\n\t\t\t// conversion to libp2p (see export command for more details).\n\t\t\tif ed25519KeyPointer, ok := stdKey.(ed25519.PrivateKey); ok {\n\t\t\t\tstdKey = &ed25519KeyPointer\n\t\t\t}\n\n\t\t\tsk, _, err = crypto.KeyPairFromStdKey(stdKey)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"converting std Go key to libp2p key: %w\", err)\n\t\t\t}\n\t\tcase keyFormatLibp2pCleartextOption:\n\t\t\tsk, err = crypto.UnmarshalPrivateKey(data)\n\t\t\tif err != nil {\n\t\t\t\t// check if data is PEM, if so, provide user with hint\n\t\t\t\tpemBlock, _ := pem.Decode(data)\n\t\t\t\tif pemBlock != nil {","sourceCodeStart":482,"sourceCodeEnd":518,"githubUrl":"https://github.com/ipfs/kubo/blob/329838acdfafae224582930457efe80aa217afc0/core/commands/keystore.go#L482-L518","documentation":"The PEM block had type \"PRIVATE KEY\" but its DER payload could not be parsed as a PKCS8 PrivateKeyInfo (x509.ParsePKCS8PrivateKey). The bytes are malformed, truncated, or use an algorithm Go cannot decode.","triggerScenarios":"`ipfs key import name -f pem-pkcs8-cleartext` on a file whose PRIVATE KEY base64 body is corrupted/cut off, or whose inner algorithm is unsupported by Go's x509 parser (e.g. some EC curves or exotic algorithms not among RSA/ECDSA/Ed25519).","commonSituations":"File mangled by editor/transfer (line wrapping broken, partial upload), a PEM block produced by a non-standard tool, or a key type outside Go's supported PKCS8 set.","solutions":["Verify the file parses with `openssl pkey -in key.pem -noout`; if openssl fails, regenerate or re-export the key","Re-download/re-copy the file and confirm integrity (checksum); truncate/whitespace damage is the usual cause","Convert with openssl (`openssl pkcs8 -topk8 -nocrypt`) to normalize the encoding before importing","Check the wrapped key algorithm is one Go supports: RSA, ECDSA (P-224/256/384/521), or Ed25519"],"exampleFix":"// before: import a partially copied file\n$ ipfs key import mykey -f pem-pkcs8-cleartext key.pem\nError: parsing PKCS8 format: asn1: structure error...\n// after: validate and regenerate\n$ openssl pkey -in key.pem -noout || openssl genpkey -algorithm ED25519 -out key.pem\n$ ipfs key import mykey -f pem-pkcs8-cleartext key.pem","handlingStrategy":"validation","validationCode":"if err := exec.Command(\"openssl\", \"pkey\", \"-in\", \"key.pem\", \"-noout\").Run(); err != nil {\n    return fmt.Errorf(\"key.pem is not a valid key; regenerate or re-export it\")\n}","typeGuard":null,"tryCatchPattern":"err := runImport()\nvar parseErr *asn1.StructuralError\nif errors.As(err, &parseErr) {\n    // PKCS8/DER corruption: re-export or regenerate the key file\n}","preventionTips":["Validate the PEM with `openssl pkey -in key.pem -noout` before import","Transfer key files with checksums (sha256sum) to catch truncation","Avoid editing PEM files with editors that rewrap or strip whitespace"],"tags":["keystore","pkcs8","asn1","key-import"],"backgroundTag":"pkcs8-parse-failed","analyzedSha":"329838acdfafae224582930457efe80aa217afc0","analyzedAt":"2026-09-03T18:30:52.135Z","contentChangedAt":"2026-09-03T18:30:52.135Z","schemaVersion":2},"datasetVersion":"2026-09-11T00:17:11.886Z"}