{"record":{"id":"a7b5fce1a23350f9","repo":"MuntashirAkon/AppManager","slug":"stream-does-not-contain-an-unencrypted-private-key","errorCode":null,"errorMessage":"Stream does not contain an unencrypted private key.","messagePattern":"Stream does not contain an unencrypted private key\\.","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"app/src/main/java/io/github/muntashirakon/AppManager/crypto/ks/KeyStoreUtils.java","lineNumber":239,"sourceCode":"                } else {\n                    switch (line) {\n                        case RSA_BEGIN_HEADER:\n                            readingKey = true;\n                            rsaFormat = true;\n                            break;\n                        case DSA_BEGIN_HEADER:\n                            readingKey = true;\n                            dsaFormat = true;\n                            break;\n                        case PKCS8_BEGIN_HEADER:\n                            readingKey = true;\n                            pkcs8Format = true;\n                            break;\n                    }\n                }\n            }\n            if (base64EncodedKey.length() == 0) {\n                throw new IOException(\"Stream does not contain an unencrypted private key.\");\n            }\n\n            BASE64Decoder decoder = new BASE64Decoder();\n            byte[] bytes = decoder.decodeBuffer(base64EncodedKey.toString());\n\n            KeyFactory kf;\n            KeySpec spec;\n            if (pkcs8Format) {\n                kf = KeyFactory.getInstance(\"RSA\");\n                spec = new PKCS8EncodedKeySpec(bytes);\n            } else if (rsaFormat) {\n                // PKCS#1 format\n                kf = KeyFactory.getInstance(\"RSA\");\n                List<BigInteger> rsaIntegers = new ArrayList<>();\n                ASN1Parse(bytes, rsaIntegers);\n                if (rsaIntegers.size() < 8) {\n                    throw new InvalidKeyException(\"Stream does not appear to be a properly formatted RSA key.\");\n                }","sourceCodeStart":221,"sourceCodeEnd":257,"githubUrl":"https://github.com/MuntashirAkon/AppManager/blob/0152f468fc9463ee02dc2ca83f6fe4989a2c4ca5/app/src/main/java/io/github/muntashirakon/AppManager/crypto/ks/KeyStoreUtils.java#L221-L257","documentation":"generatePrivateKey parses a PEM/DER private key stream, accumulating base64 content between BEGIN/END markers. If no base64 key material is found (empty accumulation), it throws IOException \"Stream does not contain an unencrypted private key.\" — i.e. the input wasn't an unencrypted PEM private key.","triggerScenarios":"Calling generatePrivateKey with a stream that is not an unencrypted PKCS#8/PKCS#1 PEM key: encrypted PEM (\"ENCRYPTED PRIVATE KEY\", or password prompt lines), certificates, wrong file, or binary key where headers don't match expected patterns.","commonSituations":"User selected the certificate (.crt/.pem) instead of the key; key is openssl-encrypted and requires a passphrase; file exported in a format (e.g. PuTTY .ppk or XML) the parser doesn't recognize.","solutions":["Supply an unencrypted PEM private key (-----BEGIN PRIVATE KEY----- or -----BEGIN RSA PRIVATE KEY-----).","Decrypt an encrypted key first: openssl pkcs8 -topk8 -nocrypt -in encrypted.key -out unencrypted.key (enter passphrase, choose empty).","Verify the correct file is selected — a private key file, not the certificate.","Convert non-PEM formats (e.g. puttygen export to OpenSSH/PEM)."],"exampleFix":"// before\nInputStream is = cr.openInputStream(encryptedKeyUri);\nPrivateKey pk = KeyStoreUtils.generatePrivateKey(is);\n// after\n// decrypt on the command line first:\n// openssl pkcs8 -topk8 -nocrypt -in encrypted.key -out plain.key\nInputStream is = cr.openInputStream(plainKeyUri);\nPrivateKey pk = KeyStoreUtils.generatePrivateKey(is);","handlingStrategy":"validation","validationCode":"// validate the stream is an unencrypted PEM private key before parsing\nString pem = readAll(is);\nif (!(pem.contains(\"-----BEGIN PRIVATE KEY-----\")\n        || pem.contains(\"-----BEGIN RSA PRIVATE KEY-----\")\n        || pem.contains(\"-----BEGIN DSA PRIVATE KEY-----\"))) {\n    throw new IllegalArgumentException(\"Not an unencrypted PEM private key (encrypted/cert/other format?)\");\n}","typeGuard":"boolean isUnencryptedPemPrivateKey(InputStream is) throws IOException {\n    String s = readAll(is);\n    return s.contains(\"-----BEGIN PRIVATE KEY-----\")\n        || s.contains(\"-----BEGIN RSA PRIVATE KEY-----\")\n        || s.contains(\"-----BEGIN DSA PRIVATE KEY-----\");\n}","tryCatchPattern":"// try\ntry {\n    PrivateKey pk = KeyStoreUtils.generatePrivateKey(keyIs);\n} catch (IOException e) {\n    if (e.getMessage().contains(\"unencrypted private key\")) {\n        // wrong or encrypted input: ask user for a decrypted PEM key file\n        showKeyFormatHelpDialog();\n    }\n}","preventionTips":["Decrypt encrypted PEM keys with `openssl pkcs8 -topk8 -nocrypt` before importing.","Select the private key file, not the certificate, when importing.","Convert PuTTY (.ppk) or OpenSSH-format keys to PEM beforehand.","Inspect the file's BEGIN/END header to confirm the expected format before calling."],"tags":["keystore","pem","private-key","format"],"backgroundTag":"invalid-argument-format","analyzedSha":"0152f468fc9463ee02dc2ca83f6fe4989a2c4ca5","analyzedAt":"2026-09-12T14:03:37.243Z","contentChangedAt":"2026-09-12T14:03:37.243Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}