eclipse-vertx/vert.x · error · VertxException

Invalid PKCS8 encoding: could not read Algorithm Identifier

Error message

Invalid PKCS8 encoding: could not read Algorithm Identifier

What it means

After the version field, PKCS#8 PrivateKeyInfo must contain an AlgorithmIdentifier SEQUENCE. getPKCS8EncodedKeyAlgorithm throws VertxException('Invalid PKCS8 encoding: could not read Algorithm Identifier') when the second parsed object is not a SEQUENCE, so the key encoding is malformed or truncated.

Source

Thrown at vertx-core/src/main/java/io/vertx/core/net/impl/pkcs1/PrivateKeyParser.java:106

   *         algorithm.
   */
  public static String getPKCS8EncodedKeyAlgorithm(byte[] encodedKey) {

    DerParser parser = new DerParser(encodedKey);
    Asn1Object sequence = parser.read();
    if (sequence.getType() != DerParser.SEQUENCE) {
      throw new VertxException("Invalid PKCS8 encoding: not a sequence");
    }

    parser = sequence.getParser();
    BigInteger version = parser.read().getInteger();
    if (version.intValue() != 0) {
        throw new VertxException("Unsupported version, expected 0 but found " + version.intValue());
    }

    sequence = parser.read();
    if (sequence.getType() != DerParser.SEQUENCE) {
        throw new VertxException("Invalid PKCS8 encoding: could not read Algorithm Identifier");
    }

    parser = sequence.getParser();
    byte[] algorithmIdentifier = parser.read().getObjectIdentifier();
    if (Arrays.equals(OID_RSA_PUBLIC_KEY, algorithmIdentifier)) {
        return "RSA";
    } else if (Arrays.equals(OID_EC_PUBLIC_KEY, algorithmIdentifier)) {
        return "EC";
    } else {
        throw new VertxException("Unsupported algorithm identifier");
    }
  }

  /**
   * Converts a DER encoded ECPrivateKey into a Java ECPrivateKeySpec.
   * <p>
   * <a href="https://datatracker.ietf.org/doc/html/rfc5915#section-3">
   * RFC 5915</a> defines the following ASN.1 syntax for an EC private key:

View on GitHub (pinned to fb308bd8c3)

Solutions

Verify the key with openssl asn1parse -in key.pem; re-export it cleanly
Ensure the full base64 body between BEGIN/END markers is present and decoded
Reconvert: openssl pkcs8 -topk8 -nocrypt -in key.pem -out key8.pem

Example fix

// before
String body = pem.substring(pem.indexOf("KEY-----") + 8); // may truncate lines
byte[] der = Base64.getMimeDecoder().decode(body);
// after
// validate: openssl asn1parse -in key.pem
byte[] der = PemReader.read(keyFile); // intact PEM -> DER
String alg = PrivateKeyParser.getPKCS8EncodedKeyAlgorithm(der);

Defensive patterns

Strategy: validation

Validate before calling

byte[] der = Base64.getMimeDecoder().decode(fullPemBodyBetweenMarkers);
if (der.length < 16) throw new IllegalArgumentException("key file truncated");

Try / catch

try {
  alg = PrivateKeyParser.getPKCS8EncodedKeyAlgorithm(der);
} catch (VertxException e) {
  // verify with openssl asn1parse and re-export the key
}

Prevention

Copy PEM files atomically and verify sizes/checksums
Include all base64 lines between BEGIN/END markers
Validate with openssl asn1parse before loading

When it happens

Trigger: Passing truncated DER data (cut-off base64), a structure where the algorithm identifier is missing/reordered, or bytes from a foreign ASN.1 format mistakenly treated as PKCS#8.

Common situations: PEM files truncated during transfer (missing trailing base64 lines), keys hand-edited, wrong file passed (CSR or certificate fragment).

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

AI-assisted analysis of eclipse-vertx/vert.x@fb308bd8c3 (2026-09-06). Data as JSON: /api/errors/170fc359c202402a. Report an issue: GitHub.