What causes "parsing PKCS8 format: %w" in ipfs/kubo?

Verify the file parses with `openssl pkey -in key.pem -noout`; if openssl fails, regenerate or re-export the key

parsing PKCS8 format: %w

Error message

parsing PKCS8 format: %w

What it means

The PEM block had type "PRIVATE KEY" but its DER payload could not be parsed as a PKCS8 PrivateKeyInfo (x509.ParsePKCS8PrivateKey). The bytes are malformed, truncated, or use an algorithm Go cannot decode.

Source

Thrown at core/commands/keystore.go:500

			return err
		}

		importFormat, _ := req.Options[keyFormatOptionName].(string)
		var sk crypto.PrivKey
		switch importFormat {
		case keyFormatPemCleartextOption:
			pemBlock, rest := pem.Decode(data)
			if pemBlock == nil {
				return fmt.Errorf("PEM block not found in input data:\n%s", rest)
			}

			if pemBlock.Type != "PRIVATE KEY" {
				return fmt.Errorf("expected PRIVATE KEY type in PEM block but got: %s", pemBlock.Type)
			}

			stdKey, err := parsePKCS8PrivateKey(pemBlock.Bytes)
			if err != nil {
				return fmt.Errorf("parsing PKCS8 format: %w", err)
			}

			// In case ed25519.PrivateKey is returned we need the pointer for
			// conversion to libp2p (see export command for more details).
			if ed25519KeyPointer, ok := stdKey.(ed25519.PrivateKey); ok {
				stdKey = &ed25519KeyPointer
			}

			sk, _, err = crypto.KeyPairFromStdKey(stdKey)
			if err != nil {
				return fmt.Errorf("converting std Go key to libp2p key: %w", err)
			}
		case keyFormatLibp2pCleartextOption:
			sk, err = crypto.UnmarshalPrivateKey(data)
			if err != nil {
				// check if data is PEM, if so, provide user with hint
				pemBlock, _ := pem.Decode(data)
				if pemBlock != nil {

View on GitHub (pinned to 329838acdf)

Solutions

Verify the file parses with `openssl pkey -in key.pem -noout`; if openssl fails, regenerate or re-export the key
Re-download/re-copy the file and confirm integrity (checksum); truncate/whitespace damage is the usual cause
Convert with openssl (`openssl pkcs8 -topk8 -nocrypt`) to normalize the encoding before importing
Check the wrapped key algorithm is one Go supports: RSA, ECDSA (P-224/256/384/521), or Ed25519

Example fix

// before: import a partially copied file
$ ipfs key import mykey -f pem-pkcs8-cleartext key.pem
Error: parsing PKCS8 format: asn1: structure error...
// after: validate and regenerate
$ openssl pkey -in key.pem -noout || openssl genpkey -algorithm ED25519 -out key.pem
$ ipfs key import mykey -f pem-pkcs8-cleartext key.pem

Defensive patterns

Strategy: validation

Validate before calling

if err := exec.Command("openssl", "pkey", "-in", "key.pem", "-noout").Run(); err != nil {
    return fmt.Errorf("key.pem is not a valid key; regenerate or re-export it")
}

Try / catch

err := runImport()
var parseErr *asn1.StructuralError
if errors.As(err, &parseErr) {
    // PKCS8/DER corruption: re-export or regenerate the key file
}

Prevention

Validate the PEM with `openssl pkey -in key.pem -noout` before import
Transfer key files with checksums (sha256sum) to catch truncation
Avoid editing PEM files with editors that rewrap or strip whitespace

When it happens

Trigger: `ipfs key import name -f pem-pkcs8-cleartext` on a file whose PRIVATE KEY base64 body is corrupted/cut off, or whose inner algorithm is unsupported by Go's x509 parser (e.g. some EC curves or exotic algorithms not among RSA/ECDSA/Ed25519).

Common situations: File mangled by editor/transfer (line wrapping broken, partial upload), a PEM block produced by a non-standard tool, or a key type outside Go's supported PKCS8 set.

Related errors

AI-assisted analysis of ipfs/kubo@329838acdf (2026-09-03). Data as JSON: /api/errors/1ef78eb57a11e604. Report an issue: GitHub.