"pkcs8" must be PCKS8 formatted string

[danbulant]

I genereated a key using generateKeyPair("ES256"), and exported the private key via exportPKCS8(privateKey).

When I try to later import that using importPKCS8(exported, "ES256"), I'm getting error "pkcs8" must be PCKS8 formatted string.

Example key:

-----BEGIN PRIVATE KEY-----
MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgm99n34W8K9Nh+3/M
tAV6gmSSNBMapHdcNvnU4gQwp2ehRANCAAS7dr8pgVpycIyReDi1ECWrz4YqZrBZ
nrxllViRq+/1WkszYY+AjPEXHZleFx7azBijrmZlTpBCo0c0RNQ/O/Pl
-----END PRIVATE KEY-----

[danbulant]

Only once I post this do I realize the issue

(when loading I passed raw buffer instead of text)

[incredibleopinions]

I have the same issue. Mine is returning as text instead of buffer but I am still getting the same error of "pkcs8" must be PCKS8 formatted string.

[panva]

@incredibleopinions possibly because it's not a PKCS#8 key? Is the first line exactly this?

-----BEGIN PRIVATE KEY-----

[incredibleopinions]

It is not. It has bag attributes, and then includes the private key and certificate. The key section starts with "-----BEGIN RSA PRIVATE KEY-----"

[panva]

Then it's not a PKCS#8 private key and it rightfully fails to import as PKCS#8.

[panva]

To elaborate, this library needs to support imports into native key like objects in either the Web API or Node.js runtimes.

For Web API this is the CryptoKey global, for Node.js this is the crypto.KeyObject abstraction and while node's crypto can cope with a number of formats, bag attributes, etc, the Web Crypto API doesn't, that is why only what can be done with both runtimes is allowed by the library.

If your runtime happens to be Node.js, you can easily import your PKCS#1 private key using the crypto.createPrivateKey API and use that as key input to this library.

The key import functions in this library are there mostly because referring developers to the platform's native import API functions was not met with a lot of understanding.

more:

• https://github.com/panva/jose/blob/v4.x/docs/types/types.KeyLike.md#type-alias-keylike
• Algorithm Key Requirements #210