JSch getting “invalid privatekey:” while trying to load an RSA private key by KeyPairGenerator

问题

I'm using java.security.KeyPairGenerator to gen an RSA key pair, and then try to load the private key via the KeyPair class provided in Jsch(0.1.49). The code:

public static void main(String[] args) {
    String header = "-----BEGIN RSA PRIVATE KEY-----";
    String footer = "-----END RSA PRIVATE KEY-----";
    KeyPairGenerator keyPairGenerator;
    try {
        keyPairGenerator = KeyPairGenerator.getInstance("RSA");
        keyPairGenerator.initialize(2048, new SecureRandom());
        PrivateKey privateKey = keyPairGenerator.genKeyPair().getPrivate();
        String key = new String(Base64.encodeBase64(privateKey.getEncoded()));
        StringBuffer pem = new StringBuffer(header+"\n");
        int len=key.length();
        for( int idx=0 ; idx < len ; idx+= 64 )
            pem.append(key.substring(idx, (idx+64)<len?(idx+64):len)+"\n");
        pem.append(footer);
        String privateKeyStr = pem.toString();
        System.out.println(privateKeyStr);
        com.jcraft.jsch.KeyPair.load(null, privateKeyStr.getBytes(), null);
    } catch (JSchException e) {
        // TODO Auto-generated catch block
        e.printStackTrace();
    } catch (NoSuchAlgorithmException e1) {
        // TODO Auto-generated catch block
        e1.printStackTrace();
    }
}

The output by System.out:

Then I see exceptions from KeyPair saying it's an invalid private key, I checked the source code of JSch, the exception is due to an indexoutofbounds while the data's being parsed. The stacktrace:

com.jcraft.jsch.JSchException: invalid privatekey: [B@5f2e5f2e
    at com.jcraft.jsch.KeyPair.load(KeyPair.java:809)
    at com.ibm.maestro.common.utils.Test.main(Test.java:149)

I'm guessing I can fix this issue by adding/changing some parms while generating the key pair, any clue? Your help will be highly appreciated!

回答1:

The Sun JCA provider will return an DER-encoded unencrypted PKCS #8 structure, rather than an RSAPrivateKey object when you call PrivateKey.getEncoded().

You can use BouncyCastle to give you the key in the format you require:

import java.io.StringWriter;
import java.security.KeyPairGenerator;
import java.security.PrivateKey;
import java.security.SecureRandom;

import org.bouncycastle.openssl.PEMWriter;

public class JSCH {

  public static void main(String[] args) throws Exception {
    KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA");
    keyPairGenerator.initialize(2048, new SecureRandom());
    PrivateKey privateKey = keyPairGenerator.genKeyPair().getPrivate();

    StringWriter writer = new StringWriter();

    try (PEMWriter pemWriter = new PEMWriter(writer)) {
      pemWriter.writeObject(privateKey);
    }

    String privateKeyStr = writer.toString();
    System.out.println(privateKeyStr);
    com.jcraft.jsch.KeyPair
        .load(null, privateKeyStr.getBytes("US-ASCII"), null);
  }
}

There may be a more elegant way to get the encoded key as a byte string. It feels ugly to write it as a string and call getBytes(), but perhaps you can look into this.

Example output:

回答2:

You can use PEMWriter to convert your private key to PEM format that will be accepted by JSch

The following example converts a key returned from KeyStore (JKS)

Key privateKey = KeyStore.getKey(privateKeyAlias, keyStorePassword);//get key from JKS
StringWriter stringWriter = new StringWriter();
PEMWriter pemWriter = new PEMWriter(stringWriter);
pemWriter.writeObject(privateKey);
pemWriter.close();

byte[] privateKeyPEM = stringWriter.toString().getBytes();

来源：https://stackoverflow.com/questions/14276246/jsch-getting-invalid-privatekey-while-trying-to-load-an-rsa-private-key-by-ke

标签

java

ssh

rsa

jsch