I’m using java.security.KeyPairGenerator to gen an RSA key pair, and then try to load

Question

0

Asked: June 17, 20262026-06-17T11:15:49+00:00 2026-06-17T11:15:49+00:00

I’m using java.security.KeyPairGenerator to gen an RSA key pair, and then try to load

0

I’m using java.security.KeyPairGenerator to gen an RSA key pair, and then try to load the private key via the KeyPair class provided in Jsch(0.1.49). The code:

public static void main(String[] args) {
    String header = "-----BEGIN RSA PRIVATE KEY-----";
    String footer = "-----END RSA PRIVATE KEY-----";
    KeyPairGenerator keyPairGenerator;
    try {
        keyPairGenerator = KeyPairGenerator.getInstance("RSA");
        keyPairGenerator.initialize(2048, new SecureRandom());
        PrivateKey privateKey = keyPairGenerator.genKeyPair().getPrivate();
        String key = new String(Base64.encodeBase64(privateKey.getEncoded()));
        StringBuffer pem = new StringBuffer(header+"\n");
        int len=key.length();
        for( int idx=0 ; idx < len ; idx+= 64 )
            pem.append(key.substring(idx, (idx+64)<len?(idx+64):len)+"\n");
        pem.append(footer);
        String privateKeyStr = pem.toString();
        System.out.println(privateKeyStr);
        com.jcraft.jsch.KeyPair.load(null, privateKeyStr.getBytes(), null);
    } catch (JSchException e) {
        // TODO Auto-generated catch block
        e.printStackTrace();
    } catch (NoSuchAlgorithmException e1) {
        // TODO Auto-generated catch block
        e1.printStackTrace();
    }
}

The output by System.out:

Then I see exceptions from KeyPair saying it’s an invalid private key, I checked the source code of JSch, the exception is due to an indexoutofbounds while the data’s being parsed. The stacktrace:

com.jcraft.jsch.JSchException: invalid privatekey: [B@5f2e5f2e
    at com.jcraft.jsch.KeyPair.load(KeyPair.java:809)
    at com.ibm.maestro.common.utils.Test.main(Test.java:149)

I’m guessing I can fix this issue by adding/changing some parms while generating the key pair, any clue? Your help will be highly appreciated!

Report

Leave an answer
Cancel reply

You must login to add an answer.

Need An Account,

1 Answer

Editorial Team · Answer 1 · 2026-06-17T11:15:49+00:00

The Sun JCA provider will return an DER-encoded unencrypted PKCS #8 structure, rather than an RSAPrivateKey object when you call PrivateKey.getEncoded().

You can use BouncyCastle to give you the key in the format you require:

import java.io.StringWriter;
import java.security.KeyPairGenerator;
import java.security.PrivateKey;
import java.security.SecureRandom;

import org.bouncycastle.openssl.PEMWriter;

public class JSCH {

  public static void main(String[] args) throws Exception {
    KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA");
    keyPairGenerator.initialize(2048, new SecureRandom());
    PrivateKey privateKey = keyPairGenerator.genKeyPair().getPrivate();

    StringWriter writer = new StringWriter();

    try (PEMWriter pemWriter = new PEMWriter(writer)) {
      pemWriter.writeObject(privateKey);
    }

    String privateKeyStr = writer.toString();
    System.out.println(privateKeyStr);
    com.jcraft.jsch.KeyPair
        .load(null, privateKeyStr.getBytes("US-ASCII"), null);
  }
}

There may be a more elegant way to get the encoded key as a byte string. It feels ugly to write it as a string and call getBytes(), but perhaps you can look into this.

Example output:

Sign Up

Sign In

Forgot Password

The Archive Base Latest Questions

I’m using java.security.KeyPairGenerator to gen an RSA key pair, and then try to load

Leave an answerCancel reply

1 Answer

Leave an answer
Cancel reply