// ConvertToECPrivateKeyPEM takes an unencrypted PKCS#8 PEM and converts it to
// EC Private Key
191569
func ConvertToECPrivateKeyPEM(inPEM []byte) ([]byte, error) {
	block, _ := pem.Decode(inPEM)
	if block == nil {
		return nil, errors.New("invalid pem bytes")
	}

	var pkey privateKeyInfo
	if _, err := asn1.Unmarshal(block.Bytes, &pkey); err != nil {
		return nil, errors.New("invalid pkcs8 key")
	}

	var ecPrivKey ecPrivateKey
	if _, err := asn1.Unmarshal(pkey.PrivateKey, &ecPrivKey); err != nil {
		return nil, errors.New("invalid private key")
	}

	ecPrivKey.NamedCurveOID = pkey.PrivateKeyAlgorithm[1]
	key, err := asn1.Marshal(ecPrivKey)
	if err != nil {
		return nil, err
	}

	return pem.EncodeToMemory(&pem.Block{
		Type:  "EC PRIVATE KEY",
		Bytes: key,
	}), nil
}
1176022
func ParseSigningKeyStorePEM(keyPEM, certPEM string) (*SigningKeyStore, error) {
	_, err := ParseCertificatePEM([]byte(certPEM))
	if err != nil {
		return nil, trace.Wrap(err)
	}
	key, err := ParsePrivateKeyPEM([]byte(keyPEM))
	if err != nil {
		return nil, trace.Wrap(err)
	}
	rsaKey, ok := key.(*rsa.PrivateKey)
	if !ok {
		return nil, trace.BadParameter("key of type %T is not supported, only RSA keys are supported for signatures", key)
	}
	certASN, _ := pem.Decode([]byte(certPEM))
	if certASN == nil {
		return nil, trace.BadParameter("expected PEM-encoded block")
	}
	return &SigningKeyStore{privateKey: rsaKey, cert: certASN.Bytes}, nil
}
415880
func (s Store) ECPrivateKey() (*ecdsa.PrivateKey, bool) {
	v, ok := s[ECPrivateKey]
	if !ok {
		return nil, false
	}
	z, ok := v.(*ecdsa.PrivateKey)
	return z, ok
}
616481
func GenerateRSAPrivateKeyPEM() ([]byte, error) {
	priv, err := rsa.GenerateKey(rand.Reader, teleport.RSAKeySize)
	if err != nil {
		return nil, trace.Wrap(err)
	}
	return pem.EncodeToMemory(&pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(priv)}), nil
}
1257249
func ParseRawPrivateKey(pemBytes []byte) (interface{}, error) {
	block, _ := pem.Decode(pemBytes)
	if block == nil {
		return nil, errors.New("ssh: no key found")
	}

	switch block.Type {
	case "RSA PRIVATE KEY":
		return x509.ParsePKCS1PrivateKey(block.Bytes)
	case "EC PRIVATE KEY":
		return x509.ParseECPrivateKey(block.Bytes)
	case "DSA PRIVATE KEY":
		return ParseDSAPrivateKey(block.Bytes)
	default:
		return nil, fmt.Errorf("ssh: unsupported key type %q", block.Type)
	}
}
239330
func AEStoPEM(raw []byte) []byte {
	return pem.EncodeToMemory(&pem.Block{Type: "AES PRIVATE KEY", Bytes: raw})
}
820463
func PublicPEM(key *ecdsa.PrivateKey) ([]byte, error) {
	pubBytes, err := x509.MarshalPKIXPublicKey(key.Public())
	if err != nil {
		return nil, err
	}
	pubPEM := pem.EncodeToMemory(&pem.Block{
		Type:  "PUBLIC KEY",
		Bytes: pubBytes,
	})
	return pubPEM, nil
}
857354
func getPrivateKey(keyBytes []byte, passphrase string) ([]byte, error) {
	// this section makes some small changes to code from notary/tuf/utils/x509.go
	pemBlock, _ := pem.Decode(keyBytes)
	if pemBlock == nil {
		return nil, fmt.Errorf("no valid private key found")
	}

	var err error
	if x509.IsEncryptedPEMBlock(pemBlock) {
		keyBytes, err = x509.DecryptPEMBlock(pemBlock, []byte(passphrase))
		if err != nil {
			return nil, errors.Wrap(err, "private key is encrypted, but could not decrypt it")
		}
		keyBytes = pem.EncodeToMemory(&pem.Block{Type: pemBlock.Type, Bytes: keyBytes})
	}

	return keyBytes, nil
}
1225323
func ConvertPrivateKeyToPKCS8(key data.PrivateKey, role data.RoleName, gun data.GUN, passphrase string) ([]byte, error) {
	var (
		err       error
		der       []byte
		blockType = "PRIVATE KEY"
	)

	if passphrase == "" {
		der, err = ConvertTUFKeyToPKCS8(key, nil)
	} else {
		blockType = "ENCRYPTED PRIVATE KEY"
		der, err = ConvertTUFKeyToPKCS8(key, []byte(passphrase))
	}
	if err != nil {
		return nil, fmt.Errorf("unable to convert to PKCS8 key")
	}

	headers := make(map[string]string)
	if role != "" {
		headers["role"] = role.String()
	}

	if gun != "" {
		headers["gun"] = gun.String()
	}

	return pem.EncodeToMemory(&pem.Block{Bytes: der, Type: blockType, Headers: headers}), nil
}
312820
func LoadEncryptedPEMPrivKey(reader io.Reader, password []byte) (*rsa.PrivateKey, error) {
	block, err := loadPem(reader)
	if err != nil {
		return nil, err
	}

	decryptedBlock, err := x509.DecryptPEMBlock(block, password)
	if err != nil {
		return nil, err
	}

	return x509.ParsePKCS1PrivateKey(decryptedBlock)
}
474086
func NewECPrivateKey(b []byte) *ECPrivateKey {
	ensureKeyLength(b)
	k := &ECPrivateKey{}
	copy(k.key[:], b)
	return k
}
911671
func PrivKeyFromBytes(curve elliptic.Curve, pk []byte) (*PrivateKey,
	*PublicKey) {
	x, y := curve.ScalarBaseMult(pk)

	priv := &ecdsa.PrivateKey{
		PublicKey: ecdsa.PublicKey{
			Curve: curve,
			X:     x,
			Y:     y,
		},
		D: new(big.Int).SetBytes(pk),
	}

	return (*PrivateKey)(priv), (*PublicKey)(&priv.PublicKey)
}
1188626
func LoadCommonRSAKeyPairPEM(headers map[string]string) (public []byte, private []byte, err error) {
	keyfile := filepath.Join(config.GetOptions().EtcPath, CommonKeyFilename)
	publicKey, privateKey, err := LoadKeyPairFromFile(keyfile)
	if err != nil {
		return nil, nil, err
	}
	if private, err = PEMFromRSAPrivateKey(privateKey, headers); err != nil {
		log.Errorf("Error loading private key: %+v\n", err)
		return nil, nil, err
	}
	if public, err = PEMFromRSAPublicKey(publicKey, headers); err != nil {
		log.Errorf("Error loading public key: %+v\n", err)
		return nil, nil, err
	}
	return public, private, nil
}
1007277
func PEMFromRSAPrivateKey(key crypto.PrivateKey, headers map[string]string) ([]byte, error) {
	pkey, err := verifyRSAPrivateKey(key)
	if err != nil {
		return nil, err
	}
	marshalled := x509.MarshalPKCS1PrivateKey(pkey)
	block := pem.Block{
		Type:    "RSA PRIVATE KEY",
		Headers: headers,
		Bytes:   marshalled,
	}
	bytes := pem.EncodeToMemory(&block)
	return bytes, nil
}
816412
func (k *Key) ExportEncryptedPrivate(password []byte) ([]byte, error) {
	var privBytes []byte
	switch priv := k.Private.(type) {
	case *rsa.PrivateKey:
		privBytes = x509.MarshalPKCS1PrivateKey(priv)
	default:
		return nil, errors.New("only RSA private key is supported")
	}

	privPEMBlock, err := x509.EncryptPEMBlock(rand.Reader, rsaPrivateKeyPEMBlockType, privBytes, password, x509.PEMCipher3DES)
	if err != nil {
		return nil, err
	}

	buf := new(bytes.Buffer)
	if err := pem.Encode(buf, privPEMBlock); err != nil {
		return nil, err
	}
	return buf.Bytes(), nil
}
44702
func loadPrivateKey(bs []byte) (*ecdsa.PrivateKey, error) {
	block, _ := pem.Decode(bs)
	return x509.ParseECPrivateKey(block.Bytes)
}
163577
func (k *Key) ExportPrivate() ([]byte, error) {
	var privPEMBlock *pem.Block
	switch priv := k.Private.(type) {
	case *rsa.PrivateKey:
		privBytes := x509.MarshalPKCS1PrivateKey(priv)
		privPEMBlock = &pem.Block{
			Type:  rsaPrivateKeyPEMBlockType,
			Bytes: privBytes,
		}
	default:
		return nil, errors.New("only RSA private key is supported")
	}

	buf := new(bytes.Buffer)
	if err := pem.Encode(buf, privPEMBlock); err != nil {
		return nil, err
	}
	return buf.Bytes(), nil
}