Private key problem

Question

hey folks,
i would like to store a certificate's private key in a mysql db.
my problem is that i don't know how to convert it back to a PrivateKey when i extract it from the db.
i use the function Base64.encode(userPrivKey.getEncoded()); (org.bouncycastle.util.encoders.Base64; to store the private key base64 encoded in the db.
when i extract the key from the db i can decode it with Base64.decode(). the problem is that the decode function only returns a byte array.
so does anybody know how i can convert that byte array back to a private key?
or is there any other (better) solution to store and retrieve private keys from a mysql db?
many thanks
toto

Answer 1

I've been looking to do the same thing, and your code is helpful.
If you do not want to pull in the BouncyCastle library, you can extract the RSA private key from the PKCS8 key format by parsing the DER directly. Here is some code that does it. All you need to add is the Base64 encode, and RSA begin and end flags.
import java.util.*;
import java.io.*;
public class Pkcs8ToRsa {
    // rsaEncrytion is { pkcs-1 1 }
    // pkcs-1 is { iso(1) member-body(2) usa(840) rsadsi(113549) pkcs(1) 1 }
    private static final byte[] OID_rsaEncryption = {
        (byte)0x2a, (byte)0x86, (byte)0x48, (byte)0x86,
        (byte)0xf7, (byte)0x0d, (byte)0x01, (byte)0x01,
        (byte)0x01 };
    private static final byte[] INTEGER_v1 = { (byte)0x00 };
    private static final int TAG_INTEGER      = 0x02;
    private static final int TAG_OCTET_STRING = 0x04;
    private static final int TAG_OID          = 0x06;
    private static final int TAG_SEQUENCE     = 0x30;
    private byte[] buffer;
    private int offset;
    protected Pkcs8ToRsa(byte[] pkcs8key) {
        this.buffer = pkcs8key;
        this.offset = 0;
    public static byte[] convert(byte[] pkcs8key) {
        return (new Pkcs8ToRsa(pkcs8key)).extractPrivateKey();
    private int extractTag() {
        // Assume single octet tag
        return ((int)buffer[offset++]) & 0xff;
    private void matchTag(int tag) {
        if (extractTag() != tag) {
            throw new IllegalArgumentException("Bad input");
    private int extractLength() {
        int lengthOfLength = ((int)buffer[offset++]) & 0xff;
        if ((lengthOfLength & 0x80) == 0) {
            // Single octet
            return lengthOfLength;
        } else {
            // Multiple-octet
            lengthOfLength = lengthOfLength & 0x7f;
            int length = 0;
            for (int i = 0; i < lengthOfLength; i++) {
                length = (length << 8) | (((int)buffer[offset++]) & 0xff);
            return length;
    private void matchLength(int length) {
        if (extractLength() != length) {
            throw new IllegalArgumentException("Bad input");
    private byte[] extractValue(int length) {
        byte[] value = new byte[length];
        System.arraycopy(buffer, offset, value, 0, length);
        offset += length;
        return value;
    private void matchValue(byte[] value) {
        for (int i = 0; i < value.length; i++) {
            if (buffer[offset+i] != value) {
throw new IllegalArgumentException("Bad input");
offset += value.length;
public byte[] extractPrivateKey() {
// Encoding should be
// SEQUENCE {
// version INTEGER,
// privateKeyAlgorithm SEQUENCE {
// id OBJECT IDENTIFIER,
// Type OPTIONAL
// privateKey OCTET STRING
// attributes [0] Attributes OPTIONAL
// We are after the contents of privateKey
// Outer sequence
matchTag(TAG_SEQUENCE);
int totalLength = extractLength();
if ((offset + totalLength) > buffer.length) {
throw new IllegalArgumentException("Bad input");
// Check version == v1
matchTag(TAG_INTEGER);
matchLength(INTEGER_v1.length);
matchValue(INTEGER_v1);
// Check algorithm
matchTag(TAG_SEQUENCE);
int algorithmLength = extractLength();
int keyOffset = offset + algorithmLength;
matchTag(TAG_OID);
matchLength(OID_rsaEncryption.length);
matchValue(OID_rsaEncryption);
// Skip to privateKey
offset = keyOffset;
// Get it.
matchTag(TAG_OCTET_STRING);
int keyLength = extractLength();
if ((offset + keyLength) > buffer.length) {
throw new IllegalArgumentException("Bad input");
return extractValue(keyLength);