Read private keys from a PEM file.

Read private keys from a bytearray in PEM format.

Read a private key from a PEM element.

Read a private key from a PEM element and add it to the accumulator list.

This API is modelled after the original pemToKey in Data.X509.Memory.

Write unencrypted private keys to a PEM file.

Write unencrypted private keys to a bytearray in PEM format.

Generate an unencrypted PEM for a private key.

Write a PKCS #8 encrypted private key to a PEM file.

If multiple keys need to be stored in the same file, use functions encryptKeyToPEM and writePEMs.

Fresh EncryptionScheme parameters should be generated for each key to encrypt.

Write a PKCS #8 encrypted private key to a bytearray in PEM format.

If multiple keys need to be stored in the same bytearray, use functions encryptKeyToPEM and pemWriteBS or pemWriteLBS.

Fresh EncryptionScheme parameters should be generated for each key to encrypt.

Generate a PKCS #8 encrypted PEM for a private key.

Fresh EncryptionScheme parameters should be generated for each key to encrypt.

Holds a private and public key together, with guaranty that they both match. Therefore no constructor is exposed. Content may be accessed through functions keyPairToPrivKey and keyPairToPubKey.

Call function keyPairFromPrivKey to build a KeyPair.

Builds a key pair from an X.509 private key.

Gets the X.509 private key in a key pair.

Gets the X.509 public key in a key pair.

Private-key serialization format.

Encryption in traditional format is not supported currently.

A key associated with format. Allows to implement ASN1Object instances.

A password stored as a sequence of UTF-8 bytes.

Some key-derivation functions add restrictions to what characters are supported.

The data type provides a special value emptyNotTerminated that is used as alternate representation of empty passwords on some systems and that produces encryption results different than an empty bytearray.

Conversion to/from a regular sequence of bytes is possible with functions toProtectionPassword and fromProtectionPassword.

Beware: the fromString implementation correctly handles multi-byte characters, so here is not equivalent to the ByteString counterpart.

A value denoting an empty password, but having a special encoding when deriving a symmetric key on some systems, like the certificate export wizard on Windows.

This value is different from toProtectionPassword "" and can be tried when decrypting content with a password known to be empty.

Extract the UTF-8 bytes in a password value.

Build a password value from a sequence of UTF-8 bytes.

When the password is empty, the special value emptyNotTerminated may be tried as well.

Data type for objects that are possibly protected with a password.

Try to recover an OptProtected content using the specified password.

Try to recover an OptProtected content in an applicative context. The applicative password is used if necessary.

import qualified Data.ByteString as B
import           Crypto.Store.PKCS8

[encryptedKey] <- readKeyFile "privkey.pem"
let askForPassword = putStr "Please enter password: " >> B.getLine
result <- recoverA (toProtectionPassword <$> askForPassword) encryptedKey
case result of
    Left err  -> putStrLn $ "Unable to recover key: " ++ show err
    Right key -> print key

Read a PEM file from disk.

Write a PEM file to disk.