X509 v0.5.1 X509.PrivateKey View Source

Functions for generating, reading and writing RSA and EC private keys.

Example use with :public_key

Encryption and decryption:

iex> private_key = X509.PrivateKey.new_rsa(2048)
iex> public_key = X509.PublicKey.derive(private_key)
iex> plaintext = "Hello, world!"
iex> ciphertext = :public_key.encrypt_public(plaintext, public_key)
iex> :public_key.decrypt_private(ciphertext, private_key)
"Hello, world!"

Signing and signature verification:

iex> private_key = X509.PrivateKey.new_ec(:secp256r1)
iex> public_key = X509.PublicKey.derive(private_key)
iex> message = "Hello, world!"
iex> signature = :public_key.sign(message, :sha256, private_key)
iex> :public_key.verify(message, :sha256, signature, public_key)
true

Link to this section Summary

Types

t()

RSA or EC private key

Functions

Attempts to parse a private key in DER (binary) format. Raises in case of failure

Attempts to parse a private key in DER (binary) format

Attempts to parse a private key in PEM format. Raises in case of failure

Attempts to parse a private key in PEM format

Generates a new private EC private key. To derive the public key, use X509.PublicKey.derive/1

Generates a new private RSA private key. To derive the public key, use X509.PublicKey.derive/1

Converts a private key to DER (binary) format

Converts a private key to PEM format

Extracts a private key from a PKCS#8 PrivateKeyInfo container

Wraps a private key in a PKCS#8 PrivateKeyInfo container

Link to this section Types

Link to this section Functions

Link to this function from_der!(der) View Source (since 0.3.0)
from_der!(binary()) :: t() | no_return()

Attempts to parse a private key in DER (binary) format. Raises in case of failure.

Unwraps the PKCS#8 PrivateKeyInfo container, if present.

Link to this function from_der(der) View Source
from_der(binary()) :: {:ok, t()} | {:error, :malformed}

Attempts to parse a private key in DER (binary) format.

Unwraps the PKCS#8 PrivateKeyInfo container, if present.

Returns an :ok tuple in case of success, or an :error tuple in case of failure. Possible error reasons are:

  • :malformed - the data could not be decoded as a private key
Link to this function from_pem!(pem, opts \\ []) View Source (since 0.3.0)
from_pem!(String.t(), Keyword.t()) :: t() | no_return()

Attempts to parse a private key in PEM format. Raises in case of failure.

Processes the first PEM entry of type PRIVATE KEY, RSA PRIVATE KEY or EC PRIVATE KEY found in the input. Unwraps the PKCS#8 PrivateKeyInfo container, if present.

Options:

  • :password - the password used to decrypt an encrypted private key; may be specified as a string or a charlist
Link to this function from_pem(pem, opts \\ []) View Source
from_pem(String.t(), Keyword.t()) ::
  {:ok, t()} | {:error, :malformed | :not_found}

Attempts to parse a private key in PEM format.

Processes the first PEM entry of type PRIVATE KEY, RSA PRIVATE KEY or EC PRIVATE KEY found in the input. Unwraps the PKCS#8 PrivateKeyInfo container, if present. Returns an :ok tuple in case of success, or an :error tuple in case of failure. Possible error reasons are:

  • :not_found - no PEM entry of a supported PRIVATE KEY type was found
  • :malformed - the entry could not be decoded as a private key

Options:

  • :password - the password used to decrypt an encrypted private key; may be specified as a string or a charlist

Generates a new private EC private key. To derive the public key, use X509.PublicKey.derive/1.

The second parameter must specify a named curve. The curve can be specified as an atom or an OID tuple.

Note that this function uses Erlang/OTP’s :public_key application, which does not support all curve names returned by the :crypto.ec_curves/0 function. In particular, the NIST Prime curves must be selected by their SECG id, e.g. NIST P-256 is :secp256r1 rather than :prime256v1. Please refer to RFC4492 appendix A for a mapping table.

Generates a new private RSA private key. To derive the public key, use X509.PublicKey.derive/1.

The key length in bits must be specified as an integer (minimum 256 bits). The default exponent of 65537 can be overridden using the :exponent option. Warning: the custom exponent value is not checked for safety!

Link to this function to_der(private_key, opts \\ []) View Source
to_der(t(), Keyword.t()) :: binary()

Converts a private key to DER (binary) format.

Options:

  • :wrap - Wrap the private key in a PKCS#8 PrivateKeyInfo container (default: false)
Link to this function to_pem(private_key, opts \\ []) View Source
to_pem(t(), Keyword.t()) :: String.t()

Converts a private key to PEM format.

Options:

  • :wrap - Wrap the private key in a PKCS#8 PrivateKeyInfo container (default: false)

Extracts a private key from a PKCS#8 PrivateKeyInfo container.

Link to this function wrap(private_key) View Source
wrap(t()) :: X509.ASN.record(:private_key_info)
wrap(X509.ASN.record(:private_key_info)) :: t()

Wraps a private key in a PKCS#8 PrivateKeyInfo container.