Skip to content

Label PKCS#8 Ed25519 keys as PRIVATE KEY - #415

Open
SashaMIT wants to merge 1 commit into
caddyserver:masterfrom
SashaMIT:fix/ed25519-pem-label
Open

SashaMIT wants to merge 1 commit into
caddyserver:masterfrom
SashaMIT:fix/ed25519-pem-label

Conversation

@SashaMIT

@SashaMIT SashaMIT commented Oct 11, 2026 •

Copy link
Copy Markdown

PEMEncodePrivateKey marshals an Ed25519 key with MarshalPKCS8PrivateKey and labels the block ED25519 PRIVATE KEY. PKCS#8 uses the PRIVATE KEY label. On this machine, LibreSSL pkey rejects the old label with "Expecting: ANY PRIVATE KEY" and reads the new label far enough to report the key type as Ed25519. This LibreSSL build has no Ed25519, so it does not print the key. The key bytes are unchanged.

PEMDecodePrivateKey already accepts both labels. An existing ED25519 PRIVATE KEY file still loads.

Fixes #391.

OpenSSL looks for that label on these bytes.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Interoperability issue: PEM encoding for Ed25519 private keys

1 participant