How to Parse PKCS#1 and PKCS#8 PEM Private Keys in Go

Understanding PKCS#1 and PKCS#8 Formats

PKCS#1 is part of the RSA encryption standard and is used only for RSA keys. Its PEM header is BEGIN RSA PRIVATE KEY. PKCS#8 is a more generic private‑key format that works for RSA and other algorithms; its header can be BEGIN PRIVATE KEY or, if encrypted, BEGIN ENCRYPTED PRIVATE KEY.

Distinguish and Parse a PEM Private Key

When a PEM‑encoded private key is available, the first step is to determine which format it uses by examining the header line. In Go, the typical workflow is:

Read PEM data : Load the PEM text into a []byte variable.

Decode PEM block : Use encoding/pem and its pem.Decode function to obtain a *pem.Block.

Identify and parse : Check block.Type. If it equals "RSA PRIVATE KEY", call x509.ParsePKCS1PrivateKey. If it equals "PRIVATE KEY", call x509.ParsePKCS8PrivateKey. Any other value should be treated as an unknown key type.

Example Code

package main

import (
    "crypto/rsa"
    "crypto/x509"
    "encoding/pem"
    "log"
)

func main() {
    // PEM‑encoded private key text
    pemData := []byte(`-----BEGIN PRIVATE KEY-----
... (key data) ...
-----END PRIVATE KEY-----`)

    // Decode PEM data
    block, _ := pem.Decode(pemData)
    if block == nil {
        log.Fatal("invalid private key data")
    }

    var privateKey interface{}
    var err error

    // Identify and parse the key
    if block.Type == "RSA PRIVATE KEY" { // PKCS#1
        privateKey, err = x509.ParsePKCS1PrivateKey(block.Bytes)
    } else if block.Type == "PRIVATE KEY" { // PKCS#8
        privateKey, err = x509.ParsePKCS8PrivateKey(block.Bytes)
    } else {
        log.Fatal("unknown private key type")
    }

    if err != nil {
        log.Fatalf("failed to parse private key: %v", err)
    }

    // Use the private key (example for RSA)
    if rsaKey, ok := privateKey.(*rsa.PrivateKey); ok {
        // rsaKey can now be used for signing, decryption, etc.
    } else {
        log.Fatal("unsupported key type")
    }
}

The program first decodes the PEM block, checks block.Type to decide whether the key is PKCS#1 or PKCS#8, invokes the appropriate x509 parsing function, and finally asserts the concrete key type before use.