PEM:READ-FROM-FILE returns NIL on PKCS#8 keys

[phoe]

CL-USER> (pem:read-from-file #P"~/priv4096.pem")
NIL

whenever the file contains a private key in form:

-----BEGIN PRIVATE KEY-----
MIIJQwIBADANBgk... (base64 encoded data)
-----END PRIVATE KEY-----

[Junker]

Yes, this function works only for PKCS#1 files. You need to convert PKCS#8 to PKCS#1 with openssl:
openssl pkey -in pkcs8.pem -traditional > pkcs1.key

[Junker]

can extract private key from PKCS#8, example:

(let* ((pem-file #P"/var/tmp/KEY/rsa_private_pkcs8.pem")
       (pkcs8-der (asn1:decode (base64:base64-string-to-usb8-array
                                (cdar (pem:parse-file pem-file)))))
       (pkcs1-der (asn1:decode (cdr (fourth (car pkcs8-der))))))
  (trivia:match pkcs1-der
    ((asn1:rsa-private-key :private-exponent d :modulus n)
     (ironclad:make-private-key :rsa :d d :n n))))

[cdmojoli]

Another, longer way, that matches the values expected in the PEM and PKCS #8 structures for RSA keys, and includes comments referencing the relevant specifications:

(use-package :trivia)

(match
    (pem:parse-file pem-file)
  ((assoc
    "PRIVATE KEY" ; RFC 7468 §4, §10: PKCS#8 Label
    (access
     #'base64:base64-string-to-usb8-array
     (access
      #'asn1:decode
      (cons
       (list*
        :sequence
        (list (cons :integer 0) ; RFC5208: Version, must be 0
              (cons
               :sequence
               (assoc
                :object-identifier
                #(1 2 840 113549 1 1 1))) ; RFC5208: PrivKeyAlgId = RSA encryption OID
              (cons
               :octet-string     ; RFC5208: Private key
               (access
                #'asn1:decode
                (asn1/format/rsa::rsa-private-key
                 :private-exponent d
                 :modulus n)))))
       _)))
    :test #'string=)
   (ironclad:make-private-key :rsa :d d :n n)))