How to make a key pair of ecdsa in a format that can be read by Java

Introduction

In some cases, such as JWT, you want to sign / verify using the public / private key on the server. I think that the JWT library side provides a method to create a key pair, but if you use it, a key pair will be generated every time you start the application. If you can't disable the last issued JWT each time you boot, you'll be using a fixed key pair.

These days, ECDSA seems to be used more often than RSA because it is smaller in size and has the same level of cryptographic strength.

Creating a key

Create in pem format.

openssl ecparam -genkey -name secp256k1 -out key-pair.pem
openssl pkcs8 -topk8 -inform pem -in key-pair.pem -outform pem -nocrypt -out private.pem
openssl ec -in key-pair.pem -pubout -outform pem -out public.pem

private key

private key is

• ----- BEGIN PRIVATE KEY -----, ----- END PRIVATE KEY ----- and trim the line feed code
• Base64 decode
• Generate PKCS8EncodedKeySpec
• Generated by specifying the algorithm with KeyFactory

import java.nio.file.Files;
import java.security.KeyFactory;
import java.security.PrivateKey;
import java.security.PublicKey;
import java.security.spec.PKCS8EncodedKeySpec;
import java.security.spec.X509EncodedKeySpec;
import java.util.Base64;

String privatePem = new String(Files.readAllBytes(path))
                    .replaceAll("\\r\\n", "")
                    .replaceAll("\\n", "")
                    .replaceAll("-----BEGIN PRIVATE KEY-----", "")
                    .replaceAll("-----END PRIVATE KEY-----", "");
PKCS8EncodedKeySpec keySpec = new PKCS8EncodedKeySpec(Base64.getDecoder().decode(privatePem));
PrivateKey privateKey = KeyFactory.getInstance("EC").generatePrivate(keySpec);

public key

• ----- BEGIN PUBLIC KEY -----, ----- END PUBLIC KEY ----- and trim the line feed code
• Base64 decode
• Generate X509EncodedKeySpec
• Generated by specifying the algorithm with KeyFactory

String publicPem = new String(Files.readAllBytes(jwtSettings.getPublicKeyAsPath()))
                    .replaceAll("\\r\\n", "")
                    .replaceAll("\\n", "")
                    .replaceAll("-----BEGIN PUBLIC KEY-----", "")
                    .replaceAll("-----END PUBLIC KEY-----", "");
X509EncodedKeySpec keySpec = new X509EncodedKeySpec(Base64.getDecoder().decode(publicPem));
PublicKey publicKey =  KeyFactory.getInstance(jwtSettings.getAlgorithm()).generatePublic(keySpec);

Reference link

• https://stackoverflow.com/questions/11410770/load-rsa-public-key-from-file
• https://metamug.com/article/security/sign-verify-digital-signature-ecdsa-java.html
• https://howtodoinjava.com/java/io/java-read-file-to-string-examples/
• https://howtodoinjava.com/java11/files-readstring-read-file-to-string/
• http://blog.livedoor.jp/k_urushima/archives/1721840.html
• https://qiita.com/wnoguchi/items/a72a042bb8159c35d056
• https://jwt.io/
• https://qiita.com/TakahikoKawasaki/items/4c35ac38c52978805c69