--- product: Chilkat product_version: 11.7.0 language: c language_label: C class: PrivateKey license: free deprecated: false reference_html: https://www.chilkatsoft.com/refdoc/c_CkPrivateKeyRef.html --- # Chilkat PrivateKey — C — v11.7.0 > Chilkat 11.7.0 · language=c · class=PrivateKey > Other versions: replace `11.7.0` in this URL. Other languages: `https://www.chilkatsoft.com/ai-docs/v/11.7.0//classes/PrivateKey.md`. > Language-wide rules (install, unlock, error model, strings/bytes): `https://www.chilkatsoft.com/ai-docs/v/11.7.0/c/guide.md`. ## Purpose PrivateKey **Load, inspect, export, save, and convert one private key.** `PrivateKey` is a key-container class. It holds one current RSA, DSA, EC, or Ed25519 private key and provides format conversion, persistence, JWK/XML access, raw EC and Ed25519 access, and public-key extraction. Cryptographic operations such as signing, decryption, TLS authentication, and SSH authentication are performed by other Chilkat classes that receive the loaded `PrivateKey`. **Content-based loading** Named load methods inspect the content and recognize supported unencrypted formats. Password-taking loaders also recognize encrypted PKCS #8 and unencrypted input. **Standard export choices** Use PKCS #8 for modern algorithm-independent interchange, encrypted PKCS #8 for password-protected storage, JWK for JOSE, and traditional PEM only when required by a legacy consumer. **One-key state** A successful load replaces the current key. A failed load leaves the object empty. Check `KeyType` and `BitLength` after loading when the expected algorithm matters. **Independent public key** `ToPublicKey` creates an independent `PublicKey` that is unaffected when this object is reloaded with another key. **Key generation** Generate new keys with `Rsa`, `Ecc`, or `EdDSA`, which can place the generated key into a `PrivateKey`. **Certificates are separate** A private key does not contain a certificate or chain. Use `Cert` or `Pfx` when certificate association is required. **Recommended format selection:** Prefer unencrypted PKCS #8 for transient interchange, encrypted PKCS #8 with `aes256` and a strong password for stored key files, JWK for JWT/JWS/JWE workflows, and traditional RSA or EC PEM only when the receiving software requires it. **Protect private material:** Base64, hexadecimal, PEM, JWK, and XML are encodings or containers, not encryption. Avoid exporting a private key unless necessary, and protect every unencrypted representation as sensitive data. For an extended overview, see [PrivateKey Class Overview](https://www.chilkatsoft.com/privatekey_class_overview.asp). ## Object creation, unlocking and error handling **Create/Dispose** ```c HCkPrivateKey instance = CkPrivateKey_Create(); // ... CkPrivateKey_Dispose(instance); ``` `HCkPrivateKey CkPrivateKey_Create(void);` Creates an instance of the HCkPrivateKey object and returns a handle ("void \*" pointer). The handle is passed in the 1st argument for the functions listed on this page. `void CkPrivateKey_Dispose(HCkPrivateKey handle);` Objects created by calling CkPrivateKey_Create must be freed by calling this method. A memory leak occurs if a handle is not disposed by calling this function. Also, any handle returned by a Chilkat "C" function must also be freed by the application by calling the appropriate Dispose method, such as CkPrivateKey_Dispose. Call `Global.UnlockBundle` once at the start of the program, before using this or any other Chilkat class. Any string unlocks a fully functional 30-day trial; a purchased unlock code is used in production. See `guide.md` for the exact code in C. ## Members common to every Chilkat class Documented once per language in `common-members.md`; listed here so this page is self-contained. | Property | Signature | Access | Meaning | |---|---|---|---| | `DebugLogFilePath` | `void CkPrivateKey_getDebugLogFilePath(HCkPrivateKey cHandle, HCkString retval); void CkPrivateKey_putDebugLogFilePath(HCkPrivateKey cHandle, const char *newVal); const char *CkPrivateKey_debugLogFilePath(HCkPrivateKey cHandle);` | read/write | If set to a file path, this property logs the LastErrorText of each Chilkat method or property call to the specified file. | | `LastErrorHtml` | `void CkPrivateKey_getLastErrorHtml(HCkPrivateKey cHandle, HCkString retval); const char *CkPrivateKey_lastErrorHtml(HCkPrivateKey cHandle);` | read-only | Provides HTML-formatted information about the last called method or property. | | `LastErrorText` | `void CkPrivateKey_getLastErrorText(HCkPrivateKey cHandle, HCkString retval); const char *CkPrivateKey_lastErrorText(HCkPrivateKey cHandle);` | read-only | Provides plain text information about the last called method or property. | | `LastErrorXml` | `void CkPrivateKey_getLastErrorXml(HCkPrivateKey cHandle, HCkString retval); const char *CkPrivateKey_lastErrorXml(HCkPrivateKey cHandle);` | read-only | Provides XML-formatted information about the last called method or property. | | `LastMethodSuccess` | `BOOL CkPrivateKey_getLastMethodSuccess(HCkPrivateKey cHandle); void CkPrivateKey_putLastMethodSuccess(HCkPrivateKey cHandle, BOOL newVal);` | read/write | Indicates the success or failure of the most recent method call: `TRUE` means success, `FALSE` means failure. | | `Utf8` | `BOOL CkPrivateKey_getUtf8(HCkPrivateKey cHandle); void CkPrivateKey_putUtf8(HCkPrivateKey cHandle, BOOL newVal);` | read/write | When set to `TRUE`, all `const char *` arguments and return values are interpreted as UTF-8 strings. | | `VerboseLogging` | `BOOL CkPrivateKey_getVerboseLogging(HCkPrivateKey cHandle); void CkPrivateKey_putVerboseLogging(HCkPrivateKey cHandle, BOOL newVal);` | read/write | If set to `TRUE`, then the contents of LastErrorText (or LastErrorXml, or LastErrorHtml) may contain more verbose information. | | `Version` | `void CkPrivateKey_getVersion(HCkPrivateKey cHandle, HCkString retval); const char *CkPrivateKey_version(HCkPrivateKey cHandle);` | read-only | Version of the component/library, such as "10.1.0" | ## Member index | Member | Kind | Signature | |---|---|---| | `BitLength` | property, read-only | `int CkPrivateKey_getBitLength(HCkPrivateKey cHandle);` | | `KeyType` | property, read-only | `void CkPrivateKey_getKeyType(HCkPrivateKey cHandle, HCkString retval); const char *CkPrivateKey_keyType(HCkPrivateKey cHandle);` | | `Pkcs8EncryptAlg` | property, read/write | `void CkPrivateKey_getPkcs8EncryptAlg(HCkPrivateKey cHandle, HCkString retval); void CkPrivateKey_putPkcs8EncryptAlg(HCkPrivateKey cHandle, const char *newVal); const char *CkPrivateKey_pkcs8EncryptAlg(HCkPrivateKey cHandle);` | | `UncommonOptions` | property, read/write | `void CkPrivateKey_getUncommonOptions(HCkPrivateKey cHandle, HCkString retval); void CkPrivateKey_putUncommonOptions(HCkPrivateKey cHandle, const char *newVal); const char *CkPrivateKey_uncommonOptions(HCkPrivateKey cHandle);` | | `GetJwk` | method | `BOOL CkPrivateKey_GetJwk(HCkPrivateKey cHandle, HCkString outStr); const char *CkPrivateKey_getJwk(HCkPrivateKey cHandle);` | | `GetJwkThumbprint` | method | `BOOL CkPrivateKey_GetJwkThumbprint(HCkPrivateKey cHandle, const char *hashAlg, HCkString outStr); const char *CkPrivateKey_getJwkThumbprint(HCkPrivateKey cHandle, const char *hashAlg);` | | `GetPkcs1ENC` | method | `BOOL CkPrivateKey_GetPkcs1ENC(HCkPrivateKey cHandle, const char *encoding, HCkString outStr); const char *CkPrivateKey_getPkcs1ENC(HCkPrivateKey cHandle, const char *encoding);` | | `GetPkcs1Pem` | method | `BOOL CkPrivateKey_GetPkcs1Pem(HCkPrivateKey cHandle, HCkString outStr); const char *CkPrivateKey_getPkcs1Pem(HCkPrivateKey cHandle);` | | `GetPkcs8ENC` | method | `BOOL CkPrivateKey_GetPkcs8ENC(HCkPrivateKey cHandle, const char *encoding, HCkString outStr); const char *CkPrivateKey_getPkcs8ENC(HCkPrivateKey cHandle, const char *encoding);` | | `GetPkcs8EncryptedENC` | method | `BOOL CkPrivateKey_GetPkcs8EncryptedENC(HCkPrivateKey cHandle, const char *encoding, const char *password, HCkString outStr); const char *CkPrivateKey_getPkcs8EncryptedENC(HCkPrivateKey cHandle, const char *encoding, const char *password);` | | `GetPkcs8EncryptedPem` | method | `BOOL CkPrivateKey_GetPkcs8EncryptedPem(HCkPrivateKey cHandle, const char *password, HCkString outStr); const char *CkPrivateKey_getPkcs8EncryptedPem(HCkPrivateKey cHandle, const char *password);` | | `GetPkcs8Pem` | method | `BOOL CkPrivateKey_GetPkcs8Pem(HCkPrivateKey cHandle, HCkString outStr); const char *CkPrivateKey_getPkcs8Pem(HCkPrivateKey cHandle);` | | `GetPkcsBd` | method | `BOOL CkPrivateKey_GetPkcsBd(HCkPrivateKey cHandle, BOOL pkcs1, const char *password, HCkBinData bd);` | | `GetRawHex` | method | `BOOL CkPrivateKey_GetRawHex(HCkPrivateKey cHandle, HCkStringBuilder pubKey, HCkString outStr); const char *CkPrivateKey_getRawHex(HCkPrivateKey cHandle, HCkStringBuilder pubKey);` | | `GetXml` | method | `BOOL CkPrivateKey_GetXml(HCkPrivateKey cHandle, HCkString outStr); const char *CkPrivateKey_getXml(HCkPrivateKey cHandle);` | | `LoadAnyFormat` | method | `BOOL CkPrivateKey_LoadAnyFormat(HCkPrivateKey cHandle, HCkBinData privKeyData, const char *password);` | | `LoadAnyFormatFile` | method | `BOOL CkPrivateKey_LoadAnyFormatFile(HCkPrivateKey cHandle, const char *path, const char *password);` | | `LoadEd25519` | method | `BOOL CkPrivateKey_LoadEd25519(HCkPrivateKey cHandle, const char *privKey, const char *pubKey);` | | `LoadEncryptedPem` | method | `BOOL CkPrivateKey_LoadEncryptedPem(HCkPrivateKey cHandle, const char *pemStr, const char *password);` | | `LoadEncryptedPemFile` | method | `BOOL CkPrivateKey_LoadEncryptedPemFile(HCkPrivateKey cHandle, const char *path, const char *password);` | | `LoadJwk` | method | `BOOL CkPrivateKey_LoadJwk(HCkPrivateKey cHandle, const char *jsonStr);` | | `LoadPem` | method | `BOOL CkPrivateKey_LoadPem(HCkPrivateKey cHandle, const char *str);` | | `LoadPemFile` | method | `BOOL CkPrivateKey_LoadPemFile(HCkPrivateKey cHandle, const char *path);` | | `LoadPkcs1File` | method | `BOOL CkPrivateKey_LoadPkcs1File(HCkPrivateKey cHandle, const char *path);` | | `LoadPkcs8EncryptedFile` | method | `BOOL CkPrivateKey_LoadPkcs8EncryptedFile(HCkPrivateKey cHandle, const char *path, const char *password);` | | `LoadPkcs8File` | method | `BOOL CkPrivateKey_LoadPkcs8File(HCkPrivateKey cHandle, const char *path);` | | `LoadPvkFile` | method | `BOOL CkPrivateKey_LoadPvkFile(HCkPrivateKey cHandle, const char *path, const char *password);` | | `LoadXml` | method | `BOOL CkPrivateKey_LoadXml(HCkPrivateKey cHandle, const char *xml);` | | `LoadXmlFile` | method | `BOOL CkPrivateKey_LoadXmlFile(HCkPrivateKey cHandle, const char *path);` | | `SavePemFile` | method | `BOOL CkPrivateKey_SavePemFile(HCkPrivateKey cHandle, const char *path);` | | `SavePkcs1File` | method | `BOOL CkPrivateKey_SavePkcs1File(HCkPrivateKey cHandle, const char *path);` | | `SavePkcs8EncryptedFile` | method | `BOOL CkPrivateKey_SavePkcs8EncryptedFile(HCkPrivateKey cHandle, const char *password, const char *path);` | | `SavePkcs8EncryptedPemFile` | method | `BOOL CkPrivateKey_SavePkcs8EncryptedPemFile(HCkPrivateKey cHandle, const char *password, const char *path);` | | `SavePkcs8File` | method | `BOOL CkPrivateKey_SavePkcs8File(HCkPrivateKey cHandle, const char *path);` | | `SavePkcs8PemFile` | method | `BOOL CkPrivateKey_SavePkcs8PemFile(HCkPrivateKey cHandle, const char *path);` | | `SaveXmlFile` | method | `BOOL CkPrivateKey_SaveXmlFile(HCkPrivateKey cHandle, const char *path);` | | `ToPublicKey` | method | `BOOL CkPrivateKey_ToPublicKey(HCkPrivateKey cHandle, HCkPublicKey pubKey);` | | `UploadToCloud` | method | `BOOL CkPrivateKey_UploadToCloud(HCkPrivateKey cHandle, HCkJsonObject jsonIn, HCkJsonObject jsonOut);` | Deprecated members are listed at the end of this file with their replacements; do not use them in new code. ## Properties ### PrivateKey.BitLength `Chilkat 11.7.0 · c · PrivateKey · BitLength · property · read-only · since 9.5.0.49` ```c int CkPrivateKey_getBitLength(HCkPrivateKey cHandle); ``` Returns the nominal size of the loaded private key, in bits. The value is `0` when the object is empty. For RSA it is the modulus size; for DSA it is the size of `p`; for EC it is the named-curve field size; and for Ed25519 it is `256`. **Comparing strength:** Bit lengths are meaningful only within the context of the algorithm. A 256-bit EC key and a 256-bit RSA key do not provide comparable security. ### PrivateKey.KeyType `Chilkat 11.7.0 · c · PrivateKey · KeyType · property · read-only · since 9.5.0.52` ```c void CkPrivateKey_getKeyType(HCkPrivateKey cHandle, HCkString retval); const char *CkPrivateKey_keyType(HCkPrivateKey cHandle); ``` Identifies the algorithm of the currently loaded key. The value is one of `empty`, `rsa`, `dsa`, `ecc`, or `ed25519`. `empty` means that no usable private key is loaded. **One-key state model:** A `PrivateKey` object holds one current key. Loading another key replaces it; a failed load leaves the object empty. ### PrivateKey.Pkcs8EncryptAlg `Chilkat 11.7.0 · c · PrivateKey · Pkcs8EncryptAlg · property · read/write · since 9.5.0.49` ```c void CkPrivateKey_getPkcs8EncryptAlg(HCkPrivateKey cHandle, HCkString retval); void CkPrivateKey_putPkcs8EncryptAlg(HCkPrivateKey cHandle, const char *newVal); const char *CkPrivateKey_pkcs8EncryptAlg(HCkPrivateKey cHandle); ``` Controls the block cipher used by encrypted PKCS #8 export methods. Supported values are `3des`, `aes128`, `aes192`, and `aes256`. Values are case-insensitive and are normalized to lowercase. The default is `3des`. Assigning an empty or unrecognized value resets the property to `3des`. All choices use CBC mode. Encrypted PKCS #8 output uses PBES2 with PBKDF2. The generated parameters use an 8-byte salt, 2048 PBKDF2 iterations, and the default PBKDF2 PRF (HMAC-SHA-1). The selected cipher uses CBC mode with a newly generated IV. **Recommended setting:** Prefer `aes256` for new output unless an older consumer requires 3DES. This property selects encryption parameters only; password quality remains essential. ### PrivateKey.UncommonOptions `Chilkat 11.7.0 · c · PrivateKey · UncommonOptions · property · read/write · since 9.5.0.96` ```c void CkPrivateKey_getUncommonOptions(HCkPrivateKey cHandle, HCkString retval); void CkPrivateKey_putUncommonOptions(HCkPrivateKey cHandle, const char *newVal); const char *CkPrivateKey_uncommonOptions(HCkPrivateKey cHandle); ``` Provides a catch-all string for specialized compatibility options that are not exposed as ordinary properties. The default is the empty string, which is appropriate for normal use. **Leave empty unless instructed:** Set this property only when a Chilkat example, release note, or support response documents a specific option needed for an unusual interoperability case. ## Methods ### PrivateKey.GetJwk `Chilkat 11.7.0 · c · PrivateKey · GetJwk · method · since 9.5.0.66` ```c BOOL CkPrivateKey_GetJwk(HCkPrivateKey cHandle, HCkString outStr); const char *CkPrivateKey_getJwk(HCkPrivateKey cHandle); ``` Exports the key as a compact JWK (JSON Web Key). Binary integers and byte strings use Base64url without padding. | Key type | Members emitted | | :--- | :--- | | RSA | `kty`, `n`, `e`, `d`, `p`, `q`, `dp`, `dq`, `qi` | | EC | `kty`, `crv`, `x`, `y`, `d` | | Ed25519 | `kty`=`OKP`, `crv`=`Ed25519`, `x`, `d`, and `use`=`sig` | **Key material only:** Optional JOSE metadata loaded from a JWK, such as `kid`, `alg`, `key_ops`, or a caller-supplied `use`, is not retained for re-export. The Ed25519 `use`=`sig` member is emitted by Chilkat. **Private output:** The returned JSON contains private key material and must be protected accordingly. Returns TRUE for success, FALSE for failure. ### PrivateKey.GetJwkThumbprint `Chilkat 11.7.0 · c · PrivateKey · GetJwkThumbprint · method · since 9.5.0.66` ```c BOOL CkPrivateKey_GetJwkThumbprint(HCkPrivateKey cHandle, const char *hashAlg, HCkString outStr); const char *CkPrivateKey_getJwkThumbprint(HCkPrivateKey cHandle, const char *hashAlg); ``` Computes the RFC 7638 thumbprint of the public portion of the loaded key using the hash algorithm named by `hashAlg`. Supported values include `md5`, `sha1`, `sha256`, `sha384`, and `sha512`. An unsupported name causes the method to fail. The returned digest is Base64url-encoded without padding. **Public-key identity:** The canonical thumbprint input contains only the required public JWK members. Private members and optional metadata such as `kid`, `use`, and `alg` are excluded, so the result matches the thumbprint of the corresponding `PublicKey`. **Recommended hash:** Use `sha256` for normal RFC 7638 interoperability. MD5 and SHA-1 are available for compatibility but should not be chosen for new security-sensitive identifiers. Returns TRUE for success, FALSE for failure. ### PrivateKey.GetPkcs1ENC `Chilkat 11.7.0 · c · PrivateKey · GetPkcs1ENC · method · since 9.5.0.52` ```c BOOL CkPrivateKey_GetPkcs1ENC(HCkPrivateKey cHandle, const char *encoding, HCkString outStr); const char *CkPrivateKey_getPkcs1ENC(HCkPrivateKey cHandle, const char *encoding); ``` **Full documentation for this method (same in every language):** [Supported Binary Encodings](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/binary_encodings.md) Exports the key as the traditional or preferred unencrypted DER representation and encodes the DER as text using the binary encoding named by `encoding`. The binary bytes are the same as returned by `GetPkcs1`. **Historical method name:** PKCS #1 is specifically an RSA standard. For non-RSA key types, this method returns the applicable traditional structure or a PKCS #8 fallback. | Key type | Returned representation | | :--- | :--- | | RSA | `RSAPrivateKey` DER from PKCS #1. | | DSA | The traditional six-integer DSA private-key structure. | | EC | `ECPrivateKey` DER from RFC 5915. | | Ed25519 | PKCS #8 `PrivateKeyInfo` DER using the Ed25519 OID `1.3.101.112`, because Ed25519 has no traditional PKCS #1 form. | For RSA, the DER contains: ``` RSAPrivateKey ::= SEQUENCE { version Version, modulus INTEGER, -- n publicExponent INTEGER, -- e privateExponent INTEGER, -- d prime1 INTEGER, -- p prime2 INTEGER, -- q exponent1 INTEGER, -- d mod (p-1) exponent2 INTEGER, -- d mod (q-1) coefficient INTEGER, -- (inverse of q) mod p otherPrimeInfos OtherPrimeInfos OPTIONAL } ``` For EC, the traditional structure is: ``` ECPrivateKey ::= SEQUENCE { version INTEGER { ecPrivkeyVer1(1) }, privateKey OCTET STRING, parameters [0] ECParameters OPTIONAL, publicKey [1] BIT STRING OPTIONAL } ``` **Encoding validation:** An unsupported `encoding` encoding name causes the method to fail; it does not silently select another encoding. Returns TRUE for success, FALSE for failure. ### PrivateKey.GetPkcs1Pem `Chilkat 11.7.0 · c · PrivateKey · GetPkcs1Pem · method · since 9.5.0.58` ```c BOOL CkPrivateKey_GetPkcs1Pem(HCkPrivateKey cHandle, HCkString outStr); const char *CkPrivateKey_getPkcs1Pem(HCkPrivateKey cHandle); ``` Exports the key as unencrypted PEM, preferring the traditional algorithm-specific representation when one exists. | Key type | PEM label | Body | | :--- | :--- | :--- | | RSA | `RSA PRIVATE KEY` | PKCS #1 DER | | DSA | `DSA PRIVATE KEY` | Traditional DSA DER | | EC | `EC PRIVATE KEY` | RFC 5915 DER | | Ed25519 | `PRIVATE KEY` | PKCS #8 DER | **Generated PEM formatting:** PEM output uses CRLF line endings, Base64 lines of at most 64 characters, and a final CRLF. **Security note:** The returned private key is not encrypted. Returns TRUE for success, FALSE for failure. ### PrivateKey.GetPkcs8ENC `Chilkat 11.7.0 · c · PrivateKey · GetPkcs8ENC · method · since 9.5.0.52` ```c BOOL CkPrivateKey_GetPkcs8ENC(HCkPrivateKey cHandle, const char *encoding, HCkString outStr); const char *CkPrivateKey_getPkcs8ENC(HCkPrivateKey cHandle, const char *encoding); ``` **Full documentation for this method (same in every language):** [Supported Binary Encodings](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/binary_encodings.md) Exports the key as unencrypted PKCS #8 DER and encodes the DER as text using the binary encoding named by `encoding`. PKCS #8 is an algorithm-independent private-key container. Chilkat emits the classic version-0 `PrivateKeyInfo` structure, with the algorithm-specific private-key DER in an `OCTET STRING`. ``` PrivateKeyInfo ::= SEQUENCE { version Version, privateKeyAlgorithm AlgorithmIdentifier, privateKey OCTET STRING, attributes [0] IMPLICIT Attributes OPTIONAL } ``` **Encoding validation:** An unsupported `encoding` encoding name causes the method to fail; it does not silently select another encoding. **Encoding is not encryption:** Base64, hexadecimal, and similar encodings only represent the DER bytes as text. They do not protect the private key. Returns TRUE for success, FALSE for failure. ### PrivateKey.GetPkcs8EncryptedENC `Chilkat 11.7.0 · c · PrivateKey · GetPkcs8EncryptedENC · method · since 9.5.0.52` ```c BOOL CkPrivateKey_GetPkcs8EncryptedENC(HCkPrivateKey cHandle, const char *encoding, const char *password, HCkString outStr); const char *CkPrivateKey_getPkcs8EncryptedENC(HCkPrivateKey cHandle, const char *encoding, const char *password); ``` **Full documentation for this method (same in every language):** [Supported Binary Encodings](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/binary_encodings.md) Exports the key as password-protected PKCS #8 DER, then encodes the encrypted DER as text. `encoding` names the binary encoding and `password` supplies the password. The cipher is selected by `Pkcs8EncryptAlg`. Encrypted PKCS #8 output uses PBES2 with PBKDF2. The generated parameters use an 8-byte salt, 2048 PBKDF2 iterations, and the default PBKDF2 PRF (HMAC-SHA-1). The selected cipher uses CBC mode with a newly generated IV. **Encoding validation:** An unsupported `encoding` encoding name causes the method to fail. **Empty passwords:** A nonempty, strong password should be used. An empty `password` is accepted but provides no meaningful password protection. Returns TRUE for success, FALSE for failure. ### PrivateKey.GetPkcs8EncryptedPem `Chilkat 11.7.0 · c · PrivateKey · GetPkcs8EncryptedPem · method` ```c BOOL CkPrivateKey_GetPkcs8EncryptedPem(HCkPrivateKey cHandle, const char *password, HCkString outStr); const char *CkPrivateKey_getPkcs8EncryptedPem(HCkPrivateKey cHandle, const char *password); ``` Exports the key as password-protected PKCS #8 PEM using `password` as the password. The cipher is selected by `Pkcs8EncryptAlg`. The output uses: ``` -----BEGIN ENCRYPTED PRIVATE KEY----- ... -----END ENCRYPTED PRIVATE KEY----- ``` Encrypted PKCS #8 output uses PBES2 with PBKDF2. The generated parameters use an 8-byte salt, 2048 PBKDF2 iterations, and the default PBKDF2 PRF (HMAC-SHA-1). The selected cipher uses CBC mode with a newly generated IV. **Generated PEM formatting:** PEM output uses CRLF line endings, Base64 lines of at most 64 characters, and a final CRLF. **Empty passwords:** An empty `password` is accepted and still produces encrypted PKCS #8, but it provides no meaningful password protection. Returns TRUE for success, FALSE for failure. ### PrivateKey.GetPkcs8Pem `Chilkat 11.7.0 · c · PrivateKey · GetPkcs8Pem · method` ```c BOOL CkPrivateKey_GetPkcs8Pem(HCkPrivateKey cHandle, HCkString outStr); const char *CkPrivateKey_getPkcs8Pem(HCkPrivateKey cHandle); ``` Exports the key as unencrypted PKCS #8 PEM. For RSA, EC, and Ed25519, the PEM armor is: ``` -----BEGIN PRIVATE KEY----- ... -----END PRIVATE KEY----- ``` PKCS #8 is an algorithm-independent private-key container. Chilkat emits the classic version-0 `PrivateKeyInfo` structure, with the algorithm-specific private-key DER in an `OCTET STRING`. ``` PrivateKeyInfo ::= SEQUENCE { version Version, privateKeyAlgorithm AlgorithmIdentifier, privateKey OCTET STRING, attributes [0] IMPLICIT Attributes OPTIONAL } ``` **Generated PEM formatting:** PEM output uses CRLF line endings, Base64 lines of at most 64 characters, and a final CRLF. **Security note:** This output is not password-protected. Returns TRUE for success, FALSE for failure. ### PrivateKey.GetPkcsBd `Chilkat 11.7.0 · c · PrivateKey · GetPkcsBd · method · since 11.0.0` ```c BOOL CkPrivateKey_GetPkcsBd(HCkPrivateKey cHandle, BOOL pkcs1, const char *password, HCkBinData bd); ``` Exports the key as DER and replaces the contents of the `BinData` in `bd`. | `pkcs1` | `password` | Output | | :--- | :--- | :--- | | `TRUE` | Ignored for encryption. | RSA PKCS #1, traditional DSA, RFC 5915 EC, or PKCS #8 for Ed25519. | | `FALSE` | Empty string. | Unencrypted PKCS #8 DER. | | `FALSE` | Nonempty password. | Encrypted PKCS #8 DER using `Pkcs8EncryptAlg`. | **Output state:** A successful call replaces any existing `bd` content. If the call fails, `bd` is cleared. **Password behavior:** When `pkcs1` is `TRUE`, `password` does not encrypt the output. To obtain encrypted output, set `pkcs1` to `FALSE` and provide a nonempty `password`. Returns TRUE for success, FALSE for failure. ### PrivateKey.GetRawHex `Chilkat 11.7.0 · c · PrivateKey · GetRawHex · method · since 9.5.0.83` ```c BOOL CkPrivateKey_GetRawHex(HCkPrivateKey cHandle, HCkStringBuilder pubKey, HCkString outStr); const char *CkPrivateKey_getRawHex(HCkPrivateKey cHandle, HCkStringBuilder pubKey); ``` Exports the raw private value as lowercase hexadecimal and replaces the contents of the `StringBuilder` in `pubKey` with the corresponding raw public key. | Key type | Returned private value | Public value in `pubKey` | | :--- | :--- | :--- | | Ed25519 | The 32-byte seed accepted by `LoadEd25519`, as 64 hex characters. | The 32-byte public key, as 64 hex characters. | | EC | The private scalar, padded to the curve size as needed. | The uncompressed point `04 \|\| HEX(x) \|\| HEX(y)`. | **Applicable key types:** This method supports Ed25519 and ordinary EC keys. RSA and DSA keys do not have a single simple raw representation and cause the method to fail. **Output on failure:** If the method fails, `pubKey` is cleared. Returns TRUE for success, FALSE for failure. ### PrivateKey.GetXml `Chilkat 11.7.0 · c · PrivateKey · GetXml · method` ```c BOOL CkPrivateKey_GetXml(HCkPrivateKey cHandle, HCkString outStr); const char *CkPrivateKey_getXml(HCkPrivateKey cHandle); ``` Exports the key in Chilkat-compatible XML. The XML is not encrypted. RSA and DSA components use ordinary Base64. RSA keys use: ``` ... ... ...

...

... ... ... ... ``` DSA keys use: ```

...

... ... ... ... ``` EC keys place the named curve in the `curve` attribute and Base64-encode the RFC 5915 `ECPrivateKey` DER in the element content: ``` ... ``` Ed25519 keys Base64-encode 64 bytes consisting of the 32-byte private seed followed by the 32-byte public key: ``` ... ``` **Round-trip support:** XML produced by this method can be loaded by `LoadXml`, `LoadXmlFile`, or the general format-detection methods. **Interoperability note:** These XML forms are Chilkat-compatible representations. Prefer PKCS #8, PEM, or JWK when interoperating with systems that expect standard key containers. Returns TRUE for success, FALSE for failure. ### PrivateKey.LoadAnyFormat `Chilkat 11.7.0 · c · PrivateKey · LoadAnyFormat · method · since 9.5.0.75` ```c BOOL CkPrivateKey_LoadAnyFormat(HCkPrivateKey cHandle, HCkBinData privKeyData, const char *password); ``` Loads a private key from the data in `privKeyData` by inspecting its contents. Recognized representations include RSA PKCS #1 DER, traditional DSA and EC DER, PKCS #8 DER, encrypted PKCS #8, PEM, JWK, Chilkat-compatible XML, Microsoft PVK, and supported Ed25519 representations. `password` supplies the password when the detected representation is encrypted; otherwise it may be empty. **Text and binary input:** `privKeyData` contains the exact bytes to inspect. Textual PEM, JWK, and XML are detected from those bytes; a filename extension is not involved. **Trailing DER data:** If the input begins with one complete supported DER key followed by extra bytes or another DER object, the first key is loaded and trailing data is ignored. **Object state:** A successful load replaces any key already held by this object. If loading fails, this object is left empty. Returns TRUE for success, FALSE for failure. ### PrivateKey.LoadAnyFormatFile `Chilkat 11.7.0 · c · PrivateKey · LoadAnyFormatFile · method · since 9.5.0.83` ```c BOOL CkPrivateKey_LoadAnyFormatFile(HCkPrivateKey cHandle, const char *path, const char *password); ``` Loads a private key from the file at `path` by inspecting its contents. Recognized representations include RSA PKCS #1 DER, traditional DSA and EC DER, PKCS #8 DER, encrypted PKCS #8, PEM, JWK, Chilkat-compatible XML, Microsoft PVK, and supported Ed25519 representations. `password` supplies the password when needed. **Filename extensions are advisory:** The file content determines the format; a nonstandard or misleading extension does not prevent recognition. **Object state:** A successful load replaces any key already held by this object. If loading fails, this object is left empty. Returns TRUE for success, FALSE for failure. ### PrivateKey.LoadEd25519 `Chilkat 11.7.0 · c · PrivateKey · LoadEd25519 · method · since 9.5.0.83` ```c BOOL CkPrivateKey_LoadEd25519(HCkPrivateKey cHandle, const char *privKey, const char *pubKey); ``` Loads an Ed25519 key pair from raw hexadecimal values. `privKey` is the 32-byte Ed25519 private seed. `pubKey` is the 32-byte public key. Each nonempty value must contain exactly 64 hexadecimal digits. Uppercase hexadecimal and an optional `0x` prefix are accepted; embedded whitespace is not accepted. `pubKey` may be empty, in which case Chilkat derives the public key from the seed. **Supplied public key is not verified:** When `pubKey` is nonempty, Chilkat stores the supplied public value without checking that it corresponds to `privKey`. Pass an empty `pubKey` when the public key should be derived and guaranteed to match the private seed. **Object state:** A successful load replaces any key already held by this object. If loading fails, this object is left empty. Returns TRUE for success, FALSE for failure. ### PrivateKey.LoadEncryptedPem `Chilkat 11.7.0 · c · PrivateKey · LoadEncryptedPem · method` ```c BOOL CkPrivateKey_LoadEncryptedPem(HCkPrivateKey cHandle, const char *pemStr, const char *password); ``` Loads a private key from the PEM text in `pemStr`. `password` supplies the password when the PEM is encrypted. The method accepts encrypted PKCS #8 PEM and also loads supported unencrypted PEM. ``` -----BEGIN ENCRYPTED PRIVATE KEY----- ... -----END ENCRYPTED PRIVATE KEY----- ``` **Content auto-detection:** Chilkat examines the content rather than relying on the method name or filename extension. This password-taking method can load both encrypted and unencrypted supported private-key representations. **Object state:** A successful load replaces any key already held by this object. If loading fails, this object is left empty. **Password failure:** An incorrect password causes loading to fail and leaves this object empty. Returns TRUE for success, FALSE for failure. ### PrivateKey.LoadEncryptedPemFile `Chilkat 11.7.0 · c · PrivateKey · LoadEncryptedPemFile · method` ```c BOOL CkPrivateKey_LoadEncryptedPemFile(HCkPrivateKey cHandle, const char *path, const char *password); ``` Loads a private key from the file at `path`, using `password` when the detected key is encrypted. The file may contain encrypted PKCS #8 PEM or another supported encrypted or unencrypted representation. **Content auto-detection:** Chilkat examines the content rather than relying on the method name or filename extension. This password-taking method can load both encrypted and unencrypted supported private-key representations. **Object state:** A successful load replaces any key already held by this object. If loading fails, this object is left empty. Returns TRUE for success, FALSE for failure. ### PrivateKey.LoadJwk `Chilkat 11.7.0 · c · PrivateKey · LoadJwk · method · since 9.5.0.66` ```c BOOL CkPrivateKey_LoadJwk(HCkPrivateKey cHandle, const char *jsonStr); ``` Loads a private key from the JWK JSON in `jsonStr`. Supported private JWK key types are RSA (`kty`=`RSA`), EC (`kty`=`EC`), and Ed25519 (`kty`=`OKP`, `crv`=`Ed25519`). An unsupported `kty` causes the method to fail. **Private key material required:** A JWK containing only public members belongs in a `PublicKey`. This method is for JWKs that contain private key material. **Metadata handling:** Optional JOSE metadata such as `kid`, `use`, `alg`, and `key_ops` may be present but is not retained by `PrivateKey`. **Object state:** A successful load replaces any key already held by this object. If loading fails, this object is left empty. Returns TRUE for success, FALSE for failure. ### PrivateKey.LoadPem `Chilkat 11.7.0 · c · PrivateKey · LoadPem · method` ```c BOOL CkPrivateKey_LoadPem(HCkPrivateKey cHandle, const char *str); ``` Loads a private key from the PEM text in `str`. This method has no password argument and therefore cannot load password-protected PEM. Use `LoadEncryptedPem` for encrypted input. **Content auto-detection:** The method name identifies the expected or traditional use, but Chilkat examines the content and can load other supported unencrypted private-key representations. Encrypted input requires a load method that accepts a password. **PEM block selection:** If the text contains multiple PEM blocks, Chilkat selects the first supported private-key block. It skips preceding public-key or unrelated PEM blocks. **Accepted surrounding content:** Leading and trailing whitespace, a UTF-8 BOM, and trailing non-PEM text are accepted. **Object state:** A successful load replaces any key already held by this object. If loading fails, this object is left empty. Returns TRUE for success, FALSE for failure. ### PrivateKey.LoadPemFile `Chilkat 11.7.0 · c · PrivateKey · LoadPemFile · method` ```c BOOL CkPrivateKey_LoadPemFile(HCkPrivateKey cHandle, const char *path); ``` Loads a private key from the file at `path`. This method has no password argument and therefore cannot load a password-protected key. Use `LoadEncryptedPemFile` or `LoadAnyFormatFile` when a password may be required. **Content auto-detection:** The method name identifies the expected or traditional use, but Chilkat examines the content and can load other supported unencrypted private-key representations. Encrypted input requires a load method that accepts a password. **PEM block selection:** For a file containing multiple PEM blocks, Chilkat selects the first supported private-key block and skips preceding public-key or unrelated blocks. **Object state:** A successful load replaces any key already held by this object. If loading fails, this object is left empty. Returns TRUE for success, FALSE for failure. ### PrivateKey.LoadPkcs1File `Chilkat 11.7.0 · c · PrivateKey · LoadPkcs1File · method · since 9.5.0.58` ```c BOOL CkPrivateKey_LoadPkcs1File(HCkPrivateKey cHandle, const char *path); ``` Loads a private key from the file at `path`. Despite the historical PKCS #1 name, the method examines the content and accepts supported unencrypted private-key representations. **Content auto-detection:** The method name identifies the expected or traditional use, but Chilkat examines the content and can load other supported unencrypted private-key representations. Encrypted input requires a load method that accepts a password. **Object state:** A successful load replaces any key already held by this object. If loading fails, this object is left empty. Returns TRUE for success, FALSE for failure. ### PrivateKey.LoadPkcs8EncryptedFile `Chilkat 11.7.0 · c · PrivateKey · LoadPkcs8EncryptedFile · method` ```c BOOL CkPrivateKey_LoadPkcs8EncryptedFile(HCkPrivateKey cHandle, const char *path, const char *password); ``` Loads a private key from the file at `path`, using `password` when the detected key is encrypted. The method can load encrypted PKCS #8 DER or PEM and also supported unencrypted representations. **Content auto-detection:** Chilkat examines the content rather than relying on the method name or filename extension. This password-taking method can load both encrypted and unencrypted supported private-key representations. **Object state:** A successful load replaces any key already held by this object. If loading fails, this object is left empty. Returns TRUE for success, FALSE for failure. ### PrivateKey.LoadPkcs8File `Chilkat 11.7.0 · c · PrivateKey · LoadPkcs8File · method` ```c BOOL CkPrivateKey_LoadPkcs8File(HCkPrivateKey cHandle, const char *path); ``` Loads a private key from the file at `path`. Although named for unencrypted PKCS #8, the method examines the file content and accepts other supported unencrypted private-key representations. **Content auto-detection:** The method name identifies the expected or traditional use, but Chilkat examines the content and can load other supported unencrypted private-key representations. Encrypted input requires a load method that accepts a password. **Trailing DER data:** When the file begins with a complete supported DER private-key object, trailing bytes or a second concatenated DER object are ignored; the first key is loaded. **Object state:** A successful load replaces any key already held by this object. If loading fails, this object is left empty. Returns TRUE for success, FALSE for failure. ### PrivateKey.LoadPvkFile `Chilkat 11.7.0 · c · PrivateKey · LoadPvkFile · method` ```c BOOL CkPrivateKey_LoadPvkFile(HCkPrivateKey cHandle, const char *path, const char *password); ``` Loads a private key from the file at `path`, using `password` if the detected representation is encrypted. This Windows-only method supports Microsoft PVK and also participates in Chilkat private-key content auto-detection. **Content auto-detection:** Chilkat examines the content rather than relying on the method name or filename extension. This password-taking method can load both encrypted and unencrypted supported private-key representations. **Object state:** A successful load replaces any key already held by this object. If loading fails, this object is left empty. Returns TRUE for success, FALSE for failure. ### PrivateKey.LoadXml `Chilkat 11.7.0 · c · PrivateKey · LoadXml · method` ```c BOOL CkPrivateKey_LoadXml(HCkPrivateKey cHandle, const char *xml); ``` Loads a private key from the XML text in `xml`. Supported Chilkat-compatible XML roots include `RSAKeyValue`, `DSAKeyValue`, `ECCKeyValue`, and `Ed25519KeyValue`. **Content auto-detection:** The method name identifies the expected or traditional use, but Chilkat examines the content and can load other supported unencrypted private-key representations. Encrypted input requires a load method that accepts a password. **Ed25519 XML:** The `Ed25519KeyValue` content is ordinary Base64 for the 32-byte private seed followed by the 32-byte public key. **Object state:** A successful load replaces any key already held by this object. If loading fails, this object is left empty. Returns TRUE for success, FALSE for failure. ### PrivateKey.LoadXmlFile `Chilkat 11.7.0 · c · PrivateKey · LoadXmlFile · method` ```c BOOL CkPrivateKey_LoadXmlFile(HCkPrivateKey cHandle, const char *path); ``` Loads a private key from the file at `path`. Chilkat recognizes RSA, DSA, EC, and Ed25519 XML produced by `GetXml`, and also auto-detects other supported unencrypted private-key representations. **Content auto-detection:** The method name identifies the expected or traditional use, but Chilkat examines the content and can load other supported unencrypted private-key representations. Encrypted input requires a load method that accepts a password. **Object state:** A successful load replaces any key already held by this object. If loading fails, this object is left empty. Returns TRUE for success, FALSE for failure. ### PrivateKey.SavePemFile `Chilkat 11.7.0 · c · PrivateKey · SavePemFile · method · since 9.5.0.58` ```c BOOL CkPrivateKey_SavePemFile(HCkPrivateKey cHandle, const char *path); ``` Saves the key at `path` as unencrypted PEM, preferring a traditional algorithm-specific representation when one exists. RSA uses `RSA PRIVATE KEY`, DSA uses `DSA PRIVATE KEY`, EC uses `EC PRIVATE KEY`, and Ed25519 uses the PKCS #8 `PRIVATE KEY` form. **Generated PEM formatting:** PEM output uses CRLF line endings, Base64 lines of at most 64 characters, and a final CRLF. **File behavior:** An existing destination file is replaced. Parent directories are not created; the parent directory must already exist. **PKCS #8 alternative:** Use `SavePkcs8PemFile` to always request the algorithm-independent PKCS #8 `PRIVATE KEY` form. **Security note:** The file is not password-protected. Returns TRUE for success, FALSE for failure. ### PrivateKey.SavePkcs1File `Chilkat 11.7.0 · c · PrivateKey · SavePkcs1File · method · since 9.5.0.58` ```c BOOL CkPrivateKey_SavePkcs1File(HCkPrivateKey cHandle, const char *path); ``` Saves the key at `path` using the traditional or preferred unencrypted DER representation. **Historical method name:** RSA is saved as PKCS #1, EC as RFC 5915, DSA in its traditional structure, and Ed25519 as PKCS #8 because no traditional PKCS #1 form exists. **File behavior:** An existing destination file is replaced. Parent directories are not created; the parent directory must already exist. **Security note:** The file contains cleartext private-key material. Returns TRUE for success, FALSE for failure. ### PrivateKey.SavePkcs8EncryptedFile `Chilkat 11.7.0 · c · PrivateKey · SavePkcs8EncryptedFile · method` ```c BOOL CkPrivateKey_SavePkcs8EncryptedFile(HCkPrivateKey cHandle, const char *password, const char *path); ``` Saves the key as password-protected PKCS #8 DER. `password` supplies the password and `path` is the destination path. The cipher is selected by `Pkcs8EncryptAlg`. Encrypted PKCS #8 output uses PBES2 with PBKDF2. The generated parameters use an 8-byte salt, 2048 PBKDF2 iterations, and the default PBKDF2 PRF (HMAC-SHA-1). The selected cipher uses CBC mode with a newly generated IV. **File behavior:** An existing destination file is replaced. Parent directories are not created; the parent directory must already exist. **Empty passwords:** An empty `password` is accepted but provides no meaningful password protection. Returns TRUE for success, FALSE for failure. ### PrivateKey.SavePkcs8EncryptedPemFile `Chilkat 11.7.0 · c · PrivateKey · SavePkcs8EncryptedPemFile · method` ```c BOOL CkPrivateKey_SavePkcs8EncryptedPemFile(HCkPrivateKey cHandle, const char *password, const char *path); ``` Saves the key as password-protected PKCS #8 PEM. `password` supplies the password and `path` is the destination path. The file uses the `ENCRYPTED PRIVATE KEY` PEM label, and the cipher is selected by `Pkcs8EncryptAlg`. Encrypted PKCS #8 output uses PBES2 with PBKDF2. The generated parameters use an 8-byte salt, 2048 PBKDF2 iterations, and the default PBKDF2 PRF (HMAC-SHA-1). The selected cipher uses CBC mode with a newly generated IV. **Generated PEM formatting:** PEM output uses CRLF line endings, Base64 lines of at most 64 characters, and a final CRLF. **File behavior:** An existing destination file is replaced. Parent directories are not created; the parent directory must already exist. **Empty passwords:** An empty `password` is accepted but provides no meaningful password protection. Returns TRUE for success, FALSE for failure. ### PrivateKey.SavePkcs8File `Chilkat 11.7.0 · c · PrivateKey · SavePkcs8File · method` ```c BOOL CkPrivateKey_SavePkcs8File(HCkPrivateKey cHandle, const char *path); ``` Saves the key as unencrypted PKCS #8 DER at `path`. PKCS #8 is an algorithm-independent private-key container. Chilkat emits the classic version-0 `PrivateKeyInfo` structure, with the algorithm-specific private-key DER in an `OCTET STRING`. ``` PrivateKeyInfo ::= SEQUENCE { version Version, privateKeyAlgorithm AlgorithmIdentifier, privateKey OCTET STRING, attributes [0] IMPLICIT Attributes OPTIONAL } ``` **File behavior:** An existing destination file is replaced. Parent directories are not created; the parent directory must already exist. **macOS Keychain:** Starting in Chilkat v10.0.0, `path` may be formatted as `keychain: