--- product: Chilkat product_version: 11.7.0 language: pascal language_label: Lazarus Pascal class: PrivateKey license: free deprecated: false reference_html: https://www.chilkatsoft.com/refdoc/pascal_PrivateKeyRef.html --- # Chilkat PrivateKey — Lazarus Pascal — v11.7.0 > Chilkat 11.7.0 · language=pascal · class=PrivateKey > Other versions: replace `11.7.0` in this URL. Other languages: `https://www.chilkatsoft.com/ai-docs/v/11.7.0//classes/PrivateKey.md`. > Language-wide rules (install, unlock, error model, strings/bytes): `https://www.chilkatsoft.com/ai-docs/v/11.7.0/pascal/guide.md`. ## Purpose PrivateKey **Load, inspect, export, save, and convert one private key.** `PrivateKey` is a key-container class. It holds one current RSA, DSA, EC, or Ed25519 private key and provides format conversion, persistence, JWK/XML access, raw EC and Ed25519 access, and public-key extraction. Cryptographic operations such as signing, decryption, TLS authentication, and SSH authentication are performed by other Chilkat classes that receive the loaded `PrivateKey`. **Content-based loading** Named load methods inspect the content and recognize supported unencrypted formats. Password-taking loaders also recognize encrypted PKCS #8 and unencrypted input. **Standard export choices** Use PKCS #8 for modern algorithm-independent interchange, encrypted PKCS #8 for password-protected storage, JWK for JOSE, and traditional PEM only when required by a legacy consumer. **One-key state** A successful load replaces the current key. A failed load leaves the object empty. Check `KeyType` and `BitLength` after loading when the expected algorithm matters. **Independent public key** `ToPublicKey` creates an independent `PublicKey` that is unaffected when this object is reloaded with another key. **Key generation** Generate new keys with `Rsa`, `Ecc`, or `EdDSA`, which can place the generated key into a `PrivateKey`. **Certificates are separate** A private key does not contain a certificate or chain. Use `Cert` or `Pfx` when certificate association is required. **Recommended format selection:** Prefer unencrypted PKCS #8 for transient interchange, encrypted PKCS #8 with `aes256` and a strong password for stored key files, JWK for JWT/JWS/JWE workflows, and traditional RSA or EC PEM only when the receiving software requires it. **Protect private material:** Base64, hexadecimal, PEM, JWK, and XML are encodings or containers, not encryption. Avoid exporting a private key unless necessary, and protect every unencrypted representation as sensitive data. For an extended overview, see [PrivateKey Class Overview](https://www.chilkatsoft.com/privatekey_class_overview.asp). ## Object creation, unlocking and error handling **Create / Free** ```pascal uses Chilkat.PrivateKey; var obj: TPrivateKey; begin obj := TPrivateKey.Create; try if not obj.IsValid then raise Exception.Create('Failed to create a TPrivateKey instance.'); // ... use obj ... finally obj.Free; end; end; ``` `constructor Create;` Allocates the underlying CkPrivateKey object and returns a new TPrivateKey instance. Simply adding **Chilkat.PrivateKey** to the unit's `uses` clause is enough to locate and bind to the Chilkat shared library (DLL / .so / .dylib) at runtime — no separate load step is required. Check `obj.IsValid` after calling `Create`; it is `False` if the underlying library could not be found/loaded or the object could not be allocated (for example, when unlicensed). `destructor Destroy; override;` Every TPrivateKey created by calling `Create` should eventually be released by calling `.Free` (inherited from `TObject`). The destructor automatically disposes the underlying CkPrivateKey handle. A native (unmanaged) memory leak occurs if the object is never freed. Call `Global.UnlockBundle` once at the start of the program, before using this or any other Chilkat class. Any string unlocks a fully functional 30-day trial; a purchased unlock code is used in production. See `guide.md` for the exact code in Lazarus Pascal. ## Members common to every Chilkat class Documented once per language in `common-members.md`; listed here so this page is self-contained. | Property | Signature | Access | Meaning | |---|---|---|---| | `DebugLogFilePath` | `property DebugLogFilePath: string read GetDebugLogFilePath write SetDebugLogFilePath;` | read/write | If set to a file path, this property logs the LastErrorText of each Chilkat method or property call to the specified file. | | `LastErrorHtml` | `property LastErrorHtml: string read GetLastErrorHtml;` | read-only | Provides HTML-formatted information about the last called method or property. | | `LastErrorText` | `property LastErrorText: string read GetLastErrorText;` | read-only | Provides plain text information about the last called method or property. | | `LastErrorXml` | `property LastErrorXml: string read GetLastErrorXml;` | read-only | Provides XML-formatted information about the last called method or property. | | `LastMethodSuccess` | `property LastMethodSuccess: Boolean read GetLastMethodSuccess write SetLastMethodSuccess;` | read/write | Indicates the success or failure of the most recent method call: `True` means success, `False` means failure. | | `VerboseLogging` | `property VerboseLogging: Boolean read GetVerboseLogging write SetVerboseLogging;` | read/write | If set to `True`, then the contents of LastErrorText (or LastErrorXml, or LastErrorHtml) may contain more verbose information. | | `Version` | `property Version: string read GetVersion;` | read-only | Version of the component/library, such as "10.1.0" | ## Member index | Member | Kind | Signature | |---|---|---| | `BitLength` | property, read-only | `property BitLength: Integer read GetBitLength;` | | `KeyType` | property, read-only | `property KeyType: string read GetKeyType;` | | `Pkcs8EncryptAlg` | property, read/write | `property Pkcs8EncryptAlg: string read GetPkcs8EncryptAlg write SetPkcs8EncryptAlg;` | | `UncommonOptions` | property, read/write | `property UncommonOptions: string read GetUncommonOptions write SetUncommonOptions;` | | `GetJwk` | method | `function GetJwk: string;` | | `GetJwkThumbprint` | method | `function GetJwkThumbprint(const hashAlg: string): string;` | | `GetPkcs1ENC` | method | `function GetPkcs1ENC(const encoding: string): string;` | | `GetPkcs1Pem` | method | `function GetPkcs1Pem: string;` | | `GetPkcs8ENC` | method | `function GetPkcs8ENC(const encoding: string): string;` | | `GetPkcs8EncryptedENC` | method | `function GetPkcs8EncryptedENC(const encoding: string;     const password: string): string;` | | `GetPkcs8EncryptedPem` | method | `function GetPkcs8EncryptedPem(const password: string): string;` | | `GetPkcs8Pem` | method | `function GetPkcs8Pem: string;` | | `GetPkcsBd` | method | `// bd is a TBinData object. function GetPkcsBd(pkcs1: Boolean;     const password: string;     bd: TChilkatBase): Boolean;` | | `GetRawHex` | method | `// pubKey is a TStringBuilder object. function GetRawHex(pubKey: TChilkatBase): string;` | | `GetXml` | method | `function GetXml: string;` | | `LoadAnyFormat` | method | `// privKeyData is a TBinData object. function LoadAnyFormat(privKeyData: TChilkatBase;     const password: string): Boolean;` | | `LoadAnyFormatFile` | method | `function LoadAnyFormatFile(const path: string;     const password: string): Boolean;` | | `LoadEd25519` | method | `function LoadEd25519(const privKey: string;     const pubKey: string): Boolean;` | | `LoadEncryptedPem` | method | `function LoadEncryptedPem(const pemStr: string;     const password: string): Boolean;` | | `LoadEncryptedPemFile` | method | `function LoadEncryptedPemFile(const path: string;     const password: string): Boolean;` | | `LoadJwk` | method | `function LoadJwk(const jsonStr: string): Boolean;` | | `LoadPem` | method | `function LoadPem(const str: string): Boolean;` | | `LoadPemFile` | method | `function LoadPemFile(const path: string): Boolean;` | | `LoadPkcs1File` | method | `function LoadPkcs1File(const path: string): Boolean;` | | `LoadPkcs8EncryptedFile` | method | `function LoadPkcs8EncryptedFile(const path: string;     const password: string): Boolean;` | | `LoadPkcs8File` | method | `function LoadPkcs8File(const path: string): Boolean;` | | `LoadPvkFile` | method | `function LoadPvkFile(const path: string;     const password: string): Boolean;` | | `LoadXml` | method | `function LoadXml(const xml: string): Boolean;` | | `LoadXmlFile` | method | `function LoadXmlFile(const path: string): Boolean;` | | `SavePemFile` | method | `function SavePemFile(const path: string): Boolean;` | | `SavePkcs1File` | method | `function SavePkcs1File(const path: string): Boolean;` | | `SavePkcs8EncryptedFile` | method | `function SavePkcs8EncryptedFile(const password: string;     const path: string): Boolean;` | | `SavePkcs8EncryptedPemFile` | method | `function SavePkcs8EncryptedPemFile(const password: string;     const path: string): Boolean;` | | `SavePkcs8File` | method | `function SavePkcs8File(const path: string): Boolean;` | | `SavePkcs8PemFile` | method | `function SavePkcs8PemFile(const path: string): Boolean;` | | `SaveXmlFile` | method | `function SaveXmlFile(const path: string): Boolean;` | | `ToPublicKey` | method | `// pubKey is a TPublicKey object. function ToPublicKey(pubKey: TChilkatBase): Boolean;` | | `UploadToCloud` | method | `// jsonIn is a TJsonObject object. // jsonOut is a TJsonObject object. function UploadToCloud(jsonIn: TChilkatBase;     jsonOut: TChilkatBase): Boolean;` | ## Properties ### PrivateKey.BitLength `Chilkat 11.7.0 · pascal · PrivateKey · BitLength · property · read-only · since 9.5.0.49` ```pascal property BitLength: Integer read GetBitLength; ``` Returns the nominal size of the loaded private key, in bits. The value is `0` when the object is empty. For RSA it is the modulus size; for DSA it is the size of `p`; for EC it is the named-curve field size; and for Ed25519 it is `256`. **Comparing strength:** Bit lengths are meaningful only within the context of the algorithm. A 256-bit EC key and a 256-bit RSA key do not provide comparable security. ### PrivateKey.KeyType `Chilkat 11.7.0 · pascal · PrivateKey · KeyType · property · read-only · since 9.5.0.52` ```pascal property KeyType: string read GetKeyType; ``` Identifies the algorithm of the currently loaded key. The value is one of `empty`, `rsa`, `dsa`, `ecc`, or `ed25519`. `empty` means that no usable private key is loaded. **One-key state model:** A `PrivateKey` object holds one current key. Loading another key replaces it; a failed load leaves the object empty. ### PrivateKey.Pkcs8EncryptAlg `Chilkat 11.7.0 · pascal · PrivateKey · Pkcs8EncryptAlg · property · read/write · since 9.5.0.49` ```pascal property Pkcs8EncryptAlg: string read GetPkcs8EncryptAlg write SetPkcs8EncryptAlg; ``` Controls the block cipher used by encrypted PKCS #8 export methods. Supported values are `3des`, `aes128`, `aes192`, and `aes256`. Values are case-insensitive and are normalized to lowercase. The default is `3des`. Assigning an empty or unrecognized value resets the property to `3des`. All choices use CBC mode. Encrypted PKCS #8 output uses PBES2 with PBKDF2. The generated parameters use an 8-byte salt, 2048 PBKDF2 iterations, and the default PBKDF2 PRF (HMAC-SHA-1). The selected cipher uses CBC mode with a newly generated IV. **Recommended setting:** Prefer `aes256` for new output unless an older consumer requires 3DES. This property selects encryption parameters only; password quality remains essential. ### PrivateKey.UncommonOptions `Chilkat 11.7.0 · pascal · PrivateKey · UncommonOptions · property · read/write · since 9.5.0.96` ```pascal property UncommonOptions: string read GetUncommonOptions write SetUncommonOptions; ``` Provides a catch-all string for specialized compatibility options that are not exposed as ordinary properties. The default is the empty string, which is appropriate for normal use. **Leave empty unless instructed:** Set this property only when a Chilkat example, release note, or support response documents a specific option needed for an unusual interoperability case. ## Methods ### PrivateKey.GetJwk `Chilkat 11.7.0 · pascal · PrivateKey · GetJwk · method · since 9.5.0.66` ```pascal function GetJwk: string; ``` Exports the key as a compact JWK (JSON Web Key). Binary integers and byte strings use Base64url without padding. | Key type | Members emitted | | :--- | :--- | | RSA | `kty`, `n`, `e`, `d`, `p`, `q`, `dp`, `dq`, `qi` | | EC | `kty`, `crv`, `x`, `y`, `d` | | Ed25519 | `kty`=`OKP`, `crv`=`Ed25519`, `x`, `d`, and `use`=`sig` | **Key material only:** Optional JOSE metadata loaded from a JWK, such as `kid`, `alg`, `key_ops`, or a caller-supplied `use`, is not retained for re-export. The Ed25519 `use`=`sig` member is emitted by Chilkat. **Private output:** The returned JSON contains private key material and must be protected accordingly. Returns True for success, False for failure. ### PrivateKey.GetJwkThumbprint `Chilkat 11.7.0 · pascal · PrivateKey · GetJwkThumbprint · method · since 9.5.0.66` ```pascal function GetJwkThumbprint(const hashAlg: string): string; ``` Computes the RFC 7638 thumbprint of the public portion of the loaded key using the hash algorithm named by `hashAlg`. Supported values include `md5`, `sha1`, `sha256`, `sha384`, and `sha512`. An unsupported name causes the method to fail. The returned digest is Base64url-encoded without padding. **Public-key identity:** The canonical thumbprint input contains only the required public JWK members. Private members and optional metadata such as `kid`, `use`, and `alg` are excluded, so the result matches the thumbprint of the corresponding `PublicKey`. **Recommended hash:** Use `sha256` for normal RFC 7638 interoperability. MD5 and SHA-1 are available for compatibility but should not be chosen for new security-sensitive identifiers. Returns True for success, False for failure. ### PrivateKey.GetPkcs1ENC `Chilkat 11.7.0 · pascal · PrivateKey · GetPkcs1ENC · method · since 9.5.0.52` ```pascal function GetPkcs1ENC(const encoding: string): string; ``` **Full documentation for this method (same in every language):** [Supported Binary Encodings](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/binary_encodings.md) Exports the key as the traditional or preferred unencrypted DER representation and encodes the DER as text using the binary encoding named by `encoding`. The binary bytes are the same as returned by `GetPkcs1`. **Historical method name:** PKCS #1 is specifically an RSA standard. For non-RSA key types, this method returns the applicable traditional structure or a PKCS #8 fallback. | Key type | Returned representation | | :--- | :--- | | RSA | `RSAPrivateKey` DER from PKCS #1. | | DSA | The traditional six-integer DSA private-key structure. | | EC | `ECPrivateKey` DER from RFC 5915. | | Ed25519 | PKCS #8 `PrivateKeyInfo` DER using the Ed25519 OID `1.3.101.112`, because Ed25519 has no traditional PKCS #1 form. | For RSA, the DER contains: ``` RSAPrivateKey ::= SEQUENCE { version Version, modulus INTEGER, -- n publicExponent INTEGER, -- e privateExponent INTEGER, -- d prime1 INTEGER, -- p prime2 INTEGER, -- q exponent1 INTEGER, -- d mod (p-1) exponent2 INTEGER, -- d mod (q-1) coefficient INTEGER, -- (inverse of q) mod p otherPrimeInfos OtherPrimeInfos OPTIONAL } ``` For EC, the traditional structure is: ``` ECPrivateKey ::= SEQUENCE { version INTEGER { ecPrivkeyVer1(1) }, privateKey OCTET STRING, parameters [0] ECParameters OPTIONAL, publicKey [1] BIT STRING OPTIONAL } ``` **Encoding validation:** An unsupported `encoding` encoding name causes the method to fail; it does not silently select another encoding. Returns True for success, False for failure. ### PrivateKey.GetPkcs1Pem `Chilkat 11.7.0 · pascal · PrivateKey · GetPkcs1Pem · method · since 9.5.0.58` ```pascal function GetPkcs1Pem: string; ``` Exports the key as unencrypted PEM, preferring the traditional algorithm-specific representation when one exists. | Key type | PEM label | Body | | :--- | :--- | :--- | | RSA | `RSA PRIVATE KEY` | PKCS #1 DER | | DSA | `DSA PRIVATE KEY` | Traditional DSA DER | | EC | `EC PRIVATE KEY` | RFC 5915 DER | | Ed25519 | `PRIVATE KEY` | PKCS #8 DER | **Generated PEM formatting:** PEM output uses CRLF line endings, Base64 lines of at most 64 characters, and a final CRLF. **Security note:** The returned private key is not encrypted. Returns True for success, False for failure. ### PrivateKey.GetPkcs8ENC `Chilkat 11.7.0 · pascal · PrivateKey · GetPkcs8ENC · method · since 9.5.0.52` ```pascal function GetPkcs8ENC(const encoding: string): string; ``` **Full documentation for this method (same in every language):** [Supported Binary Encodings](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/binary_encodings.md) Exports the key as unencrypted PKCS #8 DER and encodes the DER as text using the binary encoding named by `encoding`. PKCS #8 is an algorithm-independent private-key container. Chilkat emits the classic version-0 `PrivateKeyInfo` structure, with the algorithm-specific private-key DER in an `OCTET STRING`. ``` PrivateKeyInfo ::= SEQUENCE { version Version, privateKeyAlgorithm AlgorithmIdentifier, privateKey OCTET STRING, attributes [0] IMPLICIT Attributes OPTIONAL } ``` **Encoding validation:** An unsupported `encoding` encoding name causes the method to fail; it does not silently select another encoding. **Encoding is not encryption:** Base64, hexadecimal, and similar encodings only represent the DER bytes as text. They do not protect the private key. Returns True for success, False for failure. ### PrivateKey.GetPkcs8EncryptedENC `Chilkat 11.7.0 · pascal · PrivateKey · GetPkcs8EncryptedENC · method · since 9.5.0.52` ```pascal function GetPkcs8EncryptedENC(const encoding: string;     const password: string): string; ``` **Full documentation for this method (same in every language):** [Supported Binary Encodings](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/binary_encodings.md) Exports the key as password-protected PKCS #8 DER, then encodes the encrypted DER as text. `encoding` names the binary encoding and `password` supplies the password. The cipher is selected by `Pkcs8EncryptAlg`. Encrypted PKCS #8 output uses PBES2 with PBKDF2. The generated parameters use an 8-byte salt, 2048 PBKDF2 iterations, and the default PBKDF2 PRF (HMAC-SHA-1). The selected cipher uses CBC mode with a newly generated IV. **Encoding validation:** An unsupported `encoding` encoding name causes the method to fail. **Empty passwords:** A nonempty, strong password should be used. An empty `password` is accepted but provides no meaningful password protection. Returns True for success, False for failure. ### PrivateKey.GetPkcs8EncryptedPem `Chilkat 11.7.0 · pascal · PrivateKey · GetPkcs8EncryptedPem · method` ```pascal function GetPkcs8EncryptedPem(const password: string): string; ``` Exports the key as password-protected PKCS #8 PEM using `password` as the password. The cipher is selected by `Pkcs8EncryptAlg`. The output uses: ``` -----BEGIN ENCRYPTED PRIVATE KEY----- ... -----END ENCRYPTED PRIVATE KEY----- ``` Encrypted PKCS #8 output uses PBES2 with PBKDF2. The generated parameters use an 8-byte salt, 2048 PBKDF2 iterations, and the default PBKDF2 PRF (HMAC-SHA-1). The selected cipher uses CBC mode with a newly generated IV. **Generated PEM formatting:** PEM output uses CRLF line endings, Base64 lines of at most 64 characters, and a final CRLF. **Empty passwords:** An empty `password` is accepted and still produces encrypted PKCS #8, but it provides no meaningful password protection. Returns True for success, False for failure. ### PrivateKey.GetPkcs8Pem `Chilkat 11.7.0 · pascal · PrivateKey · GetPkcs8Pem · method` ```pascal function GetPkcs8Pem: string; ``` Exports the key as unencrypted PKCS #8 PEM. For RSA, EC, and Ed25519, the PEM armor is: ``` -----BEGIN PRIVATE KEY----- ... -----END PRIVATE KEY----- ``` PKCS #8 is an algorithm-independent private-key container. Chilkat emits the classic version-0 `PrivateKeyInfo` structure, with the algorithm-specific private-key DER in an `OCTET STRING`. ``` PrivateKeyInfo ::= SEQUENCE { version Version, privateKeyAlgorithm AlgorithmIdentifier, privateKey OCTET STRING, attributes [0] IMPLICIT Attributes OPTIONAL } ``` **Generated PEM formatting:** PEM output uses CRLF line endings, Base64 lines of at most 64 characters, and a final CRLF. **Security note:** This output is not password-protected. Returns True for success, False for failure. ### PrivateKey.GetPkcsBd `Chilkat 11.7.0 · pascal · PrivateKey · GetPkcsBd · method · since 11.0.0` ```pascal // bd is a TBinData object. function GetPkcsBd(pkcs1: Boolean;     const password: string;     bd: TChilkatBase): Boolean; ``` Exports the key as DER and replaces the contents of the `BinData` in `bd`. | `pkcs1` | `password` | Output | | :--- | :--- | :--- | | `True` | Ignored for encryption. | RSA PKCS #1, traditional DSA, RFC 5915 EC, or PKCS #8 for Ed25519. | | `False` | Empty string. | Unencrypted PKCS #8 DER. | | `False` | Nonempty password. | Encrypted PKCS #8 DER using `Pkcs8EncryptAlg`. | **Output state:** A successful call replaces any existing `bd` content. If the call fails, `bd` is cleared. **Password behavior:** When `pkcs1` is `True`, `password` does not encrypt the output. To obtain encrypted output, set `pkcs1` to `False` and provide a nonempty `password`. Returns True for success, False for failure. ### PrivateKey.GetRawHex `Chilkat 11.7.0 · pascal · PrivateKey · GetRawHex · method · since 9.5.0.83` ```pascal // pubKey is a TStringBuilder object. function GetRawHex(pubKey: TChilkatBase): string; ``` Exports the raw private value as lowercase hexadecimal and replaces the contents of the `StringBuilder` in `pubKey` with the corresponding raw public key. | Key type | Returned private value | Public value in `pubKey` | | :--- | :--- | :--- | | Ed25519 | The 32-byte seed accepted by `LoadEd25519`, as 64 hex characters. | The 32-byte public key, as 64 hex characters. | | EC | The private scalar, padded to the curve size as needed. | The uncompressed point `04 \|\| HEX(x) \|\| HEX(y)`. | **Applicable key types:** This method supports Ed25519 and ordinary EC keys. RSA and DSA keys do not have a single simple raw representation and cause the method to fail. **Output on failure:** If the method fails, `pubKey` is cleared. Returns True for success, False for failure. ### PrivateKey.GetXml `Chilkat 11.7.0 · pascal · PrivateKey · GetXml · method` ```pascal function GetXml: string; ``` Exports the key in Chilkat-compatible XML. The XML is not encrypted. RSA and DSA components use ordinary Base64. RSA keys use: ``` ... ... ...

...

... ... ... ... ``` DSA keys use: ```

...

... ... ... ... ``` EC keys place the named curve in the `curve` attribute and Base64-encode the RFC 5915 `ECPrivateKey` DER in the element content: ``` ... ``` Ed25519 keys Base64-encode 64 bytes consisting of the 32-byte private seed followed by the 32-byte public key: ``` ... ``` **Round-trip support:** XML produced by this method can be loaded by `LoadXml`, `LoadXmlFile`, or the general format-detection methods. **Interoperability note:** These XML forms are Chilkat-compatible representations. Prefer PKCS #8, PEM, or JWK when interoperating with systems that expect standard key containers. Returns True for success, False for failure. ### PrivateKey.LoadAnyFormat `Chilkat 11.7.0 · pascal · PrivateKey · LoadAnyFormat · method · since 9.5.0.75` ```pascal // privKeyData is a TBinData object. function LoadAnyFormat(privKeyData: TChilkatBase;     const password: string): Boolean; ``` Loads a private key from the data in `privKeyData` by inspecting its contents. Recognized representations include RSA PKCS #1 DER, traditional DSA and EC DER, PKCS #8 DER, encrypted PKCS #8, PEM, JWK, Chilkat-compatible XML, Microsoft PVK, and supported Ed25519 representations. `password` supplies the password when the detected representation is encrypted; otherwise it may be empty. **Text and binary input:** `privKeyData` contains the exact bytes to inspect. Textual PEM, JWK, and XML are detected from those bytes; a filename extension is not involved. **Trailing DER data:** If the input begins with one complete supported DER key followed by extra bytes or another DER object, the first key is loaded and trailing data is ignored. **Object state:** A successful load replaces any key already held by this object. If loading fails, this object is left empty. Returns True for success, False for failure. ### PrivateKey.LoadAnyFormatFile `Chilkat 11.7.0 · pascal · PrivateKey · LoadAnyFormatFile · method · since 9.5.0.83` ```pascal function LoadAnyFormatFile(const path: string;     const password: string): Boolean; ``` Loads a private key from the file at `path` by inspecting its contents. Recognized representations include RSA PKCS #1 DER, traditional DSA and EC DER, PKCS #8 DER, encrypted PKCS #8, PEM, JWK, Chilkat-compatible XML, Microsoft PVK, and supported Ed25519 representations. `password` supplies the password when needed. **Filename extensions are advisory:** The file content determines the format; a nonstandard or misleading extension does not prevent recognition. **Object state:** A successful load replaces any key already held by this object. If loading fails, this object is left empty. Returns True for success, False for failure. ### PrivateKey.LoadEd25519 `Chilkat 11.7.0 · pascal · PrivateKey · LoadEd25519 · method · since 9.5.0.83` ```pascal function LoadEd25519(const privKey: string;     const pubKey: string): Boolean; ``` Loads an Ed25519 key pair from raw hexadecimal values. `privKey` is the 32-byte Ed25519 private seed. `pubKey` is the 32-byte public key. Each nonempty value must contain exactly 64 hexadecimal digits. Uppercase hexadecimal and an optional `0x` prefix are accepted; embedded whitespace is not accepted. `pubKey` may be empty, in which case Chilkat derives the public key from the seed. **Supplied public key is not verified:** When `pubKey` is nonempty, Chilkat stores the supplied public value without checking that it corresponds to `privKey`. Pass an empty `pubKey` when the public key should be derived and guaranteed to match the private seed. **Object state:** A successful load replaces any key already held by this object. If loading fails, this object is left empty. Returns True for success, False for failure. ### PrivateKey.LoadEncryptedPem `Chilkat 11.7.0 · pascal · PrivateKey · LoadEncryptedPem · method` ```pascal function LoadEncryptedPem(const pemStr: string;     const password: string): Boolean; ``` Loads a private key from the PEM text in `pemStr`. `password` supplies the password when the PEM is encrypted. The method accepts encrypted PKCS #8 PEM and also loads supported unencrypted PEM. ``` -----BEGIN ENCRYPTED PRIVATE KEY----- ... -----END ENCRYPTED PRIVATE KEY----- ``` **Content auto-detection:** Chilkat examines the content rather than relying on the method name or filename extension. This password-taking method can load both encrypted and unencrypted supported private-key representations. **Object state:** A successful load replaces any key already held by this object. If loading fails, this object is left empty. **Password failure:** An incorrect password causes loading to fail and leaves this object empty. Returns True for success, False for failure. ### PrivateKey.LoadEncryptedPemFile `Chilkat 11.7.0 · pascal · PrivateKey · LoadEncryptedPemFile · method` ```pascal function LoadEncryptedPemFile(const path: string;     const password: string): Boolean; ``` Loads a private key from the file at `path`, using `password` when the detected key is encrypted. The file may contain encrypted PKCS #8 PEM or another supported encrypted or unencrypted representation. **Content auto-detection:** Chilkat examines the content rather than relying on the method name or filename extension. This password-taking method can load both encrypted and unencrypted supported private-key representations. **Object state:** A successful load replaces any key already held by this object. If loading fails, this object is left empty. Returns True for success, False for failure. ### PrivateKey.LoadJwk `Chilkat 11.7.0 · pascal · PrivateKey · LoadJwk · method · since 9.5.0.66` ```pascal function LoadJwk(const jsonStr: string): Boolean; ``` Loads a private key from the JWK JSON in `jsonStr`. Supported private JWK key types are RSA (`kty`=`RSA`), EC (`kty`=`EC`), and Ed25519 (`kty`=`OKP`, `crv`=`Ed25519`). An unsupported `kty` causes the method to fail. **Private key material required:** A JWK containing only public members belongs in a `PublicKey`. This method is for JWKs that contain private key material. **Metadata handling:** Optional JOSE metadata such as `kid`, `use`, `alg`, and `key_ops` may be present but is not retained by `PrivateKey`. **Object state:** A successful load replaces any key already held by this object. If loading fails, this object is left empty. Returns True for success, False for failure. ### PrivateKey.LoadPem `Chilkat 11.7.0 · pascal · PrivateKey · LoadPem · method` ```pascal function LoadPem(const str: string): Boolean; ``` Loads a private key from the PEM text in `str`. This method has no password argument and therefore cannot load password-protected PEM. Use `LoadEncryptedPem` for encrypted input. **Content auto-detection:** The method name identifies the expected or traditional use, but Chilkat examines the content and can load other supported unencrypted private-key representations. Encrypted input requires a load method that accepts a password. **PEM block selection:** If the text contains multiple PEM blocks, Chilkat selects the first supported private-key block. It skips preceding public-key or unrelated PEM blocks. **Accepted surrounding content:** Leading and trailing whitespace, a UTF-8 BOM, and trailing non-PEM text are accepted. **Object state:** A successful load replaces any key already held by this object. If loading fails, this object is left empty. Returns True for success, False for failure. ### PrivateKey.LoadPemFile `Chilkat 11.7.0 · pascal · PrivateKey · LoadPemFile · method` ```pascal function LoadPemFile(const path: string): Boolean; ``` Loads a private key from the file at `path`. This method has no password argument and therefore cannot load a password-protected key. Use `LoadEncryptedPemFile` or `LoadAnyFormatFile` when a password may be required. **Content auto-detection:** The method name identifies the expected or traditional use, but Chilkat examines the content and can load other supported unencrypted private-key representations. Encrypted input requires a load method that accepts a password. **PEM block selection:** For a file containing multiple PEM blocks, Chilkat selects the first supported private-key block and skips preceding public-key or unrelated blocks. **Object state:** A successful load replaces any key already held by this object. If loading fails, this object is left empty. Returns True for success, False for failure. ### PrivateKey.LoadPkcs1File `Chilkat 11.7.0 · pascal · PrivateKey · LoadPkcs1File · method · since 9.5.0.58` ```pascal function LoadPkcs1File(const path: string): Boolean; ``` Loads a private key from the file at `path`. Despite the historical PKCS #1 name, the method examines the content and accepts supported unencrypted private-key representations. **Content auto-detection:** The method name identifies the expected or traditional use, but Chilkat examines the content and can load other supported unencrypted private-key representations. Encrypted input requires a load method that accepts a password. **Object state:** A successful load replaces any key already held by this object. If loading fails, this object is left empty. Returns True for success, False for failure. ### PrivateKey.LoadPkcs8EncryptedFile `Chilkat 11.7.0 · pascal · PrivateKey · LoadPkcs8EncryptedFile · method` ```pascal function LoadPkcs8EncryptedFile(const path: string;     const password: string): Boolean; ``` Loads a private key from the file at `path`, using `password` when the detected key is encrypted. The method can load encrypted PKCS #8 DER or PEM and also supported unencrypted representations. **Content auto-detection:** Chilkat examines the content rather than relying on the method name or filename extension. This password-taking method can load both encrypted and unencrypted supported private-key representations. **Object state:** A successful load replaces any key already held by this object. If loading fails, this object is left empty. Returns True for success, False for failure. ### PrivateKey.LoadPkcs8File `Chilkat 11.7.0 · pascal · PrivateKey · LoadPkcs8File · method` ```pascal function LoadPkcs8File(const path: string): Boolean; ``` Loads a private key from the file at `path`. Although named for unencrypted PKCS #8, the method examines the file content and accepts other supported unencrypted private-key representations. **Content auto-detection:** The method name identifies the expected or traditional use, but Chilkat examines the content and can load other supported unencrypted private-key representations. Encrypted input requires a load method that accepts a password. **Trailing DER data:** When the file begins with a complete supported DER private-key object, trailing bytes or a second concatenated DER object are ignored; the first key is loaded. **Object state:** A successful load replaces any key already held by this object. If loading fails, this object is left empty. Returns True for success, False for failure. ### PrivateKey.LoadPvkFile `Chilkat 11.7.0 · pascal · PrivateKey · LoadPvkFile · method` ```pascal function LoadPvkFile(const path: string;     const password: string): Boolean; ``` Loads a private key from the file at `path`, using `password` if the detected representation is encrypted. This Windows-only method supports Microsoft PVK and also participates in Chilkat private-key content auto-detection. **Content auto-detection:** Chilkat examines the content rather than relying on the method name or filename extension. This password-taking method can load both encrypted and unencrypted supported private-key representations. **Object state:** A successful load replaces any key already held by this object. If loading fails, this object is left empty. Returns True for success, False for failure. ### PrivateKey.LoadXml `Chilkat 11.7.0 · pascal · PrivateKey · LoadXml · method` ```pascal function LoadXml(const xml: string): Boolean; ``` Loads a private key from the XML text in `xml`. Supported Chilkat-compatible XML roots include `RSAKeyValue`, `DSAKeyValue`, `ECCKeyValue`, and `Ed25519KeyValue`. **Content auto-detection:** The method name identifies the expected or traditional use, but Chilkat examines the content and can load other supported unencrypted private-key representations. Encrypted input requires a load method that accepts a password. **Ed25519 XML:** The `Ed25519KeyValue` content is ordinary Base64 for the 32-byte private seed followed by the 32-byte public key. **Object state:** A successful load replaces any key already held by this object. If loading fails, this object is left empty. Returns True for success, False for failure. ### PrivateKey.LoadXmlFile `Chilkat 11.7.0 · pascal · PrivateKey · LoadXmlFile · method` ```pascal function LoadXmlFile(const path: string): Boolean; ``` Loads a private key from the file at `path`. Chilkat recognizes RSA, DSA, EC, and Ed25519 XML produced by `GetXml`, and also auto-detects other supported unencrypted private-key representations. **Content auto-detection:** The method name identifies the expected or traditional use, but Chilkat examines the content and can load other supported unencrypted private-key representations. Encrypted input requires a load method that accepts a password. **Object state:** A successful load replaces any key already held by this object. If loading fails, this object is left empty. Returns True for success, False for failure. ### PrivateKey.SavePemFile `Chilkat 11.7.0 · pascal · PrivateKey · SavePemFile · method · since 9.5.0.58` ```pascal function SavePemFile(const path: string): Boolean; ``` Saves the key at `path` as unencrypted PEM, preferring a traditional algorithm-specific representation when one exists. RSA uses `RSA PRIVATE KEY`, DSA uses `DSA PRIVATE KEY`, EC uses `EC PRIVATE KEY`, and Ed25519 uses the PKCS #8 `PRIVATE KEY` form. **Generated PEM formatting:** PEM output uses CRLF line endings, Base64 lines of at most 64 characters, and a final CRLF. **File behavior:** An existing destination file is replaced. Parent directories are not created; the parent directory must already exist. **PKCS #8 alternative:** Use `SavePkcs8PemFile` to always request the algorithm-independent PKCS #8 `PRIVATE KEY` form. **Security note:** The file is not password-protected. Returns True for success, False for failure. ### PrivateKey.SavePkcs1File `Chilkat 11.7.0 · pascal · PrivateKey · SavePkcs1File · method · since 9.5.0.58` ```pascal function SavePkcs1File(const path: string): Boolean; ``` Saves the key at `path` using the traditional or preferred unencrypted DER representation. **Historical method name:** RSA is saved as PKCS #1, EC as RFC 5915, DSA in its traditional structure, and Ed25519 as PKCS #8 because no traditional PKCS #1 form exists. **File behavior:** An existing destination file is replaced. Parent directories are not created; the parent directory must already exist. **Security note:** The file contains cleartext private-key material. Returns True for success, False for failure. ### PrivateKey.SavePkcs8EncryptedFile `Chilkat 11.7.0 · pascal · PrivateKey · SavePkcs8EncryptedFile · method` ```pascal function SavePkcs8EncryptedFile(const password: string;     const path: string): Boolean; ``` Saves the key as password-protected PKCS #8 DER. `password` supplies the password and `path` is the destination path. The cipher is selected by `Pkcs8EncryptAlg`. Encrypted PKCS #8 output uses PBES2 with PBKDF2. The generated parameters use an 8-byte salt, 2048 PBKDF2 iterations, and the default PBKDF2 PRF (HMAC-SHA-1). The selected cipher uses CBC mode with a newly generated IV. **File behavior:** An existing destination file is replaced. Parent directories are not created; the parent directory must already exist. **Empty passwords:** An empty `password` is accepted but provides no meaningful password protection. Returns True for success, False for failure. ### PrivateKey.SavePkcs8EncryptedPemFile `Chilkat 11.7.0 · pascal · PrivateKey · SavePkcs8EncryptedPemFile · method` ```pascal function SavePkcs8EncryptedPemFile(const password: string;     const path: string): Boolean; ``` Saves the key as password-protected PKCS #8 PEM. `password` supplies the password and `path` is the destination path. The file uses the `ENCRYPTED PRIVATE KEY` PEM label, and the cipher is selected by `Pkcs8EncryptAlg`. Encrypted PKCS #8 output uses PBES2 with PBKDF2. The generated parameters use an 8-byte salt, 2048 PBKDF2 iterations, and the default PBKDF2 PRF (HMAC-SHA-1). The selected cipher uses CBC mode with a newly generated IV. **Generated PEM formatting:** PEM output uses CRLF line endings, Base64 lines of at most 64 characters, and a final CRLF. **File behavior:** An existing destination file is replaced. Parent directories are not created; the parent directory must already exist. **Empty passwords:** An empty `password` is accepted but provides no meaningful password protection. Returns True for success, False for failure. ### PrivateKey.SavePkcs8File `Chilkat 11.7.0 · pascal · PrivateKey · SavePkcs8File · method` ```pascal function SavePkcs8File(const path: string): Boolean; ``` Saves the key as unencrypted PKCS #8 DER at `path`. PKCS #8 is an algorithm-independent private-key container. Chilkat emits the classic version-0 `PrivateKeyInfo` structure, with the algorithm-specific private-key DER in an `OCTET STRING`. ``` PrivateKeyInfo ::= SEQUENCE { version Version, privateKeyAlgorithm AlgorithmIdentifier, privateKey OCTET STRING, attributes [0] IMPLICIT Attributes OPTIONAL } ``` **File behavior:** An existing destination file is replaced. Parent directories are not created; the parent directory must already exist. **macOS Keychain:** Starting in Chilkat v10.0.0, `path` may be formatted as `keychain: