加载DER格式EC私钥报错‘unknown object in factory: DerInteger’的解决方法

Hey there! Let's break down why you're running into this error and how to get your ECC private key loaded correctly.

The Root Cause #

Your current code uses X509Certificate2 to load the DER file, but that class is designed to load full X.509 certificates—not standalone private keys. A DER-formatted ECC private key (usually either SEC1 or PKCS#8 format) doesn't have the certificate structure X509Certificate2 expects, hence the parsing error when it hits a raw DerInteger that doesn't fit the certificate schema.

Solutions Based on Your Private Key Format #

First, confirm your private key's format (you can use OpenSSL to check: openssl ec -in test.der -inform der -text -noout). Then pick the matching code below:

1. Loading SEC1 Format ECC Private Key (Most Common for ECC)

This works for .NET Core 3.0+, .NET 5+, and .NET Framework 4.8+:

using System.IO;
using System.Security.Cryptography;

// Read the DER private key bytes
byte[] privateKeyBytes = File.ReadAllBytes("test.der");

// Initialize ECDsa and import the private key
using (ECDsa ecdsa = ECDsa.Create())
{
    ecdsa.ImportECPrivateKey(privateKeyBytes, out int bytesRead);
    
    // Now you can use the ECDsa instance for ECC operations:
    // Example: Sign data
    byte[] dataToSign = System.Text.Encoding.UTF8.GetBytes("Hello ECC!");
    byte[] signature = ecdsa.SignData(dataToSign, HashAlgorithmName.SHA256);
    
    // Example: Verify signature
    bool isSignatureValid = ecdsa.VerifyData(dataToSign, signature, HashAlgorithmName.SHA256);
}

2. Loading PKCS#8 Format ECC Private Key

If your DER file is in PKCS#8 format (OpenSSL might label it "PKCS#8 Private-Key"), use this instead:

using System.IO;
using System.Security.Cryptography;

byte[] privateKeyBytes = File.ReadAllBytes("test.der");

using (ECDsa ecdsa = ECDsa.Create())
{
    ecdsa.ImportPkcs8PrivateKey(privateKeyBytes, out int bytesRead);
    
    // Use the ECDsa instance for your encryption/signing needs
}

For Older .NET Framework Versions (Pre-4.8) #

If you're stuck on an older framework, you'll need to convert the DER key to PEM format first (using OpenSSL), then parse it manually or use a library like BouncyCastle. For example:

# Convert DER to PEM
openssl ec -in test.der -inform der -out test.pem -outform pem

Then use BouncyCastle to load the PEM key:

using Org.BouncyCastle.Crypto;
using Org.BouncyCastle.OpenSsl;
using Org.BouncyCastle.Security;

using (var reader = new StreamReader("test.pem"))
{
    var pemReader = new PemReader(reader);
    var keyPair = (AsymmetricCipherKeyPair)pemReader.ReadObject();
    var ecdsa = DotNetUtilities.ToECDsa((ECDsaPrivateKeyParameters)keyPair.Private);
    
    // Use ecdsa for operations
}

内容的提问来源于stack exchange，提问作者詹存勤