Java11读取OpenSSL生成secp256k1椭圆曲线私钥报version mismatch错误如何解决

你生成的-----BEGIN EC PRIVATE KEY-----格式的私钥是SEC1标准的EC私钥格式，而代码中使用的PKCS8EncodedKeySpec仅支持解析-----BEGIN PRIVATE KEY-----开头的PKCS8标准私钥，二者格式不匹配，所以抛出版本不匹配异常。

在不引入Bouncy Castle依赖、不修改私钥生成方式、不转换私钥格式的前提下，直接解析SEC1格式私钥内容，配合secp256k1曲线参数构造私钥即可：

JDK 11+ 实现代码（内置secp256k1参数支持） #

import java.security.KeyFactory;
import java.security.PrivateKey;
import java.security.spec.ECGenParameterSpec;
import java.security.spec.ECParameterSpec;
import java.security.spec.ECPrivateKeySpec;
import java.util.Base64;

public class Secp256k1KeyReader {
    public static void main(String[] args) throws Exception {
        // 你的SEC1格式私钥Base64字符串
        String sec1KeyBase64 = "MHQCAQEEIDHE7OA9hgIYW427NieIsXz/qAipMVhqVUIwVcEIWwuAoAcGBSuBBAAKoUQDQgAEcMu2KlVzJLKQ9XfoWvF0jZ+JwbPeUekHqTYVTFK9ISoKLgBN9abxIxycJumqIshcc74GUVtm/sJJoiPJNdEPEQ==";
        byte[] sec1KeyBytes = Base64.getDecoder().decode(sec1KeyBase64);

        // secp256k1的SEC1私钥固定结构：头部7字节后就是32字节的私钥原始值
        byte[] privateKeyRaw = new byte[32];
        System.arraycopy(sec1KeyBytes, 7, privateKeyRaw, 0, 32);
        java.math.BigInteger privateKeyValue = new java.math.BigInteger(1, privateKeyRaw);

        // 加载secp256k1曲线参数
        ECGenParameterSpec ecSpec = new ECGenParameterSpec("secp256k1");
        java.security.AlgorithmParameters parameters = java.security.AlgorithmParameters.getInstance("EC");
        parameters.init(ecSpec);
        ECParameterSpec ecParameterSpec = parameters.getParameterSpec(ECParameterSpec.class);

        // 生成私钥
        ECPrivateKeySpec privateKeySpec = new ECPrivateKeySpec(privateKeyValue, ecParameterSpec);
        KeyFactory keyFactory = KeyFactory.getInstance("EC");
        PrivateKey privateKey = keyFactory.generatePrivate(privateKeySpec);

        // 验证读取结果
        System.out.println("私钥读取成功，算法类型：" + privateKey.getAlgorithm());
    }
}

JDK 8 兼容代码 #

JDK 8 默认没有内置secp256k1参数，手动写入标准secp256k1参数即可，无需引入额外依赖：

import java.security.KeyFactory;
import java.security.PrivateKey;
import java.security.spec.ECFieldFp;
import java.security.spec.ECParameterSpec;
import java.security.spec.ECPoint;
import java.security.spec.ECPrivateKeySpec;
import java.security.spec.EllipticCurve;
import java.util.Base64;

public class Secp256k1KeyReader {
    public static void main(String[] args) throws Exception {
        String sec1KeyBase64 = "MHQCAQEEIDHE7OA9hgIYW427NieIsXz/qAipMVhqVUIwVcEIWwuAoAcGBSuBBAAKoUQDQgAEcMu2KlVzJLKQ9XfoWvF0jZ+JwbPeUekHqTYVTFK9ISoKLgBN9abxIxycJumqIshcc74GUVtm/sJJoiPJNdEPEQ==";
        byte[] sec1KeyBytes = Base64.getDecoder().decode(sec1KeyBase64);

        byte[] privateKeyRaw = new byte[32];
        System.arraycopy(sec1KeyBytes, 7, privateKeyRaw, 0, 32);
        java.math.BigInteger privateKeyValue = new java.math.BigInteger(1, privateKeyRaw);

        // 手动定义secp256k1标准参数
        ECFieldFp fp = new ECFieldFp(new java.math.BigInteger("FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F", 16));
        EllipticCurve curve = new EllipticCurve(
                fp,
                new java.math.BigInteger("0"), // a参数
                new java.math.BigInteger("7")  // b参数
        );
        ECPoint g = new ECPoint(
                new java.math.BigInteger("79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798", 16), // 基点x坐标
                new java.math.BigInteger("483ADA7726A3C4655DA4FBFC0E1108A8FD17B448A68554199C47D08FFB10D4B8", 16)  // 基点y坐标
        );
        ECParameterSpec ecParameterSpec = new ECParameterSpec(
                curve,
                g,
                new java.math.BigInteger("FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141", 16), // 阶n
                1 // 余因子h
        );

        ECPrivateKeySpec privateKeySpec = new ECPrivateKeySpec(privateKeyValue, ecParameterSpec);
        KeyFactory keyFactory = KeyFactory.getInstance("EC");
        PrivateKey privateKey = keyFactory.generatePrivate(privateKeySpec);

        System.out.println("私钥读取成功，算法类型：" + privateKey.getAlgorithm());
    }
}

注意：上述代码中使用的偏移量7仅适用于secp256k1曲线生成的标准SEC1格式私钥，因为secp256k1私钥长度固定为32字节，对应SEC1头部长度固定为7字节。

内容的提问来源于stack exchange，提问作者PatPanda