@hxa-rn/react-native-quick-crypto 1.1.0-beta.1 → 1.1.1

package/harmony/quick_crypto/src/main/cpp/cpp/keys/KeyObjectData.cpp

@@ -1,284 +1,284 @@
-#include "KeyObjectData.hpp"
-#include "QuickCryptoUtils.hpp"
-#include <cstdio>
-#include <optional>
-#include <string_view>
-
-namespace margelo::nitro::crypto {
-
-ncrypto::EVPKeyPointer::PrivateKeyEncodingConfig GetPrivateKeyEncodingConfig(KFormatType format, KeyEncoding type) {
-  auto pk_format = static_cast<ncrypto::EVPKeyPointer::PKFormatType>(format);
-  auto pk_type = static_cast<ncrypto::EVPKeyPointer::PKEncodingType>(type);
-
-  auto config = ncrypto::EVPKeyPointer::PrivateKeyEncodingConfig(false, pk_format, pk_type);
-  return config;
-}
-
-ncrypto::EVPKeyPointer::PublicKeyEncodingConfig GetPublicKeyEncodingConfig(KFormatType format, KeyEncoding type) {
-  auto pk_format = static_cast<ncrypto::EVPKeyPointer::PKFormatType>(format);
-  auto pk_type = static_cast<ncrypto::EVPKeyPointer::PKEncodingType>(type);
-
-  auto config = ncrypto::EVPKeyPointer::PublicKeyEncodingConfig(false, pk_format, pk_type);
-  return config;
-}
-
-KeyObjectData TryParsePrivateKey(std::shared_ptr<ArrayBuffer> key, std::optional<KFormatType> format, std::optional<KeyEncoding> type,
-                                 const std::optional<std::shared_ptr<ArrayBuffer>>& passphrase) {
-  // For PEM format, use PKCS8 as default encoding
-  KeyEncoding actualType = type.value_or(KeyEncoding::PKCS8);
-  auto config = GetPrivateKeyEncodingConfig(format.value(), actualType);
-
-  if (passphrase.has_value()) {
-    auto& passphrase_ptr = passphrase.value();
-    config.passphrase = std::make_optional(
-        ncrypto::DataPointer::Copy(ncrypto::Buffer<const void>{passphrase_ptr->data(), passphrase_ptr->size()}));
-  }
-
-  auto buffer = ncrypto::Buffer<const unsigned char>{key->data(), key->size()};
-
-  // Clear any existing OpenSSL errors before parsing
-  ERR_clear_error();
-
-  auto res = ncrypto::EVPKeyPointer::TryParsePrivateKey(config, buffer);
-  if (res) {
-    return KeyObjectData::CreateAsymmetric(KeyType::PRIVATE, std::move(res.value));
-  }
-
-  if (res.error.has_value() && res.error.value() == ncrypto::EVPKeyPointer::PKParseError::NEED_PASSPHRASE) {
-    throw std::runtime_error("Passphrase required for encrypted key");
-  } else {
-    // Get OpenSSL error details
-    unsigned long err = ERR_get_error();
-    char err_buf[256];
-    ERR_error_string_n(err, err_buf, sizeof(err_buf));
-    throw std::runtime_error("Failed to read private key: " + std::string(err_buf));
-  }
-}
-
-KeyObjectData::KeyObjectData(std::nullptr_t) : key_type_(KeyType::SECRET) {}
-
-KeyObjectData::KeyObjectData(std::shared_ptr<ArrayBuffer> symmetric_key)
-    : key_type_(KeyType::SECRET), data_(std::make_shared<Data>(std::move(symmetric_key))) {}
-
-KeyObjectData::KeyObjectData(KeyType type, ncrypto::EVPKeyPointer&& pkey)
-    : key_type_(type), data_(std::make_shared<Data>(std::move(pkey))) {}
-
-KeyObjectData KeyObjectData::CreateSecret(std::shared_ptr<ArrayBuffer> key) {
-  return KeyObjectData(std::move(key));
-}
-
-KeyObjectData KeyObjectData::CreateAsymmetric(KeyType key_type, ncrypto::EVPKeyPointer&& pkey) {
-  CHECK(pkey);
-  return KeyObjectData(key_type, std::move(pkey));
-}
-
-KeyType KeyObjectData::GetKeyType() const {
-  if (!data_) {
-    throw std::runtime_error("Invalid key object: no key data available");
-  }
-  return key_type_;
-}
-
-const ncrypto::EVPKeyPointer& KeyObjectData::GetAsymmetricKey() const {
-  if (key_type_ == KeyType::SECRET) {
-    throw std::runtime_error("Cannot get asymmetric key from secret key object");
-  }
-  if (!data_) {
-    throw std::runtime_error("Invalid key object: no key data available");
-  }
-  return data_->asymmetric_key;
-}
-
-std::shared_ptr<ArrayBuffer> KeyObjectData::GetSymmetricKey() const {
-  if (key_type_ != KeyType::SECRET) {
-    throw std::runtime_error("Cannot get symmetric key from asymmetric key object");
-  }
-  if (!data_) {
-    throw std::runtime_error("Invalid key object: no key data available");
-  }
-  return data_->symmetric_key;
-}
-
-size_t KeyObjectData::GetSymmetricKeySize() const {
-  if (key_type_ != KeyType::SECRET) {
-    throw std::runtime_error("Cannot get symmetric key size from asymmetric key object");
-  }
-  if (!data_) {
-    throw std::runtime_error("Invalid key object: no key data available");
-  }
-  return data_->symmetric_key->size();
-}
-
-KeyObjectData KeyObjectData::GetPublicOrPrivateKey(std::shared_ptr<ArrayBuffer> key, std::optional<KFormatType> format,
-                                                   std::optional<KeyEncoding> type,
-                                                   const std::optional<std::shared_ptr<ArrayBuffer>>& passphrase) {
-  if (key->size() > static_cast<size_t>(std::numeric_limits<int32_t>::max())) {
-    throw std::runtime_error("key is too big");
-  }
-
-  KFormatType actualFormat = format.value_or(KFormatType::DER);
-
-  if (actualFormat == KFormatType::PEM || actualFormat == KFormatType::DER) {
-    auto buffer = ncrypto::Buffer<const unsigned char>{key->data(), key->size()};
-
-    if (actualFormat == KFormatType::PEM) {
-      if (type.has_value() && type.value() == KeyEncoding::SPKI) {
-        auto res = ncrypto::EVPKeyPointer::TryParsePublicKeyPEM(buffer);
-        if (res) {
-          return CreateAsymmetric(KeyType::PUBLIC, std::move(res.value));
-        }
-        throw std::runtime_error("Failed to read PEM public key: key is not in SPKI format");
-      }
-
-      if (type.has_value() &&
-          (type.value() == KeyEncoding::PKCS8 || type.value() == KeyEncoding::SEC1 || type.value() == KeyEncoding::PKCS1)) {
-        auto config = GetPrivateKeyEncodingConfig(actualFormat, type.value());
-        if (passphrase.has_value()) {
-          auto& passphrase_ptr = passphrase.value();
-          config.passphrase = std::make_optional(
-              ncrypto::DataPointer::Copy(ncrypto::Buffer<const void>{passphrase_ptr->data(), passphrase_ptr->size()}));
-        }
-        ERR_clear_error();
-        auto private_res = ncrypto::EVPKeyPointer::TryParsePrivateKey(config, buffer);
-        if (private_res) {
-          return CreateAsymmetric(KeyType::PRIVATE, std::move(private_res.value));
-        }
-        unsigned long err = ERR_get_error();
-        char err_buf[256];
-        ERR_error_string_n(err, err_buf, sizeof(err_buf));
-        throw std::runtime_error("Failed to read PEM private key: " + std::string(err_buf));
-      }
-
-      auto res = ncrypto::EVPKeyPointer::TryParsePublicKeyPEM(buffer);
-      if (res) {
-        return CreateAsymmetric(KeyType::PUBLIC, std::move(res.value));
-      }
-
-      KeyEncoding actualType = KeyEncoding::PKCS8;
-      auto config = GetPrivateKeyEncodingConfig(actualFormat, actualType);
-      if (passphrase.has_value()) {
-        auto& passphrase_ptr = passphrase.value();
-        config.passphrase = std::make_optional(
-            ncrypto::DataPointer::Copy(ncrypto::Buffer<const void>{passphrase_ptr->data(), passphrase_ptr->size()}));
-      }
-
-      ERR_clear_error();
-
-      auto private_res = ncrypto::EVPKeyPointer::TryParsePrivateKey(config, buffer);
-      if (private_res) {
-        return CreateAsymmetric(KeyType::PRIVATE, std::move(private_res.value));
-      }
-
-      unsigned long err = ERR_get_error();
-      char err_buf[256];
-      ERR_error_string_n(err, err_buf, sizeof(err_buf));
-      throw std::runtime_error("Failed to read PEM asymmetric key: " + std::string(err_buf));
-    } else if (actualFormat == KFormatType::DER) {
-      // For DER, try parsing as public key first
-      if (type.has_value() && type.value() == KeyEncoding::SPKI) {
-        auto public_config = GetPublicKeyEncodingConfig(actualFormat, type.value());
-        auto res = ncrypto::EVPKeyPointer::TryParsePublicKey(public_config, buffer);
-        if (res) {
-          return CreateAsymmetric(KeyType::PUBLIC, std::move(res.value));
-        }
-      } else if (type.has_value() && type.value() == KeyEncoding::PKCS8) {
-        auto private_config = GetPrivateKeyEncodingConfig(actualFormat, type.value());
-        if (passphrase.has_value()) {
-          auto& passphrase_ptr = passphrase.value();
-          private_config.passphrase = std::make_optional(
-              ncrypto::DataPointer::Copy(ncrypto::Buffer<const void>{passphrase_ptr->data(), passphrase_ptr->size()}));
-        }
-        auto res = ncrypto::EVPKeyPointer::TryParsePrivateKey(private_config, buffer);
-        if (res) {
-          return CreateAsymmetric(KeyType::PRIVATE, std::move(res.value));
-        }
-      } else {
-        // If no encoding type specified, try both SPKI and PKCS8
-        auto public_config = GetPublicKeyEncodingConfig(actualFormat, KeyEncoding::SPKI);
-        auto public_res = ncrypto::EVPKeyPointer::TryParsePublicKey(public_config, buffer);
-        if (public_res) {
-          return CreateAsymmetric(KeyType::PUBLIC, std::move(public_res.value));
-        }
-
-        auto private_config = GetPrivateKeyEncodingConfig(actualFormat, KeyEncoding::PKCS8);
-        auto private_res = ncrypto::EVPKeyPointer::TryParsePrivateKey(private_config, buffer);
-        if (private_res) {
-          return CreateAsymmetric(KeyType::PRIVATE, std::move(private_res.value));
-        }
-      }
-      throw std::runtime_error("Failed to read DER asymmetric key");
-    }
-  }
-
-  throw std::runtime_error("Unsupported key format for GetPublicOrPrivateKey. Only PEM and DER are supported.");
-}
-
-KeyObjectData KeyObjectData::GetPrivateKey(std::shared_ptr<ArrayBuffer> key, std::optional<KFormatType> format,
-                                           std::optional<KeyEncoding> type, const std::optional<std::shared_ptr<ArrayBuffer>>& passphrase,
-                                           bool /* isPublic */) {
-  // Check if key size fits in int32_t without using double conversion
-  if (key->size() > static_cast<size_t>(std::numeric_limits<int32_t>::max())) {
-    std::string error_msg = "key is too big (int32): size=" + std::to_string(key->size()) +
-                            ", max_int32=" + std::to_string(std::numeric_limits<int32_t>::max());
-    throw std::runtime_error(error_msg);
-  }
-
-  // If no format is specified, assume DER format for binary data
-  KFormatType actualFormat = format.has_value() ? format.value() : KFormatType::DER;
-
-  // Auto-detect PEM when caller omitted format but payload looks like PEM text
-  if (!format.has_value() && key->size() >= 11) {
-    const char* data = reinterpret_cast<const char*>(key->data());
-    std::string_view head(data, std::min(key->size(), size_t(64)));
-    if (head.find("-----BEGIN") != std::string_view::npos) {
-      actualFormat = KFormatType::PEM;
-    }
-  }
-
-  if (actualFormat == KFormatType::PEM || actualFormat == KFormatType::DER) {
-    auto buffer = ncrypto::Buffer<const unsigned char>{key->data(), key->size()};
-
-    if (actualFormat == KFormatType::PEM) {
-      return TryParsePrivateKey(key, format, type, passphrase);
-    } else if (actualFormat == KFormatType::DER) {
-      // Try the specified encoding first, or PKCS8 as default
-      KeyEncoding primaryEncoding = type.value_or(KeyEncoding::PKCS8);
-      auto private_config = GetPrivateKeyEncodingConfig(actualFormat, primaryEncoding);
-      if (passphrase.has_value()) {
-        auto& passphrase_ptr = passphrase.value();
-        private_config.passphrase = std::make_optional(
-            ncrypto::DataPointer::Copy(ncrypto::Buffer<const void>{passphrase_ptr->data(), passphrase_ptr->size()}));
-      }
-
-      // Clear any existing OpenSSL errors before parsing
-      ERR_clear_error();
-
-      auto res = ncrypto::EVPKeyPointer::TryParsePrivateKey(private_config, buffer);
-      if (res) {
-        return CreateAsymmetric(KeyType::PRIVATE, std::move(res.value));
-      }
-
-      // If no specific encoding was provided, try other encodings as fallback
-      if (!type.has_value()) {
-        std::vector<KeyEncoding> fallbackEncodings = {KeyEncoding::SEC1, KeyEncoding::PKCS1};
-        for (auto encoding : fallbackEncodings) {
-          auto config = GetPrivateKeyEncodingConfig(actualFormat, encoding);
-          if (passphrase.has_value()) {
-            auto& passphrase_ptr = passphrase.value();
-            config.passphrase = std::make_optional(
-                ncrypto::DataPointer::Copy(ncrypto::Buffer<const void>{passphrase_ptr->data(), passphrase_ptr->size()}));
-          }
-          auto fallback_res = ncrypto::EVPKeyPointer::TryParsePrivateKey(config, buffer);
-          if (fallback_res) {
-            return CreateAsymmetric(KeyType::PRIVATE, std::move(fallback_res.value));
-          }
-        }
-      }
-      throw std::runtime_error("Failed to read DER private key");
-    }
-  }
-
-  throw std::runtime_error("Unsupported key format for GetPrivateKey. Only PEM and DER are supported.");
-}
-
-} // namespace margelo::nitro::crypto
+#include "KeyObjectData.hpp"
+#include "QuickCryptoUtils.hpp"
+#include <cstdio>
+#include <optional>
+#include <string_view>
+
+namespace margelo::nitro::crypto {
+
+ncrypto::EVPKeyPointer::PrivateKeyEncodingConfig GetPrivateKeyEncodingConfig(KFormatType format, KeyEncoding type) {
+  auto pk_format = static_cast<ncrypto::EVPKeyPointer::PKFormatType>(format);
+  auto pk_type = static_cast<ncrypto::EVPKeyPointer::PKEncodingType>(type);
+
+  auto config = ncrypto::EVPKeyPointer::PrivateKeyEncodingConfig(false, pk_format, pk_type);
+  return config;
+}
+
+ncrypto::EVPKeyPointer::PublicKeyEncodingConfig GetPublicKeyEncodingConfig(KFormatType format, KeyEncoding type) {
+  auto pk_format = static_cast<ncrypto::EVPKeyPointer::PKFormatType>(format);
+  auto pk_type = static_cast<ncrypto::EVPKeyPointer::PKEncodingType>(type);
+
+  auto config = ncrypto::EVPKeyPointer::PublicKeyEncodingConfig(false, pk_format, pk_type);
+  return config;
+}
+
+KeyObjectData TryParsePrivateKey(std::shared_ptr<ArrayBuffer> key, std::optional<KFormatType> format, std::optional<KeyEncoding> type,
+                                 const std::optional<std::shared_ptr<ArrayBuffer>>& passphrase) {
+  // For PEM format, use PKCS8 as default encoding
+  KeyEncoding actualType = type.value_or(KeyEncoding::PKCS8);
+  auto config = GetPrivateKeyEncodingConfig(format.value(), actualType);
+
+  if (passphrase.has_value()) {
+    auto& passphrase_ptr = passphrase.value();
+    config.passphrase = std::make_optional(
+        ncrypto::DataPointer::Copy(ncrypto::Buffer<const void>{passphrase_ptr->data(), passphrase_ptr->size()}));
+  }
+
+  auto buffer = ncrypto::Buffer<const unsigned char>{key->data(), key->size()};
+
+  // Clear any existing OpenSSL errors before parsing
+  ERR_clear_error();
+
+  auto res = ncrypto::EVPKeyPointer::TryParsePrivateKey(config, buffer);
+  if (res) {
+    return KeyObjectData::CreateAsymmetric(KeyType::PRIVATE, std::move(res.value));
+  }
+
+  if (res.error.has_value() && res.error.value() == ncrypto::EVPKeyPointer::PKParseError::NEED_PASSPHRASE) {
+    throw std::runtime_error("Passphrase required for encrypted key");
+  } else {
+    // Get OpenSSL error details
+    unsigned long err = ERR_get_error();
+    char err_buf[256];
+    ERR_error_string_n(err, err_buf, sizeof(err_buf));
+    throw std::runtime_error("Failed to read private key: " + std::string(err_buf));
+  }
+}
+
+KeyObjectData::KeyObjectData(std::nullptr_t) : key_type_(KeyType::SECRET) {}
+
+KeyObjectData::KeyObjectData(std::shared_ptr<ArrayBuffer> symmetric_key)
+    : key_type_(KeyType::SECRET), data_(std::make_shared<Data>(std::move(symmetric_key))) {}
+
+KeyObjectData::KeyObjectData(KeyType type, ncrypto::EVPKeyPointer&& pkey)
+    : key_type_(type), data_(std::make_shared<Data>(std::move(pkey))) {}
+
+KeyObjectData KeyObjectData::CreateSecret(std::shared_ptr<ArrayBuffer> key) {
+  return KeyObjectData(std::move(key));
+}
+
+KeyObjectData KeyObjectData::CreateAsymmetric(KeyType key_type, ncrypto::EVPKeyPointer&& pkey) {
+  CHECK(pkey);
+  return KeyObjectData(key_type, std::move(pkey));
+}
+
+KeyType KeyObjectData::GetKeyType() const {
+  if (!data_) {
+    throw std::runtime_error("Invalid key object: no key data available");
+  }
+  return key_type_;
+}
+
+const ncrypto::EVPKeyPointer& KeyObjectData::GetAsymmetricKey() const {
+  if (key_type_ == KeyType::SECRET) {
+    throw std::runtime_error("Cannot get asymmetric key from secret key object");
+  }
+  if (!data_) {
+    throw std::runtime_error("Invalid key object: no key data available");
+  }
+  return data_->asymmetric_key;
+}
+
+std::shared_ptr<ArrayBuffer> KeyObjectData::GetSymmetricKey() const {
+  if (key_type_ != KeyType::SECRET) {
+    throw std::runtime_error("Cannot get symmetric key from asymmetric key object");
+  }
+  if (!data_) {
+    throw std::runtime_error("Invalid key object: no key data available");
+  }
+  return data_->symmetric_key;
+}
+
+size_t KeyObjectData::GetSymmetricKeySize() const {
+  if (key_type_ != KeyType::SECRET) {
+    throw std::runtime_error("Cannot get symmetric key size from asymmetric key object");
+  }
+  if (!data_) {
+    throw std::runtime_error("Invalid key object: no key data available");
+  }
+  return data_->symmetric_key->size();
+}
+
+KeyObjectData KeyObjectData::GetPublicOrPrivateKey(std::shared_ptr<ArrayBuffer> key, std::optional<KFormatType> format,
+                                                   std::optional<KeyEncoding> type,
+                                                   const std::optional<std::shared_ptr<ArrayBuffer>>& passphrase) {
+  if (key->size() > static_cast<size_t>(std::numeric_limits<int32_t>::max())) {
+    throw std::runtime_error("key is too big");
+  }
+
+  KFormatType actualFormat = format.value_or(KFormatType::DER);
+
+  if (actualFormat == KFormatType::PEM || actualFormat == KFormatType::DER) {
+    auto buffer = ncrypto::Buffer<const unsigned char>{key->data(), key->size()};
+
+    if (actualFormat == KFormatType::PEM) {
+      if (type.has_value() && type.value() == KeyEncoding::SPKI) {
+        auto res = ncrypto::EVPKeyPointer::TryParsePublicKeyPEM(buffer);
+        if (res) {
+          return CreateAsymmetric(KeyType::PUBLIC, std::move(res.value));
+        }
+        throw std::runtime_error("Failed to read PEM public key: key is not in SPKI format");
+      }
+
+      if (type.has_value() &&
+          (type.value() == KeyEncoding::PKCS8 || type.value() == KeyEncoding::SEC1 || type.value() == KeyEncoding::PKCS1)) {
+        auto config = GetPrivateKeyEncodingConfig(actualFormat, type.value());
+        if (passphrase.has_value()) {
+          auto& passphrase_ptr = passphrase.value();
+          config.passphrase = std::make_optional(
+              ncrypto::DataPointer::Copy(ncrypto::Buffer<const void>{passphrase_ptr->data(), passphrase_ptr->size()}));
+        }
+        ERR_clear_error();
+        auto private_res = ncrypto::EVPKeyPointer::TryParsePrivateKey(config, buffer);
+        if (private_res) {
+          return CreateAsymmetric(KeyType::PRIVATE, std::move(private_res.value));
+        }
+        unsigned long err = ERR_get_error();
+        char err_buf[256];
+        ERR_error_string_n(err, err_buf, sizeof(err_buf));
+        throw std::runtime_error("Failed to read PEM private key: " + std::string(err_buf));
+      }
+
+      auto res = ncrypto::EVPKeyPointer::TryParsePublicKeyPEM(buffer);
+      if (res) {
+        return CreateAsymmetric(KeyType::PUBLIC, std::move(res.value));
+      }
+
+      KeyEncoding actualType = KeyEncoding::PKCS8;
+      auto config = GetPrivateKeyEncodingConfig(actualFormat, actualType);
+      if (passphrase.has_value()) {
+        auto& passphrase_ptr = passphrase.value();
+        config.passphrase = std::make_optional(
+            ncrypto::DataPointer::Copy(ncrypto::Buffer<const void>{passphrase_ptr->data(), passphrase_ptr->size()}));
+      }
+
+      ERR_clear_error();
+
+      auto private_res = ncrypto::EVPKeyPointer::TryParsePrivateKey(config, buffer);
+      if (private_res) {
+        return CreateAsymmetric(KeyType::PRIVATE, std::move(private_res.value));
+      }
+
+      unsigned long err = ERR_get_error();
+      char err_buf[256];
+      ERR_error_string_n(err, err_buf, sizeof(err_buf));
+      throw std::runtime_error("Failed to read PEM asymmetric key: " + std::string(err_buf));
+    } else if (actualFormat == KFormatType::DER) {
+      // For DER, try parsing as public key first
+      if (type.has_value() && type.value() == KeyEncoding::SPKI) {
+        auto public_config = GetPublicKeyEncodingConfig(actualFormat, type.value());
+        auto res = ncrypto::EVPKeyPointer::TryParsePublicKey(public_config, buffer);
+        if (res) {
+          return CreateAsymmetric(KeyType::PUBLIC, std::move(res.value));
+        }
+      } else if (type.has_value() && type.value() == KeyEncoding::PKCS8) {
+        auto private_config = GetPrivateKeyEncodingConfig(actualFormat, type.value());
+        if (passphrase.has_value()) {
+          auto& passphrase_ptr = passphrase.value();
+          private_config.passphrase = std::make_optional(
+              ncrypto::DataPointer::Copy(ncrypto::Buffer<const void>{passphrase_ptr->data(), passphrase_ptr->size()}));
+        }
+        auto res = ncrypto::EVPKeyPointer::TryParsePrivateKey(private_config, buffer);
+        if (res) {
+          return CreateAsymmetric(KeyType::PRIVATE, std::move(res.value));
+        }
+      } else {
+        // If no encoding type specified, try both SPKI and PKCS8
+        auto public_config = GetPublicKeyEncodingConfig(actualFormat, KeyEncoding::SPKI);
+        auto public_res = ncrypto::EVPKeyPointer::TryParsePublicKey(public_config, buffer);
+        if (public_res) {
+          return CreateAsymmetric(KeyType::PUBLIC, std::move(public_res.value));
+        }
+
+        auto private_config = GetPrivateKeyEncodingConfig(actualFormat, KeyEncoding::PKCS8);
+        auto private_res = ncrypto::EVPKeyPointer::TryParsePrivateKey(private_config, buffer);
+        if (private_res) {
+          return CreateAsymmetric(KeyType::PRIVATE, std::move(private_res.value));
+        }
+      }
+      throw std::runtime_error("Failed to read DER asymmetric key");
+    }
+  }
+
+  throw std::runtime_error("Unsupported key format for GetPublicOrPrivateKey. Only PEM and DER are supported.");
+}
+
+KeyObjectData KeyObjectData::GetPrivateKey(std::shared_ptr<ArrayBuffer> key, std::optional<KFormatType> format,
+                                           std::optional<KeyEncoding> type, const std::optional<std::shared_ptr<ArrayBuffer>>& passphrase,
+                                           bool /* isPublic */) {
+  // Check if key size fits in int32_t without using double conversion
+  if (key->size() > static_cast<size_t>(std::numeric_limits<int32_t>::max())) {
+    std::string error_msg = "key is too big (int32): size=" + std::to_string(key->size()) +
+                            ", max_int32=" + std::to_string(std::numeric_limits<int32_t>::max());
+    throw std::runtime_error(error_msg);
+  }
+
+  // If no format is specified, assume DER format for binary data
+  KFormatType actualFormat = format.has_value() ? format.value() : KFormatType::DER;
+
+  // Auto-detect PEM when caller omitted format but payload looks like PEM text
+  if (!format.has_value() && key->size() >= 11) {
+    const char* data = reinterpret_cast<const char*>(key->data());
+    std::string_view head(data, std::min(key->size(), size_t(64)));
+    if (head.find("-----BEGIN") != std::string_view::npos) {
+      actualFormat = KFormatType::PEM;
+    }
+  }
+
+  if (actualFormat == KFormatType::PEM || actualFormat == KFormatType::DER) {
+    auto buffer = ncrypto::Buffer<const unsigned char>{key->data(), key->size()};
+
+    if (actualFormat == KFormatType::PEM) {
+      return TryParsePrivateKey(key, format, type, passphrase);
+    } else if (actualFormat == KFormatType::DER) {
+      // Try the specified encoding first, or PKCS8 as default
+      KeyEncoding primaryEncoding = type.value_or(KeyEncoding::PKCS8);
+      auto private_config = GetPrivateKeyEncodingConfig(actualFormat, primaryEncoding);
+      if (passphrase.has_value()) {
+        auto& passphrase_ptr = passphrase.value();
+        private_config.passphrase = std::make_optional(
+            ncrypto::DataPointer::Copy(ncrypto::Buffer<const void>{passphrase_ptr->data(), passphrase_ptr->size()}));
+      }
+
+      // Clear any existing OpenSSL errors before parsing
+      ERR_clear_error();
+
+      auto res = ncrypto::EVPKeyPointer::TryParsePrivateKey(private_config, buffer);
+      if (res) {
+        return CreateAsymmetric(KeyType::PRIVATE, std::move(res.value));
+      }
+
+      // If no specific encoding was provided, try other encodings as fallback
+      if (!type.has_value()) {
+        std::vector<KeyEncoding> fallbackEncodings = {KeyEncoding::SEC1, KeyEncoding::PKCS1};
+        for (auto encoding : fallbackEncodings) {
+          auto config = GetPrivateKeyEncodingConfig(actualFormat, encoding);
+          if (passphrase.has_value()) {
+            auto& passphrase_ptr = passphrase.value();
+            config.passphrase = std::make_optional(
+                ncrypto::DataPointer::Copy(ncrypto::Buffer<const void>{passphrase_ptr->data(), passphrase_ptr->size()}));
+          }
+          auto fallback_res = ncrypto::EVPKeyPointer::TryParsePrivateKey(config, buffer);
+          if (fallback_res) {
+            return CreateAsymmetric(KeyType::PRIVATE, std::move(fallback_res.value));
+          }
+        }
+      }
+      throw std::runtime_error("Failed to read DER private key");
+    }
+  }
+
+  throw std::runtime_error("Unsupported key format for GetPrivateKey. Only PEM and DER are supported.");
+}
+
+} // namespace margelo::nitro::crypto