"DumpKey.java" Dumping Private Keys Out of "keystore"

Cryptography Tutorials - Herong's Tutorial Examples

∟Migrating Keys from "keystore" to "OpenSSL" Key Files

∟"DumpKey.java" Dumping Private Keys Out of "keystore"

This section provides a tutorial example on how to dump private key and public key pair output of a 'PrivateKeyEntry' in a 'keystore' file using a Java program, DumpKey.java.

Since "keytool" can not be used to export the private and public key pair out of a 'keystore' file, I wrote the following Java program, DumpKey.java, to do this job:

/* DumpKey.java
 * Copyright (c) HerongYang.com. All Rights Reserved.
 */
import java.io.*;
import java.security.*;
public class DumpKey {
   static public void main(String[] a) {
      if (a.length<5) {
         System.out.println("Usage:");
         System.out.println(
            "java DumpKey jks storepass alias keypass out");
         return;
      }
      String jksFile = a[0];
      char[] jksPass = a[1].toCharArray();
      String keyName = a[2];
      char[] keyPass = a[3].toCharArray();
      String outFile = a[4];

      try {
         KeyStore jks = KeyStore.getInstance("jks");
         jks.load(new FileInputStream(jksFile), jksPass);
         Key key = jks.getKey(keyName, keyPass);
         System.out.println("Key algorithm: "+key.getAlgorithm());
         System.out.println("Key format: "+key.getFormat());
         System.out.println("Writing key in binary form to "
            +outFile);

         FileOutputStream out = new FileOutputStream(outFile);
         out.write(key.getEncoded());
         out.close();
      } catch (Exception e) {
         e.printStackTrace();
         return;
      }
   }
}

Notes on DumpKey.java:

The first step is to load the keystore file into "jks". I am assuming that the keystore type is "jks", which is the default type used by "keytool". Another type is "pkcs12".
The second step is to obtain the key from the specified key entry name. I am assuming that the specified entry is a PrivateKeyEntry, which contains two components: the key and the self-signed certificate.
The last step is to dump the key in the default encoding format. Note that the encoding format is still in a binary form.
Converting the output in Base64 encoding is not done, because JDK does not offer any Base64 classes.

I tried my DumpKey.java program with my key pair stored in herong.jks as show below:

herong> javac DumpKey.java

herong> java DumpKey herong.jks jkspass herong_key keypass herong_bin.key
Key algorithm: DSA
Key format: PKCS#8
Writing key in binary form to herong_bin.key