proposal: crypto/x509: export error for using the wrong Parse function

[joeshaw]

What version of Go are you using (go version)?

$ go version
go version go1.15.6 darwin/amd64

What did you do?

I occasionally see PEM-encoded private keys that have the wrong PEM header for that key type. For example, a PKCS8 key with BEGIN RSA PRIVATE KEY instead of BEGIN PRIVATE KEY. Thanks to #30094 this is helpfully reported with an error message suggesting the correct API. For example, in ParsePKCS1PrivateKey:

go/src/crypto/x509/pkcs1.go

Lines 54 to 59 in ccb2e90

	if _, err := asn1.Unmarshal(der, &ecPrivateKey{}); err == nil {
	return nil, errors.New("x509: failed to parse private key (use ParseECPrivateKey instead for this key format)")
	}
	if _, err := asn1.Unmarshal(der, &pkcs8{}); err == nil {
	return nil, errors.New("x509: failed to parse private key (use ParsePKCS8PrivateKey instead for this key format)")
	}

What would you like to see?

It would be nice if these errors were exported as values that could be checked in code, so we could handle these gracefully. Currently you have to do string parsing, and I don't think that is covered by the Go 1 compatibility guarantee.

Alternatively, an API that given DER input returned which key type it was would be nice. With just DER input (that is, without the PEM block hint) you just have to try all the ParsePKCS1PrivateKey / ParsePKCS8PrivateKey / ParseECPrivateKey functions in a row until one succeeds.

[seankhliao]

Typically only errors that can be handled at runtime have their errors exported.
This seems more like a programming error rather than an expected error for running code.