Inspect private key (PKCS#8 description, optional import proof, no key byte)
inspect_private_keyDescribe a PKCS#8 private key's format, algorithm, curve, and encryption parameters without exposing password or key bytes; optionally import as a non-extractable Web Crypto key.
Instructions
Describe a PKCS#8 private key WITHOUT its password: format ('pkcs8' or 'encrypted-pkcs8'), version, kind (ec / rsa / rsa-pss / ed25519 / ed448 / x25519 / x448 / ml-dsa / unknown), curve, algorithm OID and name, attributes, whether a public key is embedded; for an encrypted key the PBES2 parameters (PBKDF2 iterations, PRF, AES key size, salt length, ciphertext size) or the name of a scheme pkinative refuses (PKCS#12 / PKCS#5 v1.5 ciphers). tryImport:true additionally imports the key into a NON-EXTRACTABLE Web Crypto key and reports the handle (type, algorithm, usages) — an encrypted key then needs password (or PKINATIVE_MCP_PASSWORD; SECRET_REQUIRED) and keyType (KEY_TYPE_REQUIRED), an RSA key needs rsaScheme (RSA_SCHEME_REQUIRED, no default); a wrong password is PKI_CRYPTO_DECRYPTION_FAILED and a legacy cipher PKI_KEY_ENCRYPTION_UNSUPPORTED with the openssl pkcs8 remedy. No result ever carries a key byte, a scalar or the password: the report is an allow-list view and the key never leaves the engine (nothing exports or writes a key here). A PUBLIC KEY or a non-PKCS#8 DER is refused with the PKI_* cause. A call carrying a password is never cached. Token-frugal: verbosity:'summary' (format, kind, curve, encrypted, scheme, imported). Input: pem / derBase64 / path. inspect_pkcs12 is its PKCS#12 counterpart; use it before sign_cms / create_csr to learn what a signer needs (keyType, rsaScheme).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| key | Yes | The PKCS#8 private key (PRIVATE KEY or ENCRYPTED PRIVATE KEY PEM, or DER): exactly one of pem / derBase64 / path. A SEC1 / PKCS#1 key must be converted first (openssl pkcs8 -topk8). | |
| hash | No | Signature hash of the imported key. Default: the curve's hash for ECDSA (SHA-256/384/512), SHA-256 for RSA; refused for Ed25519 / Ed448. 'SHA-1' needs allowSha1:true. With tryImport:true only. | |
| fields | No | Dot-paths to keep after verbosity (arrays map over elements); unmatched paths land in _meta.unmatchedFields. | |
| limits | No | Raise pkinative's 22 named security bounds for this call (trusted input only; absent keys keep the engine defaults). A value above an operator ceiling (PKINATIVE_MCP_MAX_INPUT_BYTES, PKINATIVE_MCP_MAX_KDF_ITERATIONS, PKINATIVE_MCP_MAX_PATHS_EXPLORED) is LIMIT_CEILING_EXCEEDED; describe_engine lists the defaults and the ceilings. | |
| strict | No | Escalate the first engine warning to a PKI_STRICT_DIAGNOSTIC error instead of listing it in diagnostics[]. | |
| keyType | No | The type of an ENCRYPTED key (it reveals its type only once decrypted). With tryImport:true only; KEY_TYPE_REQUIRED when missing for an encrypted key. | |
| pemMode | No | 'strict' (RFC 7468 exactly, default) or 'lax' (tolerates whitespace, line length and RFC 1421 headers). | strict |
| password | No | The password of an encrypted PKCS#8 key or a PKCS#12 file (UTF-8). Never echoed, logged or cached. Alternatively set PKINATIVE_MCP_PASSWORD in the server environment and omit this input (never both) — the variable keeps the secret out of the model transcript. | |
| allowSha1 | No | Accept or produce SHA-1 signatures (legacy material you already trust). Default false: refused with PKI_CRYPTO_ALGORITHM_REFUSED on read, VALIDATION_ERROR on write. | |
| rsaScheme | No | REQUIRED to import an RSA key: 'pkcs1' (RSASSA-PKCS1-v1_5) or 'pss' (RSA-PSS); pkinative has no default (RSA_SCHEME_REQUIRED). With tryImport:true only. | |
| tryImport | No | Also import the key into a NON-EXTRACTABLE Web Crypto key and describe the handle (never exported). An encrypted key then needs password and keyType; an RSA key needs rsaScheme. | |
| verbosity | No | 'summary' keeps the scalar fields only (token-frugal). | full |
| saltLength | No | RSA-PSS salt length in bytes (rsaScheme:'pss' only; default: the hash length). With tryImport:true only. | |
| encodingRules | No | 'der' (strict X.690 DER, default) or 'ber' (indefinite / non-minimal lengths and constructed strings, as legacy CMS producers write). | der |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| kind | No | ||
| curve | No | ||
| format | No | ||
| scheme | No | The password-based encryption scheme of an encrypted key. | |
| version | No | ||
| imported | No | The import proof (full), or its ok flag (summary). | |
| algorithm | No | ||
| encrypted | No | true for an ENCRYPTED PRIVATE KEY (format encrypted-pkcs8). | |
| publicKey | No | ||
| sizeBytes | No | Size of the DER structure (ciphertext included for an encrypted key). | |
| attributes | No | ||
| encryption | No | ||
| diagnostics | No | Non-fatal concerns the engine raised (PKI_DIAG_*, de-duplicated, at most 200; explain_code explains one). | |
| algorithmName | No | The name of the key algorithm OID (ecPublicKey, rsaEncryption, Ed25519 …), plain keys only. | |
| encryptedBytes | No | ||
| diagnosticCount | No | ||
| diagnosticCounts | No | Occurrences per diagnostic code. | |
| diagnosticsTruncated | No | true when distinct diagnostics beyond the 200 listed were dropped. |