### Manage Default Encryption Options in pkcs8 (Go)

Source: https://context7.com/youmark/pkcs8/llms.txt

Demonstrates how to view and modify the global default encryption options for the pkcs8 package. It shows the initial defaults and how to update them for stronger security before encrypting an RSA private key. The example also verifies that the encrypted key can be parsed successfully.

```go
package main

import (
	"crypto"
	"crypto/rsa"
	"crypto/rand"
	"encoding/pem"
	"fmt"
	"log"

	"github.com/youmark/pkcs8"
)

func main() {
	// View current defaults
	fmt.Printf("Default cipher key size: %d bits\n", pkcs8.DefaultOpts.Cipher.KeySize()*8)
	fmt.Printf("Default cipher IV size: %d bytes\n", pkcs8.DefaultOpts.Cipher.IVSize())

	// Modify defaults for stronger security
	pkcs8.DefaultOpts = &pkcs8.Opts{
		Cipher: pkcs8.AES256CBC,
		KDFOpts: pkcs8.PBKDF2Opts{
			SaltSize:       16,            // Larger salt
			IterationCount: 100000,        // More iterations
			HMACHash:       crypto.SHA256,
		},
	}
	fmt.Println("\nDefaults updated to higher security settings")

	// Now ConvertPrivateKeyToPKCS8 uses the new defaults
	rsaKey, _ := rsa.GenerateKey(rand.Reader, 2048)
	der, err := pkcs8.ConvertPrivateKeyToPKCS8(rsaKey, []byte("password"))
	if err != nil {
		log.Fatal(err)
	}

	pemBlock := pem.EncodeToMemory(&pem.Block{
		Type:  "ENCRYPTED PRIVATE KEY",
		Bytes: der,
	})
	fmt.Printf("\nKey encrypted with updated defaults (%d bytes):\n", len(der))
	fmt.Println(string(pemBlock[:120]) + "...")

	// Verify the key can be parsed
	_, err = pkcs8.ParsePKCS8PrivateKey(der, []byte("password"))
	if err != nil {
		log.Fatalf("failed to verify: %v", err)
	}
	fmt.Println("\nKey successfully verified")
}

```

--------------------------------

### Install Dependencies for pkcs8 Package

Source: https://github.com/youmark/pkcs8/blob/master/README.md

These commands retrieve the necessary dependency packages, golang.org/x/crypto/pbkdf2 and golang.org/x/crypto/scrypt, required by the pkcs8 package.

```bash
go get golang.org/x/crypto/pbkdf2
go get golang.org/x/crypto/scrypt
```

--------------------------------

### Install pkcs8 Package

Source: https://github.com/youmark/pkcs8/blob/master/README.md

This command installs the pkcs8 package for Go versions 1.10 and later. For Go 1.9, release v1.1 is the last compatible version.

```bash
go get github.com/youmark/pkcs8
```

--------------------------------

### PKCS#8 Encryption with Scrypt (Go)

Source: https://context7.com/youmark/pkcs8/llms.txt

Demonstrates encrypting an ECDSA private key using the scrypt key derivation function. It shows how to configure scrypt parameters like salt size, cost parameter (N), block size (r), and parallelization (p) for enhanced resistance against hardware brute-force attacks. The example also includes parsing the scrypt-encrypted key back.

```Go
package main

import (
	"crypto/ecdsa"
	"crypto/elliptic"
	"crypto/rand"
	"encoding/pem"
	"fmt"
	"log"

	"github.com/youmark/pkcs8"
)

func main() {
	ecKey, _ := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	password := []byte("password")

	// Scrypt with recommended parameters for high security
	opts := &pkcs8.Opts{
		Cipher: pkcs8.AES256CBC,
		KDFOpts: pkcs8.ScryptOpts{
			SaltSize:                 16,    // 16 bytes random salt
			CostParameter:            16384, // N = 2^14 (memory cost)
			BlockSize:                8,     // r = 8 (block size)
			ParallelizationParameter: 1,     // p = 1 (parallelization)
		},
	}

	der, err := pkcs8.MarshalPrivateKey(ecKey, password, opts)
	if err != nil {
		log.Fatal(err)
	}

	pemBlock := pem.EncodeToMemory(&pem.Block{
		Type:  "ENCRYPTED PRIVATE KEY",
		Bytes: der,
	})
	fmt.Printf("Scrypt encrypted ECDSA key (%d bytes):\n", len(der))
	fmt.Println(string(pemBlock))

	// Parse scrypt-encrypted key
	parsed, kdfParams, err := pkcs8.ParsePrivateKey(der, password)
	if err != nil {
		log.Fatalf("failed to parse: %v", err)
	}

	parsedEC := parsed.(*ecdsa.PrivateKey)
	fmt.Printf("Parsed key curve: %s\n", parsedEC.Curve.Params().Name)
	fmt.Printf("KDF params present: %v\n", kdfParams != nil)
	// Output:
	// Parsed key curve: P-256
	// KDF params present: true
}
```

--------------------------------

### PKCS#8 Encryption with PBKDF2 (Go)

Source: https://context7.com/youmark/pkcs8/llms.txt

Illustrates encrypting an RSA private key using the PBKDF2 key derivation function with SHA-256 and SHA-1. It shows how to configure salt size, iteration count, and HMAC hash function for PBKDF2. The example also verifies that both SHA-256 and SHA-1 encrypted keys can be parsed back successfully.

```Go
package main

import (
	"crypto"
	"crypto/rsa"
	"crypto/rand"
	"encoding/pem"
	"fmt"
	"log"

	"github.com/youmark/pkcs8"
)

func main() {
	rsaKey, _ := rsa.GenerateKey(rand.Reader, 2048)
	password := []byte("strongpassword")

	// PBKDF2 with SHA-256 (recommended)
	opts := &pkcs8.Opts{
		Cipher: pkcs8.AES256CBC,
		KDFOpts: pkcs8.PBKDF2Opts{
			SaltSize:       16,            // 16 bytes salt
			IterationCount: 100000,        // High iteration count for security
			HMACHash:       crypto.SHA256, // SHA-256 HMAC
		},
	}

	der, err := pkcs8.MarshalPrivateKey(rsaKey, password, opts)
	if err != nil {
		log.Fatal(err)
	}

	pemBlock := pem.EncodeToMemory(&pem.Block{
		Type:  "ENCRYPTED PRIVATE KEY",
		Bytes: der,
	})
	fmt.Printf("PBKDF2-SHA256 encrypted key (%d bytes):\n", len(der))
	fmt.Println(string(pemBlock[:150]) + "...")

	// PBKDF2 with SHA-1 (for compatibility with older systems)
	optsLegacy := &pkcs8.Opts{
		Cipher: pkcs8.AES128CBC,
		KDFOpts: pkcs8.PBKDF2Opts{
			SaltSize:       8,
			IterationCount: 2048,
			HMACHash:       crypto.SHA1,
		},
	}
	derLegacy, _ := pkcs8.MarshalPrivateKey(rsaKey, password, optsLegacy)
	fmt.Printf("\nPBKDF2-SHA1 encrypted key (%d bytes)\n", len(derLegacy))

	// Verify both can be parsed back
	_, err = pkcs8.ParsePKCS8PrivateKey(der, password)
	if err != nil {
		log.Fatalf("SHA256 round-trip failed: %v", err)
	}
	_, err = pkcs8.ParsePKCS8PrivateKey(derLegacy, password)
	if err != nil {
		log.Fatalf("SHA1 round-trip failed: %v", err)
	}
	fmt.Println("\nBoth keys successfully parsed back")
}
```

--------------------------------

### PKCS#8 Encryption with Various Ciphers (Go)

Source: https://context7.com/youmark/pkcs8/llms.txt

Demonstrates encrypting an RSA private key using different cipher options (AES-CBC, AES-GCM, Triple DES-CBC) provided by the pkcs8 package. It shows how to configure cipher and key derivation options and prints details about the resulting encrypted key.

```Go
package main

import (
	"crypto"
	"crypto/rsa"
	"crypto/rand"
	"encoding/pem"
	"fmt"
	"log"

	"github.com/youmark/pkcs8"
)

func main() {
	rsaKey, _ := rsa.GenerateKey(rand.Reader, 2048)
	password := []byte("secret")

	// Available ciphers:
	ciphers := []struct {
		name   string
		cipher pkcs8.Cipher
	}{
		{"AES-128-CBC", pkcs8.AES128CBC},
		{"AES-192-CBC", pkcs8.AES192CBC},
		{"AES-256-CBC", pkcs8.AES256CBC},
		{"AES-128-GCM", pkcs8.AES128GCM},
		{"AES-192-GCM", pkcs8.AES192GCM},
		{"AES-256-GCM", pkcs8.AES256GCM},
		{"3DES-CBC", pkcs8.TripleDESCBC},
	}

	for _, c := range ciphers {
		opts := &pkcs8.Opts{
			Cipher: c.cipher,
			KDFOpts: pkcs8.PBKDF2Opts{
				SaltSize:       8,
				IterationCount: 10000,
				HMACHash:       crypto.SHA256,
			},
		}
		der, err := pkcs8.MarshalPrivateKey(rsaKey, password, opts)
		if err != nil {
			log.Fatalf("failed with %s: %v", c.name, err)
		}
		fmt.Printf("%s: key size=%d, IV size=%d, output=%d bytes\n",
			c.name, c.cipher.KeySize(), c.cipher.IVSize(), len(der))
	}
	// Output:
	// AES-128-CBC: key size=16, IV size=16, output=1312 bytes
	// AES-192-CBC: key size=24, IV size=16, output=1312 bytes
	// AES-256-CBC: key size=32, IV size=16, output=1312 bytes
	// AES-128-GCM: key size=16, IV size=16, output=1312 bytes
	// AES-192-GCM: key size=24, IV size=16, output=1312 bytes
	// AES-256-GCM: key size=32, IV size=16, output=1312 bytes
	// 3DES-CBC: key size=24, IV size=8, output=1304 bytes
}
```

--------------------------------

### Register Custom Cipher Implementation in Go

Source: https://context7.com/youmark/pkcs8/llms.txt

Demonstrates how to register a custom cipher implementation for PKCS#8 keys. This involves defining a struct that satisfies the pkcs8.Cipher interface and then registering it using its OID. The custom cipher can then be used for encryption and decryption.

```go
package main

import (
	"crypto/aes"
	"crypto/cipher"
	"encoding/asn1"
	"fmt"

	"github.com/youmark/pkcs8"
)

// Example: Register a custom cipher (demonstrating the interface)
type customCipher struct{}

func (c customCipher) IVSize() int                                { return aes.BlockSize }
func (c customCipher) KeySize() int                               { return 32 }
func (c customCipher) OID() asn1.ObjectIdentifier                 { return asn1.ObjectIdentifier{1, 2, 3, 4, 5} }
func (c customCipher) Encrypt(key, iv, plaintext []byte) ([]byte, error) {
	block, _ := aes.NewCipher(key)
	mode := cipher.NewCBCEncrypter(block, iv)
	// Add padding and encrypt...
	ciphertext := make([]byte, len(plaintext))
	mode.CryptBlocks(ciphertext, plaintext)
	return ciphertext, nil
}
func (c customCipher) Decrypt(key, iv, ciphertext []byte) ([]byte, error) {
	block, _ := aes.NewCipher(key)
	mode := cipher.NewCBCDecrypter(block, iv)
	plaintext := make([]byte, len(ciphertext))
	mode.CryptBlocks(plaintext, ciphertext)
	return plaintext, nil
}

func main() {
	// Register custom cipher with its OID
	customOID := asn1.ObjectIdentifier{1, 2, 3, 4, 5}
	pkcs8.RegisterCipher(customOID, func() pkcs8.Cipher {
		return customCipher{}
	})

	fmt.Println("Custom cipher registered successfully")
	fmt.Printf("Cipher OID: %v\n", customOID)
	// The cipher can now be used when parsing PKCS#8 keys encrypted with this OID
}
```

--------------------------------

### Register Custom KDF Implementation in Go

Source: https://context7.com/youmark/pkcs8/llms.txt

Illustrates how to register a custom Key Derivation Function (KDF) for PKCS#8 keys. This involves defining a struct that implements the pkcs8.KDFParameters interface and then registering it with its corresponding OID. This allows the library to use the custom KDF when processing keys.

```go
package main

import (
	"encoding/asn1"
	"fmt"

	"github.com/youmark/pkcs8"
)

// Example: Custom KDF parameters structure
type customKDFParams struct {
	Salt       []byte
	Iterations int
}

func (p customKDFParams) DeriveKey(password []byte, size int) ([]byte, error) {
	// Custom key derivation logic here
	// This is a simplified example - real implementations should use proper KDFs
	key := make([]byte, size)
	for i := 0; i < size && i < len(password); i++ {
		key[i] = password[i] ^ p.Salt[i%len(p.Salt)]
	}
	return key, nil
}

func main() {
	// Register custom KDF with its OID
	customOID := asn1.ObjectIdentifier{1, 2, 3, 4, 6}
	pkcs8.RegisterKDF(customOID, func() pkcs8.KDFParameters {
		return new(customKDFParams)
	})

	fmt.Println("Custom KDF registered successfully")
	fmt.Printf("KDF OID: %v\n", customOID)
	// The KDF can now be used when parsing PKCS#8 keys that use this OID
}
```

--------------------------------

### Convert Private Key to PKCS#8 Format (Go)

Source: https://context7.com/youmark/pkcs8/llms.txt

A convenience function to convert RSA or ECDSA private keys into PKCS#8 format. When a password is provided, it uses default encryption options (AES-256-CBC with PBKDF2). This function is a wrapper around MarshalPrivateKey with pre-configured defaults.

```go
package main

import (
	"crypto/ecdsa"
	"crypto/elliptic"
	"crypto/rand"
	"crypto/rsa"
	"encoding/pem"
	"fmt"
	"log"

	"github.com/youmark/pkcs8"
)

func main() {
	// Convert RSA key to unencrypted PKCS#8
	rsaKey, _ := rsa.GenerateKey(rand.Reader, 2048)
	der, err := pkcs8.ConvertPrivateKeyToPKCS8(rsaKey)
	if err != nil {
		log.Fatalf("failed to convert: %v", err)
	}
	pemBlock := pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: der})
	fmt.Println("RSA key in PKCS#8 format:")
	fmt.Println(string(pemBlock[:100]) + "...")

	// Convert ECDSA key to encrypted PKCS#8 (uses default AES-256-CBC + PBKDF2)
	ecKey, _ := ecdsa.GenerateKey(elliptic.P384(), rand.Reader)
	der, err = pkcs8.ConvertPrivateKeyToPKCS8(ecKey, []byte("mypassword"))
	if err != nil {
		log.Fatalf("failed to convert: %v", err)
	}
	pemBlock = pem.EncodeToMemory(&pem.Block{Type: "ENCRYPTED PRIVATE KEY", Bytes: der})
	fmt.Println("\nECDSA P-384 key encrypted with default options:")
	fmt.Println(string(pemBlock[:100]) + "...")

	// Verify round-trip
	parsed, err := pkcs8.ParsePKCS8PrivateKeyECDSA(der, []byte("mypassword"))
	if err != nil {
		log.Fatalf("failed to parse: %v", err)
	}
	fmt.Printf("\nRound-trip successful, curve: %s\n", parsed.Curve.Params().Name)
	// Output: Round-trip successful, curve: P-384
}

```

--------------------------------

### Marshal Private Key to PKCS#8 DER Format (Go)

Source: https://context7.com/youmark/pkcs8/llms.txt

Encodes a private key (RSA or ECDSA) into DER-encoded PKCS#8 format. Supports optional encryption using specified cipher and KDF options. When no password or options are provided, it marshals as unencrypted PKCS#8.

```go
package main

import (
	"crypto"
	"crypto/ecdsa"
	"crypto/elliptic"
	"crypto/rand"
	"crypto/rsa"
	"encoding/pem"
	"fmt"
	"log"

	"github.com/youmark/pkcs8"
)

func main() {
	// Generate an RSA key
	rsaKey, _ := rsa.GenerateKey(rand.Reader, 2048)

	// Marshal as unencrypted PKCS#8
	der, err := pkcs8.MarshalPrivateKey(rsaKey, nil, nil)
	if err != nil {
		log.Fatalf("failed to marshal: %v", err)
	}
	pemBlock := pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: der})
	fmt.Println("Unencrypted PKCS#8:")
	fmt.Println(string(pemBlock[:80]) + "...")

	// Marshal with AES-256-CBC encryption and PBKDF2
	opts := &pkcs8.Opts{
		Cipher: pkcs8.AES256CBC,
		KDFOpts: pkcs8.PBKDF2Opts{
			SaltSize:       16,
			IterationCount: 10000,
			HMACHash:       crypto.SHA256,
		},
	}

der, err = pkcs8.MarshalPrivateKey(rsaKey, []byte("strongpassword"), opts)
	if err != nil {
		log.Fatalf("failed to marshal encrypted: %v", err)
	}
	pemBlock = pem.EncodeToMemory(&pem.Block{Type: "ENCRYPTED PRIVATE KEY", Bytes: der})
	fmt.Println("\nEncrypted PKCS#8 (AES-256-CBC + PBKDF2):")
	fmt.Println(string(pemBlock[:80]) + "...")

	// Marshal ECDSA key with scrypt KDF
	ecKey, _ := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	scryptOpts := &pkcs8.Opts{
		Cipher: pkcs8.AES256CBC,
		KDFOpts: pkcs8.ScryptOpts{
			SaltSize:                 16,
			CostParameter:            16384,
			BlockSize:                8,
			ParallelizationParameter: 1,
		},
	}

der, err = pkcs8.MarshalPrivateKey(ecKey, []byte("password"), scryptOpts)
	if err != nil {
		log.Fatalf("failed to marshal with scrypt: %v", err)
	}
	pemBlock = pem.EncodeToMemory(&pem.Block{Type: "ENCRYPTED PRIVATE KEY", Bytes: der})
	fmt.Println("\nEncrypted PKCS#8 (AES-256-CBC + scrypt):")
	fmt.Println(string(pemBlock[:80]) + "...")
}

```

--------------------------------

### Parse DER-encoded PKCS#8 Private Key (Go)

Source: https://context7.com/youmark/pkcs8/llms.txt

Parses a DER-encoded PKCS#8 private key, optionally decrypting it with a password. It returns the private key, KDF parameters if the key was encrypted, and any encountered error. This function provides more detailed output than a simpler parsing function.

```go
package main

import (
	"crypto/ecdsa"
	"encoding/pem"
	"fmt"
	"log"

	"github.com/youmark/pkcs8"
)

func main() {
	encryptedPEM := `-----BEGIN ENCRYPTED PRIVATE KEY-----
MIHsMFcGCSqGSIb3DQEFDTBKMCkGCSqGSIb3DQEFDDAcBAjVvKZtHlmIbAICCAAw
DAYIKoZIhvcNAgkFADAdBglghkgBZQMEASoEEL3jdkBvObn+QELgKVE2cnMEgZAl
...
-----END ENCRYPTED PRIVATE KEY-----`

	block, _ := pem.Decode([]byte(encryptedPEM))

	// Parse with KDF parameters returned
	privateKey, kdfParams, err := pkcs8.ParsePrivateKey(block.Bytes, []byte("password"))
	if err != nil {
		log.Fatalf("failed to parse: %v", err)
	}

	if kdfParams != nil {
		fmt.Println("Key was encrypted with KDF parameters")
	}

	ecKey := privateKey.(*ecdsa.PrivateKey)
	fmt.Printf("Parsed ECDSA key on curve: %s\n", ecKey.Curve.Params().Name)
	// Output:
	// Key was encrypted with KDF parameters
	// Parsed ECDSA key on curve: P-256
}

```

--------------------------------

### Parse PKCS#8 RSA Private Keys (Go)

Source: https://context7.com/youmark/pkcs8/llms.txt

Convenience function to parse an encrypted or unencrypted PKCS#8 private key directly as an RSA private key using the pkcs8 Go package. It handles decryption if a password is provided. Dependencies include the 'encoding/pem' package and the 'github.com/youmark/pkcs8' package.

```go
package main

import (
	"encoding/pem"
	"fmt"
	"log"

	"github.com/youmark/pkcs8"
)

func main() {
	encryptedPEM := `-----BEGIN ENCRYPTED PRIVATE KEY-----
MIIFHDBOBgkqhkiG9w0BBQ0wQTApBgkqhkiG9w0BBQwwHAQIKXB+OWAc6pwCAggA
MAwGCCqGSIb3DQIJBQAwFAYIKoZIhvcNAwcECCeQ2z+ohlaTBIIEyAbgxv69udAD
...
-----END ENCRYPTED PRIVATE KEY-----`

	block, _ := pem.Decode([]byte(encryptedPEM))

	// Parse directly as RSA key
	rsaKey, err := pkcs8.ParsePKCS8PrivateKeyRSA(block.Bytes, []byte("password"))
	if err != nil {
		log.Fatalf("failed to parse RSA key: %v", err)
	}

	fmt.Printf("RSA modulus size: %d bits\n", rsaKey.N.BitLen())
	fmt.Printf("RSA public exponent: %d\n", rsaKey.E)
	// Output:
	// RSA modulus size: 2048 bits
	// RSA public exponent: 65537
}
```

--------------------------------

### Parse PKCS#8 Private Keys (Go)

Source: https://context7.com/youmark/pkcs8/llms.txt

Parses encrypted or unencrypted private keys in PKCS#8 format using the pkcs8 Go package. When a password is provided, it decrypts the key. It returns the parsed private key, which can be either RSA or ECDSA. Dependencies include the 'crypto/x509' and 'encoding/pem' packages from the Go standard library, along with the 'github.com/youmark/pkcs8' package.

```go
package main

import (
	"crypto/rsa"
	"encoding/pem"
	"fmt"
	"log"

	"github.com/youmark/pkcs8"
)

func main() {
	// Encrypted PKCS#8 private key (AES-256-CBC encrypted)
	encryptedPEM := `-----BEGIN ENCRYPTED PRIVATE KEY-----
MIIFLTBXBgkqhkiG9w0BBQ0wSjApBgkqhkiG9w0BBQwwHAQIrrW09+9XumECAggA
MAwGCCqGSIb3DQIJBQAwHQYJYIZIAWUDBAEqBBAxglavSPtrKNsM9cDXmrS1BIIE
0Gy226c9+zxZ8jUsUIbDdsq1mPbqAWs1xImAj4nA7NMv6G/5QH9CrsmB+4r4GIiy
...
-----END ENCRYPTED PRIVATE KEY-----`

	// Decode PEM block
	block, _ := pem.Decode([]byte(encryptedPEM))
	if block == nil {
		log.Fatal("failed to decode PEM block")
	}

	// Parse encrypted private key with password
	privateKey, err := pkcs8.ParsePKCS8PrivateKey(block.Bytes, []byte("password"))
	if err != nil {
		log.Fatalf("failed to parse private key: %v", err)
	}

	// Type assert to RSA private key
	rsaKey, ok := privateKey.(*rsa.PrivateKey)
	if !ok {
		log.Fatal("not an RSA private key")
	}
	fmt.Printf("RSA key size: %d bits\n", rsaKey.N.BitLen())
	// Output: RSA key size: 2048 bits

	// Parse unencrypted private key (no password needed)
	unencryptedPEM := `-----BEGIN PRIVATE KEY-----
MIIEvQIBADANBgkqhkiG9w0BAQEFAASC...
-----END PRIVATE KEY-----`
	block, _ = pem.Decode([]byte(unencryptedPEM))
	privateKey, err = pkcs8.ParsePKCS8PrivateKey(block.Bytes)
	if err != nil {
		log.Fatalf("failed to parse unencrypted key: %v", err)
	}
}
```

--------------------------------

### Parse PKCS#8 ECDSA Private Keys (Go)

Source: https://context7.com/youmark/pkcs8/llms.txt

Convenience function to parse an encrypted or unencrypted PKCS#8 private key directly as an ECDSA private key using the pkcs8 Go package. It handles decryption if a password is provided. Dependencies include the 'encoding/pem' package and the 'github.com/youmark/pkcs8' package.

```go
package main

import (
	"encoding/pem"
	"fmt"
	"log"

	"github.com/youmark/pkcs8"
)

func main() {
	encryptedPEM := `-----BEGIN ENCRYPTED PRIVATE KEY-----
MIHsMFcGCSqGSIb3DQEFDTBKMCkGCSqGSIb3DQEFDDAcBAjVvKZtHlmIbAICCAAw
DAYIKoZIhvcNAgkFADAdBglghkgBZQMEASoEEL3jdkBvObn+QELgKVE2cnMEgZAl
...
-----END ENCRYPTED PRIVATE KEY-----`

	block, _ := pem.Decode([]byte(encryptedPEM))

	// Parse directly as ECDSA key
	ecdsaKey, err := pkcs8.ParsePKCS8PrivateKeyECDSA(block.Bytes, []byte("password"))
	if err != nil {
		log.Fatalf("failed to parse ECDSA key: %v", err)
	}

	fmt.Printf("ECDSA curve: %s\n", ecdsaKey.Curve.Params().Name)
	fmt.Printf("ECDSA public key X: %s\n", ecdsaKey.X.String()[:20]+"...")
	// Output:
	// ECDSA curve: P-256
	// ECDSA public key X: 63457841261649012...
}
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.