x509.ParsePKIXPublicKey failed to parse X.509 DER format public key

[xrfang]

Go version

go version go1.22.5 linux/amd64

Output of go env in your module/workspace:

GO111MODULE='on'
GOARCH='amd64'
GOBIN=''
GOCACHE='/home/xrfang/.cache/go-build'
GOENV='/home/xrfang/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMODCACHE='/home/xrfang/go/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/home/xrfang/go'
GOPRIVATE=''
GOPROXY='https://goproxy.cn,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.22.5'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='gcc'
CXX='g++'
CGO_ENABLED='1'
GOMOD='/home/xrfang/git/cluster/go.mod'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build178794489=/tmp/go-build -gno-record-gcc-switches'

What did you do?

I am writing a program doing ECDH with a C client, which uses WolfSSL.

What did you see happen?

Key exchange procedure failed at:

pub, err := x509.ParsePKIXPublicKey(data)

Error message is:

asn1: structure error: tags don't match (16 vs {class:3 tag:2097151 length:0 isCompound:true}) {optional:false explicit:false application:false private:false defaultValue: tag: stringType:0 timeType:0 set:false omitEmpty:false} publicKeyInfo @5

What did you expect to see?

The key should be OK, because OpenSSL said so:

$ openssl ec -in pubkey.der -inform DER -pubin -text -noout
read EC key
Public-Key: (256 bit)
pub:
04:6b:3f:2b:d2:5f:1d:d0:05:98:37:dc:92:8e:4e:
5d:f5:32:af:57:d0:e8:53:17:10:2f:61:32:52:b5:
b1:25:e1:0f:7e:91:e1:e1:07:31:a5:ba:f9:9f:16:
8c:da:35:c0:80:6f:ec:9f:2d:a9:d7:09:7a:46:86:
52:60:d5:6d:52
ASN1 OID: prime256v1
NIST CURVE: P-256

pubkey.x509.gz

[gabyhelp]

Related Issues and Documentation

• crypto/x509: ParsePKCS1PublicKey expects invalid key format #29141 (closed)
• crypto/x509: ParsePKIXPublicKey can not parse 1024bit RSA #23032 (closed)
• crypto/x509:x509.ParsePKCS1PrivateKey pkcs1 length 2048 error #33241 (closed)
• x/crypto/ssh: unable to parse certificates #45010 (closed)
• Package x509 > func ParsePKIXPublicKey ¶
• crypto/x509: ParseCertificate fails for ECDSA certificate, gives asn1 unmarshal error #21502 (closed)
• crypto/tls: LoadX509KeyPair fails to parse some keys, yet they are accepted by OpenSSL #21807 (closed)
• crypto/x509: failed to parse ECDSA256 PEM generated by Apple Developer Website #33560 (closed)
• crypto/x509: failed to parse X509 certificate #52742 (closed)
• crypto/x509: ParsePKCS1PrivateKey is not complaint with PKCS#1 standard #14512 (closed)

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[xrfang]

The data has some extra bytes before x509 evelope, it is weired that openssl happily decoded it!