question: public static PrivateKey loadEncrypted ( InputStream is , Password password ) throws CryptoException , IOException { byte [ ] streamContents = ReadUtil . readFully ( is ) ; EncryptionType encType = getEncryptionType ( new ByteArrayInputStream ( streamContents ) ) ; if ( encType == null ) { throw new CryptoException ( res . getString ( "NotValidPkcs8.exception.message" ) ) ; } if ( encType == UNENCRYPTED ) { throw new PrivateKeyUnencryptedException ( res . getString ( "Pkcs8IsUnencrypted.exception.message" ) ) ; } byte [ ] encPvk = null ; PemInfo pemInfo = PemUtil . decode ( new ByteArrayInputStream ( streamContents ) ) ; if ( pemInfo != null ) { encPvk = pemInfo . getContent ( ) ; } if ( encPvk == null ) { encPvk = streamContents ; } try { EncryptedPrivateKeyInfo epki = new EncryptedPrivateKeyInfo ( encPvk ) ; String encAlg = epki . getAlgName ( ) ; if ( ! checkSupportedForDecrypt ( encAlg ) ) { throw new PrivateKeyPbeNotSupportedException ( encAlg , MessageFormat . format ( res . getString ( "PrivateKeyWrappingAlgUnsupported.exception.message" ) , encAlg ) ) ; } AlgorithmParameters encAlgParams = epki . getAlgParameters ( ) ; PBEKeySpec pbeKeySpec = new PBEKeySpec ( password . toCharArray ( ) ) ; SecretKeyFactory keyFact = SecretKeyFactory . getInstance ( encAlg ) ; SecretKey pbeKey = keyFact . generateSecret ( pbeKeySpec ) ; Cipher cipher = Cipher . getInstance ( encAlg ) ; cipher . init ( Cipher . DECRYPT_MODE , pbeKey , encAlgParams ) ; PKCS8EncodedKeySpec privateKeySpec = epki . getKeySpec ( cipher ) ; byte [ ] pvkBytes = privateKeySpec . getEncoded ( ) ; String privateKeyAlgorithm = getPrivateKeyAlgorithm ( pvkBytes ) ; KeyFactory keyFactory = KeyFactory . getInstance ( privateKeyAlgorithm ) ; PrivateKey pvk = keyFactory . generatePrivate ( privateKeySpec ) ; return pvk ; } catch ( GeneralSecurityException ex ) { throw new CryptoException ( res . getString ( "NoLoadPkcs8PrivateKey.exception.message" ) , ex ) ; } }
target:  Load an encrypted PKCS #8 private key from the specified stream. The encoding of the private key may be PEM or DER.