@@ -305,17 +305,26 @@ def to_bytes_ecdsa_raw(self) -> bytes:
305305 raise ValueError ("Not an ECDSA key." )
306306 return self ._private_key .private_numbers ()\
307307 .private_value .to_bytes (32 , "big" )
308-
308+
309309 def to_bytes_der (self ) -> bytes :
310310 """
311311 Return the DER-encoded private key.
312312 """
313- return self ._private_key .private_bytes (
314- encoding = serialization .Encoding .DER ,
315- format = serialization .PrivateFormat .TraditionalOpenSSL ,
316- encryption_algorithm = serialization .NoEncryption ()
317- )
318-
313+ if self .is_ed25519 ():
314+ # Ed25519 only supports PKCS#8 for DER exports
315+ return self ._private_key .private_bytes (
316+ encoding = serialization .Encoding .DER ,
317+ format = serialization .PrivateFormat .PKCS8 ,
318+ encryption_algorithm = serialization .NoEncryption ()
319+ )
320+ else :
321+ # ECDSA can be exported in Traditional OpenSSL or PKCS#8
322+ return self ._private_key .private_bytes (
323+ encoding = serialization .Encoding .DER ,
324+ format = serialization .PrivateFormat .TraditionalOpenSSL ,
325+ encryption_algorithm = serialization .NoEncryption ()
326+ )
327+
319328 def to_string_raw (self ) -> str :
320329 return self .to_bytes_raw ().hex ()
321330
0 commit comments