Debian GNU/Linux 11
openjdk version "1.8.0_302"
OpenJDK Runtime Environment (build 1.8.0_302-b08)
OpenJDK 64-Bit Server VM (build 25.302-b08, mixed mode)
jcp-2.0.41789

# openssl ciphers | tr ':' '\n' | grep GOST
GOST2012-GOST8912-GOST8912
GOST2001-GOST89-GOST89
// Создание ключей по алгоритму подписи 1.2.643.7.1.1.3.2 (ГОСТ Р 34.11-2012/34.10-2012 256 бит)
# openssl req -x509 -newkey gost2012_256 -pkeyopt paramset:A -nodes -keyout keyA.pem -out certA.pem
# openssl x509 -outform der -in certA.pem -out certA.crt

# java -cp .:dependencies/* PKeyReader /distrib/cert/test/keyA.pem 1.2.643.7.1.1.1.1 BC certA.zip (2kb) загружен 0 раз(а).
+ key factory: java.security.KeyFactory@340f438e
 algorithm: 1.2.643.7.1.1.1.1
 provider: BC version 1.6
+ pkcs8 encoded key spec: java.security.spec.PKCS8EncodedKeySpec@30c7da1e
 format: PKCS#8
Exception in thread "main" java.security.spec.InvalidKeySpecException: encoded key spec not recognized: DEF length 39 object truncated by 9
        at org.bouncycastle.jcajce.provider.asymmetric.util.BaseKeyFactorySpi.engineGeneratePrivate(Unknown Source)
        at org.bouncycastle.jcajce.provider.asymmetric.ecgost12.KeyFactorySpi.engineGeneratePrivate(Unknown Source)
        at java.security.KeyFactory.generatePrivate(KeyFactory.java:366)
        at PKeyReader.main(PKeyReader.java:62)

import org.bouncycastle.jce.provider.BouncyCastleProvider;

import java.io.IOException;
import java.net.URISyntaxException;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.security.Security;
import java.security.KeyFactory;
import java.security.NoSuchAlgorithmException;
import java.security.PrivateKey;
import java.security.interfaces.RSAPublicKey;
import java.security.spec.InvalidKeySpecException;
import java.security.spec.PKCS8EncodedKeySpec;
import java.security.spec.X509EncodedKeySpec;
import java.util.Base64;

/**
 * Чтение закрытого ключа из файла.
 */
public class PKeyReader {

    /**
    * Попытка прочитать закрытый ключ из файла
    * @param 	путь к ключу
    * @param	алгоритм
    * @param	провайдер (опциональный)
    */
  public static void main(String[] args) throws Exception {
    if (args.length < 2) {
      System.out.println("input error: skipped required parameters.");
      System.out.println("  java .:dependences/* Main [key path] [algorithm] {provider}");
      return;
    }

    Security.addProvider(new BouncyCastleProvider());

    String privateKeyPath = args[0];
    String algorithm = args[1];
    String provider = args.length > 2 ? args[2] : "";

    String privateKeyContent = new String(Files.readAllBytes(Paths.get(privateKeyPath)));

    privateKeyContent = privateKeyContent.replace("-----BEGIN PRIVATE KEY-----", "").replace("-----END PRIVATE KEY-----", "").replaceAll("\\s", "");

    System.out.println(privateKeyContent);

    KeyFactory kf = null;
    if (provider.isEmpty())
      kf = KeyFactory.getInstance(algorithm);
    else
      kf = KeyFactory.getInstance(algorithm, provider);

    System.out.println("+ key factory: " + kf);
    System.out.println(" algorithm: " + kf.getAlgorithm());
    System.out.println(" provider: " + kf.getProvider());

    byte[] privData = Base64.getDecoder().decode(privateKeyContent);
    PKCS8EncodedKeySpec keySpecPKCS8 = new PKCS8EncodedKeySpec(privData);
    System.out.println("+ pkcs8 encoded key spec: " + keySpecPKCS8);
    System.out.println(" format: " + keySpecPKCS8.getFormat());

    PrivateKey privKey = kf.generatePrivate(keySpecPKCS8);

    System.out.println("+ private key: " + privKey);
  }
}