code: def jks_pkey_decrypt(data, password_str):
      
      password_bytes = password_str.encode('utf-16be') # Java chars are UTF-16BE code units
  
      data = bytearray(data)
      iv, data, check = data[:20], data[20:-20], data[-20:]
      xoring = zip(data, _jks_keystream(iv, password_bytes))
      key = bytearray([d^k for d,k in xoring])
  
      if hashlib.sha1(bytes(password_bytes + key)).digest() != check:
          raise BadHashCheckException("Bad hash check on private key; wrong password?")
      key = bytes(key)
      return key
docs: Decrypts the private key password protection algorithm used by JKS keystores.
      The JDK sources state that 'the password is expected to be in printable ASCII', though this does not appear to be enforced;
      the password is converted into bytes simply by taking each individual Java char and appending its raw 2-byte representation.
      See sun/security/provider/KeyProtector.java in the JDK sources.