def _unarmor_pem(data, password=None):
object_type, headers, der_bytes = pem.unarmor(data)<EOL>type_regex = '<STR_LIT>'<EOL>armor_type = re.match(type_regex, object_type)<EOL>if not armor_type:<EOL><INDENT>raise ValueError(pretty_message(<EOL>'''<STR_LIT>'''<EOL>))<EOL><DEDENT>pem_header = armor_type.group(<NUM_LIT:1>)<EOL>data = data.strip()<EOL>if pem_header in set(['<STR_LIT>', '<STR_LIT>', '<STR_LIT>']):<EOL><INDENT>algo = armor_type.group(<NUM_LIT:2>).lower()<EOL>return ('<STR_LIT>', algo, _unarmor_pem_openssl_private(headers, der_bytes, password))<EOL><DEDENT>key_type = pem_header.lower()<EOL>algo = None<EOL>if key_type == '<STR_LIT>':<EOL><INDENT>key_type = '<STR_LIT>'<EOL><DEDENT>elif key_type == '<STR_LIT>':<EOL><INDENT>key_type = '<STR_LIT>'<EOL>algo = '<STR_LIT>'<EOL><DEDENT>return (key_type, algo, der_bytes)<EOL>
Removes PEM-encoding from a public key, private key or certificate. If the
private key is encrypted, the password will be used to decrypt it.

:param data:
    A byte string of the PEM-encoded data

:param password:
    A byte string of the encryption password, or None

:return:
    A 3-element tuple in the format: (key_type, algorithm, der_bytes). The
    key_type will be a unicode string of "public key", "private key" or
    "certificate". The algorithm will be a unicode string of "rsa", "dsa"
    or "ec".