SEC1 EC private keys, the EC PRIVATE KEY encoding

The elliptic-curve private-key encoding of RFC 5915: ECPrivateKey, the EC PRIVATE KEY PEM block OpenSSL writes and appliances still emit. parse reads one into its version, scalar, curve and stored public point, and encode writes it back.

The curve is what fixes the scalar's width, so the parameters field is required here even though the ASN.1 marks it optional: without it there is no width to hold the scalar to, and a scalar of the wrong width is a different key. RFC 5915 sec. 3 states the scalar as ceiling(log2(n)/8) octets with its leading zeros intact, so a short one is refused and never padded into place.

The parameters field carries a named curve and nothing else. RFC 5480 sec. 2.1.1 says a specified curve and an implicit curve MUST NOT appear, and each is refused by name, so the message says which one arrived.

The stored public key is surfaced as the bytes it carries. It is the encoding's own copy of the public half, not the key's identity: a verb that needs that half derives it from the scalar, so a stored point that disagrees cannot decide anything.

pki.schema.sec1.parse

since 0.8.8 stable
pki.schema.sec1.parse(input, opts) -> key

Read an RFC 5915 ECPrivateKey, as DER bytes or an EC PRIVATE KEY PEM block, into { version, privateKey, curve, curveOid, publicKey }. The scalar and the stored point are Buffers, and curve is the registry name of the named curve the key carries.

The parameters field is required, because the curve is what fixes the scalar's width and a scalar of the wrong width is a different key. It carries a named curve and nothing else: a specified curve and an implicit curve are both refused with sec1/bad-curve, which RFC 5480 sec. 2.1.1 states as a MUST NOT.

The stored public key is the encoding's own copy of the public half, not the key's identity. A verb that needs that half derives it from the scalar.

Example

// requires: der -- an ECPrivateKey, from `openssl ecparam -genkey` or an appliance
var key = pki.schema.sec1.parse(der);
key.version;    // 1
key.curve;      // "prime256v1"

See also: pki.schema.sec1.encode, pki.schema.pkcs8.parse

References

pki.schema.sec1.encode

since 0.8.8 stable
pki.schema.sec1.encode(key) -> Buffer

Write an ECPrivateKey back to DER from the shape parse returns, with the parameters field always present, which RFC 5915 sec. 3 asks of a generator. A key read and written again produces the bytes it came from.

Example

// requires: der -- an ECPrivateKey, from `openssl ecparam -genkey` or an appliance
pki.schema.sec1.encode(pki.schema.sec1.parse(der)).equals(der);   // true

See also: pki.schema.sec1.parse

References