1658992 - Add mechanism for generating an EC keypair from a raw private key value

Status: RESOLVED WONTFIX

(NSS :: Libraries, enhancement, P2)

Description

[Kevin Jacobs [:kjacobs]]

https://tools.ietf.org/html/draft-irtf-cfrg-hpke-05 specifies a DeriveKeyPair method that constructs an EC keypair from HKDF output (which becomes the private key). Unfortunately, the existing Import mechanisms seem to all require the public to also be provided.

Exposing EC_NewKeyFromSeed through a custom PK11 mechanism will meet the need of generating the public key and converting both to SECKEY objects.

Comment 1

[Kevin Jacobs [:kjacobs]]

Attachment: Bug 1658992 - Add CKM_NSS_EC_KEY_PAIR_GEN_FROM_SEED for HPKE DeriveKeyPair.

Comment 2

[Kevin Jacobs [:kjacobs]]

ECH doesn't need this API. Given that its only use case would be to exercise HPKE test vectors, it doesn't seem worth the complexiity and technical debt of a new vendor mechanism. We can instead instantiate HPKE test vectors with the DKP outputs.