4

I'm working on a program in which I would like to generate an ECDSA key with OpenSSL's libcrypto EVP API. I found this piece of documentation that deals with this topic.

When specifying the key type, there is no EVP_PKEY_ECDSA, only EVP_PKEY_EC. The documentation says this is for ECDSA and ECDH keys.

However the parameter generation function EVP_PKEY_CTX_set_ec_paramgen_curve_nid only takes a curve NID (name of the used elliptic curve in OpenSSL). There is no way to tell this function that I want an ECDSA key. According to this documentation, there is no other EVP_PKEY_CTX_set_ec_ function, either.

I'm not an expert in cryptography, so I may not understand correctly.

Is an EC key the same as an ECDSA or ECDH key? The OpenSSL docs and terminology definitely suggest that, but do not say it explicitly. If they are not the same, how can I make sure to generate an ECDSA key?

Venemo
  • 18,515
  • 13
  • 84
  • 125

1 Answers1

3

Edit: didn't notice before answering, but near dupe Is there a difference between ECDH and ECDSA keys?

For Weierstrass curves, yes the same EC keypair can be used for either ECDSA or ECDH. (Or both, but that's not best practice, because in general you should not use one key for different purposes and signing and keyagreement are different purposes.) That same keypair can also be used for other elliptic-curve algorithms like ECMQV in things that implement those algorithms -- which OpenSSL doesn't.

If you use the key in conjunction with a certificate, which SSL/TLS protocols and CMS and S/MIME messages among other things do, then the certificate can impose restrictions on which operations (thus algorithms) use the key. But not everything uses certificates, and for those that do, nothing technically prevents you from having multiple certificates with different keyusage for the same key.

Bernstein's 'curve25519' uses different keys and algorithms, and is handled as a special case.

dave_thompson_085
  • 34,712
  • 6
  • 50
  • 70
  • Thanks Dave, this clears things up for me! One more thing: which are the Weierstrass curves? – Venemo Mar 24 '18 at 14:31
  • 1
    @Venemo For OpenSSL purposes, all but 25519 are Weierstrass. When X9/NIST/Certicom first standardized ECC ca 1999 they picked Weierstrass, and the first main competitor (Brainpool) didn't try to change it, so all of those curves are Weierstrass. Others have proposed alternatives, but none besides Bernstein has gotten any real acceptance. For his (rather dense) take on the situation see https://safecurves.cr.yp.to/equation.html – dave_thompson_085 Mar 26 '18 at 08:43