Which "point" should I serialize? affine? compressed? encoded?

[edgarogh]

Hello,

Just to make it clear, I know approximately nothing about EC cryptography and what every notion means. I'm currently implementing a subset of Google UKey2, for an open source project I'm making, to interface with hardware.

Basically, I have a keypair and want to store the public key inside this protobuf structure:

// A convenience proto for encoding NIST P-256 elliptic curve public keys
message EcP256PublicKey {
  // x and y are encoded in big-endian two's complement (slightly wasteful)
  // Client MUST verify (x,y) is a valid point on NIST P256
  required bytes x = 1;
  required bytes y = 2;
}

^{FYI, bytes represents a raw byte array, like a &[u8] or Vec<u8> depending on the context. I'm comfortable with Rust, so I'll be able to work from any kind of similar type.}

The issue is, I know nothing about ECC and the p256 crate has 3 kinds of "points" that can be obtained from a PK:

• Affine points
• Compressed affine points
• Encoded points

Which one is the one that Google probably expects from their spec?

Thank you very much in advance!

[tarcieri]

For what you're doing you'll need EncodedPoint, in particular EncodedPoint::coordinates.

[edgarogh]

So that actually didn't work. I found a Java implementation which clearly tries to serialize the affine point, but the Rust library doesn't expose the coordinates for reasons I lack the knowledge to understand.

I'll give up RustCrypto and do the PK crypto with a Java worker, that'll be slower and harder to maintain, but I lost too many hours just trying to serialize a public key.

Thank you anyway for trying to help, I really appreciate it.

[tarcieri]

Can you post the code you're having trouble with?

Coordinate access is a longstanding issue. See zkcrypto/group#30

[edgarogh]

Basically, here's what I want to implement in Rust; I need the two last arrays I'm printing (affine X and Y) for serializing:

Minimal Java code

import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.interfaces.ECPrivateKey;
import java.security.interfaces.ECPublicKey;
import java.security.spec.ECGenParameterSpec;

import java.util.Arrays;

public class Main {
  public static void main(String[] args) throws Exception {
    KeyPairGenerator gen = KeyPairGenerator.getInstance("EC");
    gen.initialize(new ECGenParameterSpec("secp256r1"));
    KeyPair keyPair = gen.generateKeyPair();

    ECPrivateKey privateKey = (ECPrivateKey) keyPair.getPrivate();
    ECPublicKey publicKey = (ECPublicKey) keyPair.getPublic();

    System.out.print("privateKey.getS().toByteArray() = ");
    System.out.println(Arrays.toString(privateKey.getS().toByteArray()));
    
    System.out.print("publicKey.getW().getAffineX().toByteArray() = ");
    System.out.println(Arrays.toString(publicKey.getW().getAffineX().toByteArray()));
    
    System.out.print("publicKey.getW().getAffineY().toByteArray() = ");
    System.out.println(Arrays.toString(publicKey.getW().getAffineY().toByteArray()));
  }
}

You can run it on https://www.jdoodle.com/online-java-compiler/ for instance (tested w/ Java 17).

Here's the output of one run:

privateKey.getS().toByteArray() = [0, -8, -77, 99, 95, -14, 45, -75, -55, 87, -43, 68, -81, 97, 123, -120, 36, 112, -50, 2, 31, -15, 59, -13, -28, 70, 73, -22, 15, -128, -120, -122, -16]
publicKey.getW().getAffineX().toByteArray() = [0, -50, 42, -6, -28, 74, -78, -58, -72, -114, -109, 31, -81, -39, 102, 43, 99, 97, 11, -71, -12, -55, 117, 113, 109, 86, -32, 97, 41, 116, -94, 66, -115]
publicKey.getW().getAffineY().toByteArray() = [48, 70, 20, -39, -125, 24, -114, 126, 53, -36, -82, 45, -3, 125, 112, -67, 79, -3, -34, 16, 7, 96, 107, -38, 13, -27, -118, 93, 10, 41, 71, -36]

The public key S and affine X are 33 bytes long, the affine Y is 32 bytes long.
Here are the docs for ECPublicKey and ECPoint.

But seriously, I don't wan't to bother you too much, I'll manage to find other ways to do what I want to do if I have to.

[tarcieri]

You can look at the JWK serializer as an example. This one encodes the coordinates from an EncodedPoint: https://github.com/RustCrypto/traits/blob/master/elliptic-curve/src/jwk.rs#L121-L135

You can obtain an EncodedPoint by using the ToEncodedPoint trait which is impl'd for p256::{AffinePoint, ProjectivePoint}. Pass false as the compress flag.

[edgarogh]

It works!

I had tried what you were suggesting previously, but the device I was communicating with was rejecting the key because the key fields were supposedly negative, so I thought I was doing something wrong. Turns out Java does this super weird thing (at least too a newbie like me) where the private key byte array and public key coordinate byte arrays are 32 bytes long when the first element's MSB is 0, and 33 bytes long with a preceding zero when the MSB is 1. In other words, if the first byte (signed) is negative, then the array starts with an additional 0 byte. You can clearly see this in the 3 byte arrays I sent previously. This also explains why your crates wouldn't let me create a private key from a 33 byte-long slice and why it always gives 32 byte-long coordinates.

I wrote a little unit test based on the values in my above test run in Java, taking in account my findings, and surely, your crates give me the same results as the Java reference implementation. 🎉

Now, I just need to apply the reverse transformation when passing the coordinate byte arrays to protobuf, as the other peer expects them in the "Java format".