Allow loading (compressed) SEC.1-encoded ECC keys via FFI and Python - #5083
Merged
reneme merged 4 commits intoSep 1, 2025
Merged
Conversation
reneme
force-pushed
the
feature/load_compressed_ecc_key
branch
from
August 29, 2025 14:11
b0321ed to
d173533
Compare
arckoor
reviewed
Aug 29, 2025
randombit
reviewed
Aug 29, 2025
This allows loading ECDH, ECDSA, and SM2 public keys that are encoded in SEC1 format (both compressed and uncompressed). Without that, there's no convenient way to load compressed SEC1 encoded ECC public keys. For uncompressed points one could have manually parse the coordinates and pass them into botan_pubkey_load_ec*_load().
reneme
force-pushed
the
feature/load_compressed_ecc_key
branch
from
September 1, 2025 07:13
d173533 to
6babfa3
Compare
randombit
approved these changes
Sep 1, 2025
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Desired Use Case Description
Currently, loading a SEC.1 encoded ECC key doesn't seem to be possible conveniently via the FFI. It provides two suitable functions:
botan_pubkey_load()which expects a PEM container and the low-levelbotan_pubkey_load_ecdh()which requires both coordinates of the public point. Unfortunately in my use case I only have a compressed SEC.1 encoding of an ECDH public key, so*_load_ecdh()is not really feasible. As a work-around I am wrapping this encoding into a PEM container by hard-coding the ASN.1 prologue for my curve. Meh!Changes in this PR
This adds three new FFI functions:
botan_pubkey_load_ecdsa_sec1(),botan_pubkey_load_ecdh_sec1(), andbotan_pubkey_load_sm2_sec1()to facilitate the above-described use case. Also, I exposed them via the Python wrapper likebotan3.PublicKey.load_ecdh_sec1(), ...Also, this PR bumps the FFI API requirement. Which I think is necessary because of the new APIs, right? I refrained from documenting those new functions, given that the existing low-level functions aren't explicitly documented either.
I'm certainly open for better ideas for naming or approach. Or perhaps I missed some way to do that on master?
Edit: Specifically for ECDH, one could drop the serialized compressed public point straight into
PKAgreement.agree()and avoid this problem. For ECDSA that wouldn't work, though.