Subject: [jose] Question about JWK EC

From: Ludwig Seitz <[email-masked]>
Date: Fri, 24 May 2013 13:22:07 +0200

Hello,

while implementing the JWK EC part of the JOSE draft, I've come across
the following question:

draft-ietf-jose-json-web-algorithms-10

"5.2.2.  JWK Parameters for Elliptic Curve Private Keys

   In addition to the members used to represent Elliptic Curve public
   keys, the following member MUST be present to represent Elliptic
   Curve private keys:"

However an EC private key is fundamentally different from an EC public
key, it is just an integer and doesn't have the x and y 
parameters that an EC public key has. So when representing a EC private
key, the x and y members of the public key are not
readily available.

Was it the intention of the WG that the encoding of the EC private key
should include the parameters from the public key?

Regards,

Ludwig Seitz
-- 
Ludwig Seitz, PhD
SICS Swedish ICT AB
Ideon Science Park
Building Beta 2 
Scheelevägen 17 
SE-223 70 Lund

Phone +46(0)70-349 92 51
http://www.sics.se

---

From: <[email-masked]>
Date: Fri, 24 May 2013 14:11:26 +0200

This is consistent with the RSA private key section
https://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-10#section-5.3.2

" In addition to the members used to represent RSA public keys, the
   following members are used to represent RSA private keys."

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Ludwig Seitz
Sent: Friday, May 24, 2013 1:22 PM
To: [email-masked]
Subject: [jose] Question about JWK EC

Hello,

while implementing the JWK EC part of the JOSE draft, I've come across the following question:

However an EC private key is fundamentally different from an EC public key, it is just an integer and doesn't have the x and y parameters that an EC public key has. So when representing a EC private key, the x and y members of the public key are not readily available.

Was it the intention of the WG that the encoding of the EC private key should include the parameters from the public key?

Regards,

Ludwig Seitz
--
Ludwig Seitz, PhD
SICS Swedish ICT AB
Ideon Science Park
Building Beta 2
Scheelevägen 17
SE-223 70 Lund

Phone +46(0)70-349 92 51
http://www.sics.se

---

From: "Richer, Justin P." <[email-masked]>
Date: Fri, 24 May 2013 13:07:00 +0000

It was my read of the spec that the private key components are always in addition and the resulting object is a key pair.

 -- Justin

On May 24, 2013, at 7:22 AM, Ludwig Seitz <[email-masked]> wrote:

> _______________________________________________
> jose mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/jose

---

From: Richard Barnes <[email-masked]>
Date: Fri, 24 May 2013 10:13:39 -0400

I don't think that's necessarily the case.  It seems like you could have a
bare public key:

{
   "kty": "EC",
   "crv": "P-256",
   "d": "..."
}

You can compute the public key from that information, since the base point
for the cyclic group is specified as part of the definition of P-256 [1].
 Namely, if G is the base point, you just compute d*G.  That's arguably
even more trivial than computing an RSA public key from the private key.
 (EC point multiplication vs. Euclidean algorithm.  At least it uses the
same operation as ECDH.)

[1] <http://csrc.nist.gov/publications/fips/fips186-3/fips_186-3.pdf>

On Fri, May 24, 2013 at 9:07 AM, Richer, Justin P. <[email-masked]>wrote:

> It was my read of the spec that the private key components are always in
> addition and the resulting object is a key pair.
>
>  -- Justin
>