I am trying to generate deterministic keys using EC curve secp521r1 in java. I went through KDF but, couldn't find any references to use it with EC curves. I would appreciate if someone could point me to KDF or something similar to it for deterministic EC keys. All I need is to generate EC key pair using a passpharse.

Sample code that I am using to generate EC keys in Java:

 ECParameterSpec ecSpec = ECNamedCurveTable.getParameterSpec("secp521r1");
        KeyPairGenerator g = KeyPairGenerator.getInstance("ECDSA", "BC");

        g.initialize(ecSpec, new SecureRandom());
        KeyPair pair = g.generateKeyPair();

        KeyFactory fact = KeyFactory.getInstance("ECDSA", "BC");
        PublicKey pub = fact.generatePublic(new X509EncodedKeySpec(pair.getPublic().getEncoded()));
        PrivateKey priv = fact.generatePrivate(new PKCS8EncodedKeySpec(pair.getPrivate().getEncoded()));
  • $\begingroup$ Can you not just use any good KDF? $\endgroup$
    – Modal Nest
    Jan 21 at 9:57
  • $\begingroup$ @ModalNest I am not sure what would be the good fit for secp521r1 keys $\endgroup$ Jan 21 at 11:06

The problem is that this requires relatively low level access to the cryptographic algorithms.

In general the private key can simply be set to a set of bits, although it should actually fit in the field. Setting the highest bit to zero is a dirty trick if the runtime(s) do not accept as many random bits as the key size. This will however let you use any kind of KDF to derive the bits.

The public key is nothing more than the private key S multiplied with the generator point. This is where you may get in trouble, as this operation is a low level function that may not be exposed.

In principle you could use ECDH for this using the generator as public point of the "other party", but the Java API is high enough that it won't directly return the resulting point, making this a useless exercise (other API's may differ though, so I thought I should mention this).

So in general you'll need a low level API to perform functions like that.

In your case the best way forward is to use the Bouncy Castle libraries, where such low level functionality is supplied by the lightweight cryptography API. Bouncy Castle also has a nice set of KDF's that you can use. I know 'cause I did the initial implementation.

  • $\begingroup$ Thanks for your valuable inputs. I tried one of the sample using a seed to generate key pairs using bouncy castle. But, unfortunately, I am not able to retrieve private key (as a Java Object) from generated key bytes. Updating the question with reference. I am trying to use these keys to signature verification. $\endgroup$ Jan 21 at 16:35
  • $\begingroup$ I tried to give an answer that is as language / runtime agnostic as possible. Coding questions have to be asked at Stack Overflow (where I might take a look at it, I'm answering quite a few crypto questions there as well). $\endgroup$
    – Maarten Bodewes
    Jan 21 at 16:46
  • $\begingroup$ Sure, thanks @Maarten $\endgroup$ Jan 21 at 16:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.