nrfutil generate different public key from openSSL

[Luccas]

Hi there,

I'm trying to use nrfutil generate package with an extern key pair generated with openSSL. I used opneSLL with prime256v1 curve, which correspond to secp256r1 curve, and got an private key in PEM format, same format that nrfutil gives. But then I tried to get the public key from the command :

nrfutil keys display --key pk --format code private_key.pem --out_file out_file.c

And the public key generated differs from the openSSL.

Also, when I try to use the pk and sk generated by nrfutil to verify any signed message (using this site) I always get invalid signature.

Anyone know why that happens?

The openSSL commands used to generate the key pair:

openssl ecparam -name prime256v1 -genkey -out private_key.pem

And code used to display pub and priv keys:

openssl ec -in private_key.pem -text -noout

Thanks in advance!

Luccas

[Turbo J]

OpenSSL will always display and use keys in big endian byte order, while uECC uses little endian on NRF5x. So a key 0x1 0x2 ... 0x31 0x32 becomes 0x32 0x31 .. 0x02 0x01 in uECC.

Workaround: Just swap the key bytes around. Note that compressed (33 byte) public keys are special: You need to exclude the first byte IIRC.

[Luccas]

Oh, thanks for the explanation! I notice that on private key. But now, is there any way to sign a package using nrfutil in big endian?

[bjorn-spockeli]

@Luccas: No, not as far as I know.

[Luccas]

Ok. I'm trying to find a way to do that. If I discover something I'll post here. Thanks for the answers!