Repository navigation
Add raw-private (and possibly raw-public and raw-secret) key formats? #393
Description
Currently, it's not possible to import or export a raw private X25519, Ed25519, ECDH or ECDSA key.
The spec says raw is "An unformatted sequence of bytes. Intended for secret keys." However, in the mentioned asymmetric algorithms it's actually used to import and export public keys. And unlike with pkcs8, spki and jwk, there's no natural way to tell from the format name and/or data whether it's a private or a public key.
So, we could introduce a raw-private key format for importing and exporting raw private keys.
Conversely, we could introduce raw-public for importing and exporting raw public keys, and deprecate the usage of raw for that purpose.
To complete the trio, we could introduce raw-secret for importing and exporting raw secret keys, and deprecate raw entirely.
(In the future, when we add ML-KEM, we may also want raw-seed to import/export the private key seed.)
Activity
steveluscher commentedon Jan 3, 2025
Yes please! We ship a series of helper methods to make importing the raw bytes of an
Ed25519private key more ergonomic for developers. All it does is to increase the attack surface of our library (which I've proposed to remove in anza-xyz/kit#47 at the expense of developer experience) where a platform API to import raw private key bytes would do just fine.