I am trying to use the OpenSSL command line to generate a ECDH public key that meets the following specifications:

Use a Base64 encoded X.509 SubjectPublicKeyInfo structure containing a ECDH public key for group P256

They following commands provide me with a key:

openssl ecparam -name prime256v1 -out prime256v1.pem
openssl ecparam -in prime256v1.pem -genkey -noout -out prime256v1-key.pem
openssl ec -in prime256v1-key.pem -pubout -out pubkey.pem


However this key is not being accepted by the API I am accessing.

An example key that is working is:


This example key is 44 (Base64) bytes shorter and has a slightly different SubjectPublickKeyInfo signature.

My question is what is the difference between these two keys and how could I use the OpenSSL command line tools to generate such a key pair.


Try compressed version

What you posted there as "example key that is working" is a base64 encoded EC pubkey without the PEM wrapper and without the usual line breaks. And more specifically it is a COMPRESSED version of the EC pubkey. But openssl writes UNcompressed keys by default.

You can convert between the compressed und uncompressed versions like so:

$ cat ExampleOfRejectedKey.headerlesspem

Make openssl parse in the key

$ openssl ec -inform DER -pubin -in <(base64 -d ExampleOfRejectedKey.headerlesspem)
read EC key
writing EC key
-----END PUBLIC KEY-----

Again but with "-conv_form compressed"

$ openssl ec -inform DER -pubin -in <(base64 -d ExampleOfRejectedKey.headerlesspem) -conv_form compressed
read EC key
writing EC key
-----END PUBLIC KEY-----

As you can see: It's a lot shorter now. And closer in length to the working key. Try this. (Why any API would insist on a compressed representation, and not say so, is beyond me.)

Further reading

See this question: 2011-07-12, Is there a standardized fixed-length encoding for EC public keys?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.