I recently had a problem where I created an EC client certificate which used the sect571k1
curve and I got some strange errors attempting to use it as a client certificate through Mozilla Firefox. It turns out that Firefox supports secp521r1
but not sect571k1
.
I had created the certificate using Java's keytool
, which reports the curve as 570-bit EC key
, while openssl x509
tells me it is both ASN1 OID: sect571k1
and NIST CURVE: K-571
. A bit of googling leads me to RFC 4492 which lists several keys and their various aliases, but it does not list many of the curves which are popularly discussed such as djb's Curve25519 and any of the brainpool curves. (Java's keytool
doesn't appear to allow you to choose the exact curve, only the bit-size of the key, so I didn't really have a choice.)
My LibreSSL supports ~90 different curves while my Java supports ~50 different curves. I'd like to be sure that anything I do with any "more-capable" tools are going to be compatible with web browsers, and it would be good to know what the equivalents are for all of these names.
sect571k1
. I've corrected the question text. – Christopher Schultz May 15 '18 at 14:09