I know how to do this with RSA keys (see this article: Determine if private key belongs to certificate?) however I do not know how to do this for ECDSA certificate / key pairs.

With RSA keys, the modulus can be used for this. However I'm not sure what the "equivalent" is for ECDSA.



The equivalent data for ECDSA, or any ECC including ECDH, is the public point value and a specification of the curve used. In practice for interoperability people use one of the curves identified by a standardized OID (NIST, SECG, etc) and mostly only the two "blessed" by NSA Suite B, namely nistp256 and nistp384, although the ASN.1 formats (and openssl library) can support any(?) Weierstrass-form curve.

But the easy methods are effectively the same as in Determine if private key belongs to certificate? , to which I add some possible improvements:

  1. Use openssl x509 -in cert -pubkey to get the field from the cert, and compare it to (all of) the public key (in the same SPKI encoding) obtained from the private key with openssl ec -in key -pubout

    1A. Instead of different commands for RSA and ECC private keys, since openssl 1.0.0 in 2010 you can use the algorithm-generic openssl pkey -in key -pubout for both.

  2. Configure an openssl-based program to (try to) use the key and "own" cert. If they don't match, openssl library will return an error which the program should display.

    2A. Instead of setting-up a whole server environment, or temporarily taking-over an existing one, you can just run openssl s_server -accept X -cert cfile -key kfile where X is any port usable on your machine = not restricted and not currently bound or connected. If it starts okay (cert & key match), just control-C (or equivalent).

| improve this answer | |
  • 1
    Thanks for the reply, very helpful. To take it one stage further, how would you identify the public point value and specification of the curve used by examining the CSR and/or the private key and/or the certificate in OpenSSL? For example, I was anticipating the Generator or the Seed to be the unique identifier i'm looking for. However I generated two sets of keys, certs and CSR's with the same curve and the only differences I can see is the public and private keys (somewhat obviously) - however I cannot see anything else unique? Is there anything? – Jeff Nov 20 '14 at 16:31
  • @Jeff See values: Both cert and CSR contain the public key in an encoded form, defined by X9.62 (which I don't actually have) and repeated in ietf.org/rfc/rfc3279.txt . The private key uses a similar form. Since you're using openssl, you can extract (SPKI) publickey from the cert as in my answer, or CSR similarly, or you normally have privatekey (either specific or PKCS8) already in a file, and then openssl ec -in file [-pubin] -text -noout displays the fields in (skilled-)human-readable form. – dave_thompson_085 Nov 21 '14 at 12:10
  • @Jeff The group generator aka base point G is part of the curve specification. As I said people mostly use standard curves and the encoded key contains only the OID for the curve; you can get the details about a curve from the source standards, or openssl ecparam -param_enc explicit converts to the full specification instead of the OID and them openssl ecparam -text -noout displays it. There is no seed in a curve. You might use a seed in generating a curve if you did that which people don't, but only the curve is represented not the seed. ... – dave_thompson_085 Nov 21 '14 at 12:16
  • @Jeff ... You might seed a PRNG used to generate the privatekey of a keypair, but the key represents the privateky not the seed. So yes, if you generate multiple keypairs on the same curve, the only unique parts of each keypair are the privatekey value (number) and publickey value (point). And the encoded publickey contains only the latter of these. – dave_thompson_085 Nov 21 '14 at 12:18
  • Old question I know. I want to confirm I understand this. Given a ECDSA private key and X509 certificate. If both pubkey values are the same, IS IT SAFE to assume that the private key really is the owner of that certificate? (see my debate here stackoverflow.com/questions/54535798/…) – Nathan H Feb 6 '19 at 11:24

To give a concrete implementation of what @dave_thompson_085 said, this does the trick - it extracts the public key from each of the certificate and the private key, then calculates their md5 hash, allowing you to compare them easily:

# openssl x509 -pubkey -in mydomain-ecc.crt -noout | openssl md5
(stdin)= 77e16c92c1a4907c7da34e72a1c5b879
# openssl pkey -pubout -in mydomain-ecc.key | openssl md5
(stdin)= 77e16c92c1a4907c7da34e72a1c5b879

Since this question was posted, an answer has been added to the question linked by the OP, providing a one-liner that will also work with ECC certs (using pkey instead of rsa), but it doesn't provide visible confirmation.

| improve this answer | |
  • Old question I know. I want to confirm I understand this. Given a ECDSA private key and X509 certificate. If both of the values above are equal, IS IT SAFE to assume that the private key really is the owner of that certificate? (see my debate here stackoverflow.com/questions/54535798/…) – Nathan H Feb 6 '19 at 11:23
  • Yes - in that I don't know of any circumstance short of a collision that would produce a false positive. If you disapprove of the use of md5, just use any stronger hash, like sha2 or blake2, or compare the outputs directly. – Synchro Feb 6 '19 at 11:34
  • 1
    Looking at this article (blog.hboeck.de/archives/…). I'm no crypto expert but this paragraph bothers me: "A naive check whether a private key belongs to a certificate could be done by extracting the public key parts of both ..." (see the rest). Are they describing exactly what we are doing here? – Nathan H Feb 6 '19 at 11:56
  • 1
    Not what I meant. We agree that this will help me compare the private key to the certificate. My question is to check if the private key is a real private key, as explained in the blog post. He explains you can inject the right public key inside the wrong private key to cheat the test described in your answer. – Nathan H Feb 7 '19 at 8:32
  • 2
    The author confirmed to me by email that in theory he sees no difference to the problem whether it's RSA or EC. In any case, for my own project I've now decided to take a completely different route so I won't validate anything anymore. However maybe someone else would be interested... If you ever figure it out, update your answer :) – Nathan H Feb 7 '19 at 9:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.