Module ecdsa 

ecdsa-verify / ecdsa-sign key creation.

Enums

EcdsaVariant

The served curve/digest pairings. Every variant still binds its hash at mint — a key can never be used with a digest its minter did not choose — but the cross pairings of the served curves and SHA-2 digests are representable, as WebCrypto’s per-operation hash makes them on the platform.

Functions

generate_key

Generate a fresh random signing key of the declared variant, returning both halves.

import_signing_key_jwk

Import a signing key as an EC private JWK (kty: "EC", with crv, d, and the mandatory public coordinates x/y; as JSON text). crv and alg are validated as in import_verifying_key_jwk.

import_signing_key_pkcs8

Import a signing key as a PKCS#8 PrivateKeyInfo (DER, the SEC1 private-key body). The encoded curve must match the declared variant’s (Error::InvalidKey); an embedded public key, when present, is validated against the scalar and never trusted on its own. Returns only the signing key; the public half is imported separately (there is no derive from a private import — see the WIT ecdsa-sign interface doc).

import_verifying_key_jwk

Import a public key as an EC public JWK (kty: "EC", with crv, x, and y; as JSON text). The JWK’s crv must match the declared variant’s curve, and an alg member, when present, must be the curve’s JOSE signature alg ("ES256" for P-256, "ES384" for P-384). See the WIT mac-key.export-key-jwk doc for the package-wide JWK contract.

import_verifying_key_raw

Import a public key as an uncompressed SEC1 point.

import_verifying_key_spki

Import a public key as an X.509 SubjectPublicKeyInfo (DER). The curve must be named by OID and match the declared variant’s, or the import fails Error::InvalidKey; whether a compressed point encoding is accepted is implementation-defined — do not rely on either behavior (see the WIT import-verifying-key-spki doc).

unwrap_signing_key_jwk

Mint a signing key from unwrapped key material read as an EC private JWK, subject to import_signing_key_jwk’s contract plus the unwrap-path use/key_ops checks (see the WIT README.md, “JWK contract”). Consumes the UnwrapInput; see unwrap_signing_key_pkcs8 for the options model.

unwrap_signing_key_pkcs8

Mint a signing key from unwrapped key material read as a PKCS#8 PrivateKeyInfo, subject to import_signing_key_pkcs8’s contract. Consumes the UnwrapInput; the minted key’s usages and extractability come from options alone.