I have generated ECC521 key pair and keep it as mbedtls_pk_context blob.
It seems to me It consume > 5K of memory from mbedtls heap.
( No idea yet why )
Are mbedtls has some API for serialize mbedtls_pk_context to plain array and recover back ?
I would like to store pair as file and recover back when need.
Or how this kind of issues are handled usually ?
Serialization and recover can be used for compact mbedtls heap as well. Blob occupy ~80 blocks and may be they not so contiguous. If I have few key pairs they fragment heap a lot and I need more heap for execute other operations. As result more and more heap reservation for predict worst case scenario.
I can see mbedtls_pk_write_key_der() and mbedtls_pk_write_pubkey_der() dump private or/and public keys only. But may be I 'm not understand whole functionality of those.
What API I should use to restore mbedtls_pk_context from der for be sure if I not loze nothing.
Yes, they don’t use a forum, but a public mailing list.
I can see mbedtls_pk_write_key_der() and mbedtls_pk_write_pubkey_der() dump private or/and public keys only. But may be I 'm not understand whole functionality of those.
Correct, this writes the public\private key in DER form (PKCS8). You can store the result in a non volatile memory to be used later. Once you have it stored, you don’t need to repeat this operation, until you wish to repalce the key ( for example if it was revoked)
What API I should use to restore mbedtls_pk_context from der for be sure if I not loze nothing.
In order to get the mbedtls_pk_context, you should call mbedtls_pk_parse_key()
This is the proper way to store your data, as the DER format is standardized, and can be used by third party as well.
You mean, I should save public and private key separately and use 2 different APIs for extract those.
The same vice versa , restore key what is need for current operation and do what is need.
You mean, I should save public and private key separately and use 2 different APIs for extract those.
The same vice versa , restore key what is need for current operation and do what is need.
Depending on what you need. A private key is combined from both the private and the public components of the key pair, while the public key is combined only from the public components.
If you need in your device to do operations that require the private components ( asymmetric signing), then you should store the private key in a secure storage in your device. If you need only public operations ( signature verification) then you should store only the public key, however it is most likely that the signature verification that you will need to do is using someone else’s public key. No real need to store both. ( of same key). However, if the device is using a key, it is most likely to sign its messages to an external peer, in this case, that external peer would need your public key
I found one more operation what will need.
If I keep key pair in DER format and need to export from it public key only in DER format.
I can’t see any direct API. Looks like I should restore mbedtls_pk_context and after that export public key in DER only.
Is this true ?
Hi Eugene,
Well, yes. But if you only need the public key, you can store the public key alone.
If you need the public key to send to external peers, then yes, you will probably need the mbedtls_pk_context for all the PK operations anyway, so use this context to get the public key in DER \ PEM format for the remote peer
Regards
Could you help to estimate max possible buffer size for ECC521 keypair.
I can see mbedtls_pk_write_key_der returns 222 or 223 bytes sometimes.
How constant this value for certain keypair type.
I think I can reserve 256 or even 512 bytes for output buffer and it should be enough for all deviation in DER output. Is this right approach ?
By the way why mbedtls_pk_context allocate from heap ~5000 bytes / 80 blocks in case of ECC521 ?
Looks like quite big values, but internal mbedtls allocator show those digits.
Or it is OK ?
