How to generate an ECDSA key pair in Java

1import java.nio.charset.StandardCharsets;
2import java.nio.file.Files;
3import java.nio.file.Path;
4import java.nio.file.attribute.PosixFilePermissions;
5import java.security.KeyPair;
6import java.security.KeyPairGenerator;
7import java.security.spec.ECGenParameterSpec;
8import java.util.Base64;
9 
10public class GenerateKey {
11  public static void main(String[] args) throws Exception {
12    KeyPairGenerator generator = KeyPairGenerator.getInstance("EC");
13    generator.initialize(new ECGenParameterSpec("secp256r1")); // P-256, aka prime256v1
14    KeyPair pair = generator.generateKeyPair();
15 
16    // getEncoded() is PKCS#8 for the private key and SPKI for the public key
17    Path keyFile = Files.createFile(Path.of("key.pem"),
18        PosixFilePermissions.asFileAttribute(PosixFilePermissions.fromString("rw-------")));
19    Files.writeString(keyFile, pem("PRIVATE KEY", pair.getPrivate().getEncoded()));
20    Files.writeString(Path.of("pub.pem"), pem("PUBLIC KEY", pair.getPublic().getEncoded()));
21    System.out.print(pem("PUBLIC KEY", pair.getPublic().getEncoded()));
22  }
23 
24  static String pem(String label, byte[] der) {
25    Base64.Encoder base64 = Base64.getMimeEncoder(64, "\n".getBytes(StandardCharsets.US_ASCII));
26    return "-----BEGIN " + label + "-----\n" + base64.encodeToString(der) + "\n-----END " + label + "-----\n";
27  }
28}
29 

1// "BEGIN ENCRYPTED PRIVATE KEY": PKCS#8 under PBES2 (PBKDF2-HMAC-SHA256 + AES-256-CBC)
2char[] password = System.getenv("KEY_PASSWORD").toCharArray();
3byte[] salt = new byte[16];
4new SecureRandom().nextBytes(salt);
5 
6Cipher cipher = Cipher.getInstance("PBEWithHmacSHA256AndAES_256");
7cipher.init(Cipher.ENCRYPT_MODE,
8    SecretKeyFactory.getInstance("PBEWithHmacSHA256AndAES_256").generateSecret(new PBEKeySpec(password)),
9    new PBEParameterSpec(salt, 600_000));
10byte[] encrypted = cipher.doFinal(pair.getPrivate().getEncoded());
11 
12// EncryptedPrivateKeyInfo only accepts the parameters under their standard name, PBES2
13AlgorithmParameters pbes2 = AlgorithmParameters.getInstance("PBES2");
14pbes2.init(cipher.getParameters().getEncoded());
15Files.writeString(Path.of("key-encrypted.pem"),
16    pem("ENCRYPTED PRIVATE KEY", new EncryptedPrivateKeyInfo(pbes2, encrypted).getEncoded()));
17 

1# a P-256 key pair plus a self-signed certificate in a password-protected PKCS#12 keystore
2keytool -genkeypair -alias signing -keyalg EC -groupname secp256r1 \
3  -sigalg SHA256withECDSA -dname "CN=signing key" -validity 365 \
4  -keystore keys.p12 -storetype PKCS12 -storepass:env STORE_PASS
5 
6# the same private key as PKCS#8 PEM, for tools outside the JVM
7openssl pkcs12 -in keys.p12 -passin env:STORE_PASS -nocerts -nodes | openssl pkey -out key-from-p12.pem
8