I'm currently replacing a custom C library with the Security framework and it really would be useful if 3 & 4 had a simple interface. Again there doesn't seem to be a canned way of either getting a standard g value, or doing this all in one step, but the steps are not too hard. This is the variable g that RFC-5114 specifies a few versions of - the spec of your api/device should say what the value of g is supposed to be. encrypt a small piece of data to exchange to verify you both have the right key. It's all standardised stuff, and hopefully the primitives are all in amework - in any case there are plenty of C libraries to do it, we can probably pull the code out of CommonCrypto ourselves if we have to.Ĥ.

`CCECCryptorComputeSharedSecret()` is in CommonCrypto but it is not a public function. generate the shared secret - as far as I can see the Security Framework doesn't expose a funciton to do this. In most web service cases they will want an ASN.1 formatted key and there is excellent info on that from Quinn in this forum thread: and there is also excellent code examples in ģ. they will use a format where you just want the x & y points on the curve - the data you get from `SecItemCopyMatching()` has an extra 0x04 byte at the start (which I think is in an RFC somewhere - it defines the format?) that you will probably need to strip off. (b) conform the key to the other end's requirements.

(a) get the data of the key which requires a stupid round-trip via Keychain using `SecItemCopyMatching()` send the public key to the other party, which means you need to generating an ephemeral keypair, which you can do with `SecKeyGeneratePair()`Ģ.

Elliptic curve cryptography