Support reading ECDSA private keys in "openssl ecparam -genkey" output format

[dfoxfranke]

Running openssl ecparam -genkey -name prime256v1 gives output like this:

-----BEGIN EC PARAMETERS-----
BggqhkjOPQMBBw==
-----END EC PARAMETERS-----
-----BEGIN EC PRIVATE KEY-----
MHcCAQEEIMAE+BTzAWcOIlF3Ws/rwnGjR/edsqi8yRkDACA5I5qnoAoGCCqGSM49
AwEHoUQDQgAEx5fZWcozQkJM1RxdtZmYRsRCfRPPMZDgxUWcDqqUnIoWPgYpRCFf
s58AWKN3DoGigIC3lxXODamfN6mcZPBg2w==
-----END EC PRIVATE KEY-----

The contents of the -----BEGIN EC PRIVATE KEY----- block are defined in RFC 5915. The -----BEGIN EC PARAMETERS----- block just contains the OID of the curve and is redundant with the parameters field of the ECPrivateKey block.

It would be helpful if rustls exposed a function that can parse this. Right now the user has to convert it to PKCS#8 (via openssl pkcs8 -topk8 -nocrypt) before rustls can consume it.

[ctz]

This would need support in ring

[blaggacao]

I'm not familiar at all with rust, but looking at some examples, it looks as if a parsed ECDSA in principle would be supported?
https://github.com/ctz/rustls/blob/20a2c5811ad35c90de0737ad97e738037f6ca06f/rustls/src/server/mod.rs#L265-L269

Also:
https://github.com/ctz/rustls/blob/e3bb8b81cfc297554ed5bda2aa3740c7afb962c5/rustls/src/sign.rs#L134-L138

[briansmith]

This would need support in ring

I am OK with adding support to ring to parse ECPrivateKey directly, without the PKCS#8 wrapper.

[adamchalmers]

This would need support in ring

I am OK with adding support to ring to parse ECPrivateKey directly, without the PKCS#8 wrapper.

@briansmith, thanks for offering to include this in Ring. Is there a Ring issue I can follow for this? I tried to find one and I couldn't, apologies if my issue-fu wasn't up to scratch.

[farcaller]

The ring PR for this feature is briansmith/ring#1456.

[ctz]

Please see discussion on #998 and #997