Struct EcdhKeypair 

pub struct EcdhKeypair { /* private fields */ }

An ephemeral P-256 ECDH key pair.

Both CA and client generate a fresh keypair per enrollment session. The keypair is consumed by derive_session_key since the ephemeral secret must not be reused.

Implementations

impl EcdhKeypair

pub fn generate() -> Self

Generate a fresh ephemeral P-256 key pair using the OS RNG.

pub fn public_key_bytes(&self) -> Vec<u8>

The uncompressed public key (65 bytes: 0x04 || X || Y). Send this in TLV_ECDH_PUB.

pub fn random_salt() -> [u8; 32]

Generate a random 32-byte HKDF salt.

pub fn derive_session_key( self, peer_pub_bytes: &[u8], salt: &[u8; 32], request_id: &[u8; 8], ) -> Result<SessionKey, CertError>

Perform ECDH with peer_pub_bytes and derive a 128-bit AES session key via HKDF-SHA256.

• peer_pub_bytes: uncompressed P-256 public key from the other party (65 bytes)
• salt: 32-byte random salt from the CA’s NEW response
• request_id: 8-byte request identifier (HKDF info field)