PUBLIC_KEY: add support for Elliptic Curves to public_key app

11 files changed, 441 insertions, 56 deletions

diff --git a/lib/public_key/asn1/ECPrivateKey.asn1 b/lib/public_key/asn1/ECPrivateKey.asn1
new file mode 100644
index 0000000000..e8607c4f7b
--- /dev/null
+++ b/lib/public_key/asn1/ECPrivateKey.asn1
@@ -0,0 +1,24 @@
+ECPrivateKey { iso(1) identified-organization(3) dod(6)
+  internet(1) security(5) mechanisms(5) pkix(7) id-mod(0)
+  id-mod-ecprivateKey(65) }
+
+DEFINITIONS EXPLICIT TAGS ::=
+
+BEGIN
+
+-- EXPORTS ALL;
+
+IMPORTS
+
+-- FROM New PKIX ASN.1 [RFC5912]
+
+OTPEcpkParameters FROM OTP-PKIX;
+
+ECPrivateKey ::= SEQUENCE {
+  version        INTEGER,
+  privateKey     OCTET STRING,
+  parameters [0] OTPEcpkParameters OPTIONAL,
+  publicKey  [1] BIT STRING OPTIONAL
+}
+
+END
\ No newline at end of file
diff --git a/lib/public_key/asn1/OTP-PKIX.asn1 b/lib/public_key/asn1/OTP-PKIX.asn1
index a90fe2840c..4a9d401345 100644
--- a/lib/public_key/asn1/OTP-PKIX.asn1
+++ b/lib/public_key/asn1/OTP-PKIX.asn1
@@ -105,7 +105,8 @@ IMPORTS
 	rsaEncryption, RSAPublicKey,
 	dhpublicnumber, DomainParameters, DHPublicKey,
 	id-keyExchangeAlgorithm, KEA-Parms-Id, --KEA-PublicKey,
-	ecdsa-with-SHA1, 
+	ecdsa-with-SHA1, ecdsa-with-SHA224,
+	ecdsa-with-SHA256, ecdsa-with-SHA384, ecdsa-with-SHA512,
 	prime-field, Prime-p, 
 	characteristic-two-field, --Characteristic-two, 
 	gnBasis, 
@@ -321,7 +322,11 @@ SupportedSignatureAlgorithms SIGNATURE-ALGORITHM-CLASS ::= {
 		    sha256-with-rsa-encryption |
 		    sha384-with-rsa-encryption |
 		    sha512-with-rsa-encryption |
-		    ecdsa-with-sha1 } 
+		    ecdsa-with-sha1 |
+		    ecdsa-with-sha224 |
+		    ecdsa-with-sha256 |
+		    ecdsa-with-sha384 |
+		    ecdsa-with-sha512 }
 
 SupportedPublicKeyAlgorithms PUBLIC-KEY-ALGORITHM-CLASS ::= { 
 		    dsa | rsa-encryption | dh  | kea  | ec-public-key }
@@ -439,6 +444,22 @@ SupportedPublicKeyAlgorithms PUBLIC-KEY-ALGORITHM-CLASS ::= {
        ID ecdsa-with-SHA1
        TYPE NULL }  -- XXX Must be empty and not NULL
 
+   ecdsa-with-sha224 SIGNATURE-ALGORITHM-CLASS ::= {
+       ID ecdsa-with-SHA224
+       TYPE NULL }  -- XXX Must be empty and not NULL
+
+   ecdsa-with-sha256 SIGNATURE-ALGORITHM-CLASS ::= {
+       ID ecdsa-with-SHA256
+       TYPE NULL }  -- XXX Must be empty and not NULL
+
+   ecdsa-with-sha384 SIGNATURE-ALGORITHM-CLASS ::= {
+       ID ecdsa-with-SHA384
+       TYPE NULL }  -- XXX Must be empty and not NULL
+
+   ecdsa-with-sha512 SIGNATURE-ALGORITHM-CLASS ::= {
+       ID ecdsa-with-SHA512
+       TYPE NULL }  -- XXX Must be empty and not NULL
+
    FIELD-ID-CLASS ::= CLASS {
 	&id OBJECT IDENTIFIER UNIQUE,
 	&Type }
@@ -489,6 +510,23 @@ SupportedPublicKeyAlgorithms PUBLIC-KEY-ALGORITHM-CLASS ::= {
 	    ID ppBasis
 	    TYPE Pentanomial }
 
+   -- Elliptic Curve parameters may be specified explicitly,
+   -- specified implicitly through a "named curve", or
+   -- inherited from the CA
+
+   OTPEcpkParameters ::= CHOICE {
+      ecParameters  OTPECParameters,
+      namedCurve    OBJECT IDENTIFIER,
+      implicitlyCA  NULL }
+
+   OTPECParameters  ::= SEQUENCE {         -- Elliptic curve parameters
+      version   ECPVer,
+      fieldID   OTPFieldID,
+      curve     Curve,
+      base      ECPoint,                -- Base point G
+      order     INTEGER,                -- Order n of the base point
+      cofactor  INTEGER  OPTIONAL }     -- The integer h = #E(Fq)/n
+
    -- SubjectPublicKeyInfo.algorithm
 
    ec-public-key PUBLIC-KEY-ALGORITHM-CLASS ::= {
diff --git a/lib/public_key/asn1/OTP-PUB-KEY.set.asn b/lib/public_key/asn1/OTP-PUB-KEY.set.asn
index f8fb318c93..e94f428e4b 100644
--- a/lib/public_key/asn1/OTP-PUB-KEY.set.asn
+++ b/lib/public_key/asn1/OTP-PUB-KEY.set.asn
@@ -6,5 +6,6 @@ PKIX1Algorithms88.asn1
 PKCS-1.asn1
 PKCS-3.asn1
 DSS.asn1
+ECPrivateKey.asn1
 PKCS-7.asn1
 PKCS-10.asn1
diff --git a/lib/public_key/asn1/PKCS-1.asn1 b/lib/public_key/asn1/PKCS-1.asn1
index b5754790e7..117eacd8ad 100644
--- a/lib/public_key/asn1/PKCS-1.asn1
+++ b/lib/public_key/asn1/PKCS-1.asn1
@@ -52,8 +52,40 @@ id-md5 OBJECT IDENTIFIER ::= {
     iso(1) member-body(2) us(840) rsadsi(113549) digestAlgorithm(2) 5
 }
 
+id-hmacWithSHA224 OBJECT IDENTIFIER ::= {
+    iso(1) member-body(2) us(840) rsadsi(113549) digestAlgorithm(2) 8
+}
+
+id-hmacWithSHA256 OBJECT IDENTIFIER ::= {
+    iso(1) member-body(2) us(840) rsadsi(113549) digestAlgorithm(2) 9
+}
+
+id-hmacWithSHA384 OBJECT IDENTIFIER ::= {
+    iso(1) member-body(2) us(840) rsadsi(113549) digestAlgorithm(2) 10
+}
+
+id-hmacWithSHA512 OBJECT IDENTIFIER ::= {
+    iso(1) member-body(2) us(840) rsadsi(113549) digestAlgorithm(2) 11
+}
+
 id-mgf1    OBJECT IDENTIFIER ::= { pkcs-1 8 }
 
+id-sha224  OBJECT IDENTIFIER  ::=  { joint-iso-itu-t(2)
+        country(16) us(840) organization(1) gov(101) csor(3)
+        nistalgorithm(4) hashalgs(2) 4 }
+
+id-sha256  OBJECT IDENTIFIER  ::=  { joint-iso-itu-t(2)
+        country(16) us(840) organization(1) gov(101) csor(3)
+        nistalgorithm(4) hashalgs(2) 1 }
+
+id-sha384  OBJECT IDENTIFIER  ::=  { joint-iso-itu-t(2)
+        country(16) us(840) organization(1) gov(101) csor(3)
+        nistalgorithm(4) hashalgs(2) 2 }
+
+id-sha512  OBJECT IDENTIFIER  ::=  { joint-iso-itu-t(2)
+        country(16) us(840) organization(1) gov(101) csor(3)
+        nistalgorithm(4) hashalgs(2) 3 }
+
 
 RSAPublicKey ::= SEQUENCE {
     modulus           INTEGER,  -- n
diff --git a/lib/public_key/asn1/PKIX1Algorithms88.asn1 b/lib/public_key/asn1/PKIX1Algorithms88.asn1
index 74225747d3..6cc6745af6 100644
--- a/lib/public_key/asn1/PKIX1Algorithms88.asn1
+++ b/lib/public_key/asn1/PKIX1Algorithms88.asn1
@@ -98,6 +98,11 @@
    -- OID for ECDSA signatures with SHA-1
 
    ecdsa-with-SHA1 OBJECT IDENTIFIER ::= { id-ecSigType 1 }
+   ecdsa-with-SHA2 OBJECT IDENTIFIER ::= { id-ecSigType 3 }
+   ecdsa-with-SHA224 OBJECT IDENTIFIER ::= { ecdsa-with-SHA2 1 }
+   ecdsa-with-SHA256 OBJECT IDENTIFIER ::= { ecdsa-with-SHA2 2 }
+   ecdsa-with-SHA384 OBJECT IDENTIFIER ::= { ecdsa-with-SHA2 3 }
+   ecdsa-with-SHA512 OBJECT IDENTIFIER ::= { ecdsa-with-SHA2 4 }
 
    -- OID for an elliptic curve signature
    -- format for the value of an ECDSA signature value
@@ -199,40 +204,83 @@
 
    -- Named Elliptic Curves in ANSI X9.62.
 
-   ellipticCurve OBJECT IDENTIFIER ::= { ansi-X9-62 curves(3) }
-
-   c-TwoCurve OBJECT IDENTIFIER ::= {
-        ellipticCurve characteristicTwo(0) }
-
-   c2pnb163v1  OBJECT IDENTIFIER  ::=  { c-TwoCurve  1 }
-   c2pnb163v2  OBJECT IDENTIFIER  ::=  { c-TwoCurve  2 }
-   c2pnb163v3  OBJECT IDENTIFIER  ::=  { c-TwoCurve  3 }
-   c2pnb176w1  OBJECT IDENTIFIER  ::=  { c-TwoCurve  4 }
-   c2tnb191v1  OBJECT IDENTIFIER  ::=  { c-TwoCurve  5 }
-   c2tnb191v2  OBJECT IDENTIFIER  ::=  { c-TwoCurve  6 }
-   c2tnb191v3  OBJECT IDENTIFIER  ::=  { c-TwoCurve  7 }
-   c2onb191v4  OBJECT IDENTIFIER  ::=  { c-TwoCurve  8 }
-   c2onb191v5  OBJECT IDENTIFIER  ::=  { c-TwoCurve  9 }
-   c2pnb208w1  OBJECT IDENTIFIER  ::=  { c-TwoCurve 10 }
-   c2tnb239v1  OBJECT IDENTIFIER  ::=  { c-TwoCurve 11 }
-   c2tnb239v2  OBJECT IDENTIFIER  ::=  { c-TwoCurve 12 }
-   c2tnb239v3  OBJECT IDENTIFIER  ::=  { c-TwoCurve 13 }
-   c2onb239v4  OBJECT IDENTIFIER  ::=  { c-TwoCurve 14 }
-   c2onb239v5  OBJECT IDENTIFIER  ::=  { c-TwoCurve 15 }
-   c2pnb272w1  OBJECT IDENTIFIER  ::=  { c-TwoCurve 16 }
-   c2pnb304w1  OBJECT IDENTIFIER  ::=  { c-TwoCurve 17 }
-   c2tnb359v1  OBJECT IDENTIFIER  ::=  { c-TwoCurve 18 }
-   c2pnb368w1  OBJECT IDENTIFIER  ::=  { c-TwoCurve 19 }
-   c2tnb431r1  OBJECT IDENTIFIER  ::=  { c-TwoCurve 20 }
-
-   primeCurve OBJECT IDENTIFIER ::= { ellipticCurve prime(1) }
-
-   prime192v1  OBJECT IDENTIFIER  ::=  { primeCurve  1 }
-   prime192v2  OBJECT IDENTIFIER  ::=  { primeCurve  2 }
-   prime192v3  OBJECT IDENTIFIER  ::=  { primeCurve  3 }
-   prime239v1  OBJECT IDENTIFIER  ::=  { primeCurve  4 }
-   prime239v2  OBJECT IDENTIFIER  ::=  { primeCurve  5 }
-   prime239v3  OBJECT IDENTIFIER  ::=  { primeCurve  6 }
-   prime256v1  OBJECT IDENTIFIER  ::=  { primeCurve  7 }
+   --   ellipticCurve OBJECT IDENTIFIER ::= { ansi-X9-62 curves(3) }
+
+   --   c-TwoCurve OBJECT IDENTIFIER ::= {
+   --        ansi-ellipticCurve characteristicTwo(0) }
+
+   --   c2pnb163v1  OBJECT IDENTIFIER  ::=  { c-TwoCurve  1 }
+   --   c2pnb163v2  OBJECT IDENTIFIER  ::=  { c-TwoCurve  2 }
+   --   c2pnb163v3  OBJECT IDENTIFIER  ::=  { c-TwoCurve  3 }
+   --   c2pnb176w1  OBJECT IDENTIFIER  ::=  { c-TwoCurve  4 }
+   --   c2tnb191v1  OBJECT IDENTIFIER  ::=  { c-TwoCurve  5 }
+   --   c2tnb191v2  OBJECT IDENTIFIER  ::=  { c-TwoCurve  6 }
+   --   c2tnb191v3  OBJECT IDENTIFIER  ::=  { c-TwoCurve  7 }
+   --   c2onb191v4  OBJECT IDENTIFIER  ::=  { c-TwoCurve  8 }
+   --   c2onb191v5  OBJECT IDENTIFIER  ::=  { c-TwoCurve  9 }
+   --   c2pnb208w1  OBJECT IDENTIFIER  ::=  { c-TwoCurve 10 }
+   --   c2tnb239v1  OBJECT IDENTIFIER  ::=  { c-TwoCurve 11 }
+   --   c2tnb239v2  OBJECT IDENTIFIER  ::=  { c-TwoCurve 12 }
+   --   c2tnb239v3  OBJECT IDENTIFIER  ::=  { c-TwoCurve 13 }
+   --   c2onb239v4  OBJECT IDENTIFIER  ::=  { c-TwoCurve 14 }
+   --   c2onb239v5  OBJECT IDENTIFIER  ::=  { c-TwoCurve 15 }
+   --   c2pnb272w1  OBJECT IDENTIFIER  ::=  { c-TwoCurve 16 }
+   --   c2pnb304w1  OBJECT IDENTIFIER  ::=  { c-TwoCurve 17 }
+   --   c2tnb359v1  OBJECT IDENTIFIER  ::=  { c-TwoCurve 18 }
+   --   c2pnb368w1  OBJECT IDENTIFIER  ::=  { c-TwoCurve 19 }
+   --   c2tnb431r1  OBJECT IDENTIFIER  ::=  { c-TwoCurve 20 }
+
+   --   primeCurve OBJECT IDENTIFIER ::= { ansi-ellipticCurve prime(1) }
+
+   --   prime192v1  OBJECT IDENTIFIER  ::=  { primeCurve  1 }
+   --   prime192v2  OBJECT IDENTIFIER  ::=  { primeCurve  2 }
+   --   prime192v3  OBJECT IDENTIFIER  ::=  { primeCurve  3 }
+   --   prime239v1  OBJECT IDENTIFIER  ::=  { primeCurve  4 }
+   --   prime239v2  OBJECT IDENTIFIER  ::=  { primeCurve  5 }
+   --   prime239v3  OBJECT IDENTIFIER  ::=  { primeCurve  6 }
+   --   prime256v1  OBJECT IDENTIFIER  ::=  { primeCurve  7 }
+
+   certicom-arc OBJECT IDENTIFIER ::= {
+        iso(1) identified-organization(3) certicom(132)
+   }
+
+   ellipticCurve OBJECT IDENTIFIER ::= {
+        iso(1) identified-organization(3) certicom(132) curve(0)
+   }
+
+   secp192r1 OBJECT IDENTIFIER ::= { ansi-X9-62 curves(3) prime(1) 1 }
+   secp256r1 OBJECT IDENTIFIER ::= { ansi-X9-62 curves(3) prime(1) 7 }
+
+   sect163k1 OBJECT IDENTIFIER ::= { ellipticCurve 1 }
+   sect163r1 OBJECT IDENTIFIER ::= { ellipticCurve 2 }
+   sect239k1 OBJECT IDENTIFIER ::= { ellipticCurve 3 }
+   sect113r1 OBJECT IDENTIFIER ::= { ellipticCurve 4 }
+   sect113r2 OBJECT IDENTIFIER ::= { ellipticCurve 5 }
+   secp112r1 OBJECT IDENTIFIER ::= { ellipticCurve 6 }
+   secp112r2 OBJECT IDENTIFIER ::= { ellipticCurve 7 }
+   secp160r1 OBJECT IDENTIFIER ::= { ellipticCurve 8 }
+   secp160k1 OBJECT IDENTIFIER ::= { ellipticCurve 9 }
+   secp256k1 OBJECT IDENTIFIER ::= { ellipticCurve 10 }
+   sect163r2 OBJECT IDENTIFIER ::= { ellipticCurve 15 }
+   sect283k1 OBJECT IDENTIFIER ::= { ellipticCurve 16 }
+   sect283r1 OBJECT IDENTIFIER ::= { ellipticCurve 17 }
+   sect131r1 OBJECT IDENTIFIER ::= { ellipticCurve 22 }
+   sect131r2 OBJECT IDENTIFIER ::= { ellipticCurve 23 }
+   sect193r1 OBJECT IDENTIFIER ::= { ellipticCurve 24 }
+   sect193r2 OBJECT IDENTIFIER ::= { ellipticCurve 25 }
+   sect233k1 OBJECT IDENTIFIER ::= { ellipticCurve 26 }
+   sect233r1 OBJECT IDENTIFIER ::= { ellipticCurve 27 }
+   secp128r1 OBJECT IDENTIFIER ::= { ellipticCurve 28 }
+   secp128r2 OBJECT IDENTIFIER ::= { ellipticCurve 29 }
+   secp160r2 OBJECT IDENTIFIER ::= { ellipticCurve 30 }
+   secp192k1 OBJECT IDENTIFIER ::= { ellipticCurve 31 }
+   secp224k1 OBJECT IDENTIFIER ::= { ellipticCurve 32 }
+   secp224r1 OBJECT IDENTIFIER ::= { ellipticCurve 33 }
+   secp384r1 OBJECT IDENTIFIER ::= { ellipticCurve 34 }
+   secp521r1 OBJECT IDENTIFIER ::= { ellipticCurve 35 }
+   sect409k1 OBJECT IDENTIFIER ::= { ellipticCurve 36 }
+   sect409r1 OBJECT IDENTIFIER ::= { ellipticCurve 37 }
+   sect571k1 OBJECT IDENTIFIER ::= { ellipticCurve 38 }
+   sect571r1 OBJECT IDENTIFIER ::= { ellipticCurve 39 }
 
    END
diff --git a/lib/public_key/doc/src/public_key.xml b/lib/public_key/doc/src/public_key.xml
index 84300f6e65..9cad17e4c3 100644
--- a/lib/public_key/doc/src/public_key.xml
+++ b/lib/public_key/doc/src/public_key.xml
@@ -84,7 +84,8 @@
    
     <p><code>pki_asn1_type() = 'Certificate' | 'RSAPrivateKey'| 'RSAPublicKey' |
     'DSAPrivateKey' | 'DSAPublicKey' | 'DHParameter' | 'SubjectPublicKeyInfo' |
-    'PrivateKeyInfo' | 'CertificationRequest'</code></p>
+    'PrivateKeyInfo' | 'CertificationRequest' | 'ECPrivateKey'|
+    'OTPEcpkParameters'</code></p>
     
     <p><code>pem_entry () = {pki_asn1_type(), binary(), %% DER or encrypted DER
           not_encrypted | cipher_info()} </code></p>
@@ -100,6 +101,8 @@
 
     <p><code>dsa_private_key() = #'DSAPrivateKey'{}</code></p>
     
+    <p><code>ec_key()  = {'ECKey', Key}</code></p>
+
     <p><code> public_crypt_options() = [{rsa_pad, rsa_padding()}]. </code></p>
 
     <p><code> rsa_padding() =  'rsa_pkcs1_padding' | 'rsa_pkcs1_oaep_padding'
@@ -109,6 +112,8 @@
 
     <p><code> dss_digest_type()  = 'sha' </code></p>
 
+    <p><code> ecdsa_digest_type()  = 'sha' </code></p>
+
     <p><code> crl_reason()  = unspecified | keyCompromise | cACompromise | affiliationChanged | superseded | cessationOfOperation | certificateHold | privilegeWithdrawn |  aACompromise
     </code></p>
 
@@ -528,8 +533,8 @@ fun(OtpCert :: #'OTPCertificate'{}, Event :: {bad_cert, Reason :: atom()} |
        <d>The msg is either the binary "plain text" data to be
        signed or it is the hashed value of "plain text" i.e. the
        digest.</d>
-       <v>DigestType = rsa_digest_type() | dss_digest_type()</v>
-       <v>Key = rsa_private_key() | dsa_private_key()</v>
+       <v>DigestType = rsa_digest_type() | dss_digest_type() | ecdsa_digest_type()</v>
+       <v>Key = rsa_private_key() | dsa_private_key() | ec_key()</v>
   </type>
   <desc>
     <p> Creates a digital signature.</p> 
@@ -592,9 +597,9 @@ fun(OtpCert :: #'OTPCertificate'{}, Event :: {bad_cert, Reason :: atom()} |
       <v>Msg = binary() | {digest,binary()}</v>
        <d>The msg is either the binary "plain text" data 
         or it is the hashed value of "plain text" i.e. the digest.</d>
-      <v>DigestType = rsa_digest_type() | dss_digest_type()</v>
+      <v>DigestType = rsa_digest_type() | dss_digest_type() | ecdsa_digest_type()</v>
       <v>Signature = binary()</v>
-      <v>Key = rsa_public_key() | dsa_public_key()</v> 
+      <v>Key = rsa_public_key() | dsa_public_key() | ec_key()</v>
   </type> 
   <desc> 
     <p>Verifies a digital signature</p> 
diff --git a/lib/public_key/include/public_key.hrl b/lib/public_key/include/public_key.hrl
index 4d1d510f29..976104fe6c 100644
--- a/lib/public_key/include/public_key.hrl
+++ b/lib/public_key/include/public_key.hrl
@@ -72,6 +72,10 @@
 	  valid_ext
 	 }).
 
+-record('ECPoint', {
+	  point
+	 }).
+
 
 -define(unspecified, 0).
 -define(keyCompromise, 1).
diff --git a/lib/public_key/src/pubkey_cert_records.erl b/lib/public_key/src/pubkey_cert_records.erl
index 98004c71a3..0449129809 100644
--- a/lib/public_key/src/pubkey_cert_records.erl
+++ b/lib/public_key/src/pubkey_cert_records.erl
@@ -23,7 +23,8 @@
 
 -include("public_key.hrl").
 
--export([decode_cert/1, transform/2, supportedPublicKeyAlgorithms/1]).
+-export([decode_cert/1, transform/2, supportedPublicKeyAlgorithms/1,
+	 supportedCurvesTypes/1, namedCurves/1]).
 
 %%====================================================================
 %% Internal application API
@@ -101,6 +102,77 @@ supportedPublicKeyAlgorithms(?'dhpublicnumber') -> 'DHPublicKey';
 supportedPublicKeyAlgorithms(?'id-keyExchangeAlgorithm') -> 'KEA-PublicKey';
 supportedPublicKeyAlgorithms(?'id-ecPublicKey') -> 'ECPoint'.
 
+supportedCurvesTypes(?'characteristic-two-field') -> characteristic_two_field;
+supportedCurvesTypes(?'prime-field') -> prime_field.
+
+namedCurves(?'sect571r1') -> sect571r1;
+namedCurves(?'sect571k1') -> sect571k1;
+namedCurves(?'sect409r1') -> sect409r1;
+namedCurves(?'sect409k1') -> sect409k1;
+namedCurves(?'secp521r1') -> secp521r1;
+namedCurves(?'secp384r1') -> secp384r1;
+namedCurves(?'secp224r1') -> secp224r1;
+namedCurves(?'secp224k1') -> secp224k1;
+namedCurves(?'secp192k1') -> secp192k1;
+namedCurves(?'secp160r2') -> secp160r2;
+namedCurves(?'secp128r2') -> secp128r2;
+namedCurves(?'secp128r1') -> secp128r1;
+namedCurves(?'sect233r1') -> sect233r1;
+namedCurves(?'sect233k1') -> sect233k1;
+namedCurves(?'sect193r2') -> sect193r2;
+namedCurves(?'sect193r1') -> sect193r1;
+namedCurves(?'sect131r2') -> sect131r2;
+namedCurves(?'sect131r1') -> sect131r1;
+namedCurves(?'sect283r1') -> sect283r1;
+namedCurves(?'sect283k1') -> sect283k1;
+namedCurves(?'sect163r2') -> sect163r2;
+namedCurves(?'secp256k1') -> secp256k1;
+namedCurves(?'secp160k1') -> secp160k1;
+namedCurves(?'secp160r1') -> secp160r1;
+namedCurves(?'secp112r2') -> secp112r2;
+namedCurves(?'secp112r1') -> secp112r1;
+namedCurves(?'sect113r2') -> sect113r2;
+namedCurves(?'sect113r1') -> sect113r1;
+namedCurves(?'sect239k1') -> sect239k1;
+namedCurves(?'sect163r1') -> sect163r1;
+namedCurves(?'sect163k1') -> sect163k1;
+namedCurves(?'secp256r1') -> secp256r1;
+namedCurves(?'secp192r1') -> secp192r1;
+
+namedCurves(sect571r1) -> ?'sect571r1';
+namedCurves(sect571k1) -> ?'sect571k1';
+namedCurves(sect409r1) -> ?'sect409r1';
+namedCurves(sect409k1) -> ?'sect409k1';
+namedCurves(secp521r1) -> ?'secp521r1';
+namedCurves(secp384r1) -> ?'secp384r1';
+namedCurves(secp224r1) -> ?'secp224r1';
+namedCurves(secp224k1) -> ?'secp224k1';
+namedCurves(secp192k1) -> ?'secp192k1';
+namedCurves(secp160r2) -> ?'secp160r2';
+namedCurves(secp128r2) -> ?'secp128r2';
+namedCurves(secp128r1) -> ?'secp128r1';
+namedCurves(sect233r1) -> ?'sect233r1';
+namedCurves(sect233k1) -> ?'sect233k1';
+namedCurves(sect193r2) -> ?'sect193r2';
+namedCurves(sect193r1) -> ?'sect193r1';
+namedCurves(sect131r2) -> ?'sect131r2';
+namedCurves(sect131r1) -> ?'sect131r1';
+namedCurves(sect283r1) -> ?'sect283r1';
+namedCurves(sect283k1) -> ?'sect283k1';
+namedCurves(sect163r2) -> ?'sect163r2';
+namedCurves(secp256k1) -> ?'secp256k1';
+namedCurves(secp160k1) -> ?'secp160k1';
+namedCurves(secp160r1) -> ?'secp160r1';
+namedCurves(secp112r2) -> ?'secp112r2';
+namedCurves(secp112r1) -> ?'secp112r1';
+namedCurves(sect113r2) -> ?'sect113r2';
+namedCurves(sect113r1) -> ?'sect113r1';
+namedCurves(sect239k1) -> ?'sect239k1';
+namedCurves(sect163r1) -> ?'sect163r1';
+namedCurves(sect163k1) -> ?'sect163k1';
+namedCurves(secp256r1) -> ?'secp256r1';
+namedCurves(secp192r1) -> ?'secp192r1'.
+
 %%--------------------------------------------------------------------
 %%% Internal functions
 %%--------------------------------------------------------------------
@@ -111,14 +183,24 @@ decode_supportedPublicKey(#'OTPSubjectPublicKeyInfo'{algorithm= PA =
 						  #'PublicKeyAlgorithm'{algorithm=Algo},
 						  subjectPublicKey = {0,SPK0}}) ->
     Type = supportedPublicKeyAlgorithms(Algo),
-    {ok, SPK} = 'OTP-PUB-KEY':decode(Type, SPK0),
+    SPK = case Type of
+              'ECPoint' -> #'ECPoint'{point = SPK0};
+              _ -> {ok, SPK1} = 'OTP-PUB-KEY':decode(Type, SPK0),
+                   SPK1
+          end,
     #'OTPSubjectPublicKeyInfo'{subjectPublicKey = SPK, algorithm=PA}.
 
 encode_supportedPublicKey(#'OTPSubjectPublicKeyInfo'{algorithm= PA =
 						     #'PublicKeyAlgorithm'{algorithm=Algo},
 						     subjectPublicKey = SPK0}) ->
     Type = supportedPublicKeyAlgorithms(Algo),
-    {ok, SPK} = 'OTP-PUB-KEY':encode(Type, SPK0),
+    SPK = case Type of
+              'ECPoint' ->
+                  SPK0#'ECPoint'.point;
+              _ ->
+                  {ok, SPK1} = 'OTP-PUB-KEY':encode(Type, SPK0),
+                  SPK1
+          end,
     #'OTPSubjectPublicKeyInfo'{subjectPublicKey = {0,SPK}, algorithm=PA}.
 
 %%% Extensions
diff --git a/lib/public_key/src/pubkey_pem.erl b/lib/public_key/src/pubkey_pem.erl
index 6bdc35fb79..746d142ec3 100644
--- a/lib/public_key/src/pubkey_pem.erl
+++ b/lib/public_key/src/pubkey_pem.erl
@@ -202,7 +202,11 @@ pem_start('CertificationRequest') ->
 pem_start('ContentInfo') ->
     <<"-----BEGIN PKCS7-----">>;
 pem_start('CertificateList') ->
-     <<"-----BEGIN X509 CRL-----">>.
+     <<"-----BEGIN X509 CRL-----">>;
+pem_start('OTPEcpkParameters') ->
+    <<"-----BEGIN EC PARAMETERS-----">>;
+pem_start('ECPrivateKey') ->
+    <<"-----BEGIN EC PRIVATE KEY-----">>.
 
 pem_end(<<"-----BEGIN CERTIFICATE-----">>) ->
     <<"-----END CERTIFICATE-----">>;
@@ -226,6 +230,10 @@ pem_end(<<"-----BEGIN PKCS7-----">>) ->
     <<"-----END PKCS7-----">>;
 pem_end(<<"-----BEGIN X509 CRL-----">>) ->
     <<"-----END X509 CRL-----">>;
+pem_end(<<"-----BEGIN EC PARAMETERS-----">>) ->
+    <<"-----END EC PARAMETERS-----">>;
+pem_end(<<"-----BEGIN EC PRIVATE KEY-----">>) ->
+    <<"-----END EC PRIVATE KEY-----">>;
 pem_end(_) ->
     undefined.
 
@@ -250,7 +258,11 @@ asn1_type(<<"-----BEGIN CERTIFICATE REQUEST-----">>) ->
 asn1_type(<<"-----BEGIN PKCS7-----">>) ->
     'ContentInfo';
 asn1_type(<<"-----BEGIN X509 CRL-----">>) ->
-    'CertificateList'.
+    'CertificateList';
+asn1_type(<<"-----BEGIN EC PARAMETERS-----">>) ->
+    'OTPEcpkParameters';
+asn1_type(<<"-----BEGIN EC PRIVATE KEY-----">>) ->
+    'ECPrivateKey'.
 
 pem_decrypt() ->
     <<"Proc-Type: 4,ENCRYPTED">>.
diff --git a/lib/public_key/src/public_key.erl b/lib/public_key/src/public_key.erl
index 736c18cdd4..6c25428ea4 100644
--- a/lib/public_key/src/public_key.erl
+++ b/lib/public_key/src/public_key.erl
@@ -94,7 +94,9 @@ pem_entry_decode({'SubjectPublicKeyInfo', Der, _}) ->
             der_decode(KeyType, Key0);
         'DSAPublicKey' ->
             {params, DssParams} = der_decode('DSAParams', Params),
-            {der_decode(KeyType, Key0), DssParams}
+            {der_decode(KeyType, Key0), DssParams};
+        'ECPrivateKey' ->
+            der_decode(KeyType, Key0)
     end;
 pem_entry_decode({Asn1Type, Der, not_encrypted}) when is_atom(Asn1Type),
 						      is_binary(Der) ->
@@ -336,6 +338,40 @@ format_rsa_private_key(#'RSAPrivateKey'{modulus = N, publicExponent = E,
 					privateExponent = D}) ->
    [crypto:mpint(K) || K <- [E, N, D]].
 
+%%
+%% Description: convert a ECPrivate key into resource Key
+%%--------------------------------------------------------------------
+list2int(L) ->
+    S = length(L) * 8,
+    <<R:S/integer>> = erlang:iolist_to_binary(L),
+    R.
+
+ec_private_key_to_eckey(#'ECPrivateKey'{privateKey = PrivKey,
+					parameters = Param,
+					publicKey = _PubKey}) ->
+    ECCurve = case Param of
+                  #'OTPECParameters'{ fieldID = FieldId, curve = PCurve, base = Base, order = Order, cofactor = CoFactor } ->
+                      Field = {pubkey_cert_records:supportedCurvesTypes(FieldId#'OTPFieldID'.fieldType), FieldId#'OTPFieldID'.parameters},
+                      Curve = {list2int(PCurve#'Curve'.a), list2int(PCurve#'Curve'.b), none},
+                      {Field, Curve, erlang:list_to_binary(Base), Order, CoFactor};
+                  {namedCurve, OID} ->
+                      pubkey_cert_records:namedCurves(OID)
+              end,
+    Key = {ECCurve, list2int(PrivKey), undefined},
+    {'ECKey', crypto:term_to_ec_key(Key)}.
+
+ec_public_key_to_eckey({#'ECPoint'{point = ECPoint}, Param}) ->
+    ECCurve = case Param of
+                  #'OTPECParameters'{ fieldID = FieldId, curve = PCurve, base = Base, order = Order, cofactor = CoFactor } ->
+                      Field = {pubkey_cert_records:supportedCurvesTypes(FieldId#'OTPFieldID'.fieldType), FieldId#'OTPFieldID'.parameters},
+                      Curve = {list2int(PCurve#'Curve'.a), list2int(PCurve#'Curve'.b), none},
+                      {Field, Curve, erlang:list_to_binary(Base), Order, CoFactor};
+                  {namedCurve, OID} ->
+                      pubkey_cert_records:namedCurves(OID)
+              end,
+    Key = {ECCurve, undefined, ECPoint},
+    {'ECKey', crypto:term_to_ec_key(Key)}.
+
 %%--------------------------------------------------------------------
 
 -spec pkix_sign_types(SignatureAlg::oid()) ->
@@ -362,7 +398,15 @@ pkix_sign_types(?md5WithRSAEncryption) ->
 pkix_sign_types(?'id-dsa-with-sha1') ->
     {sha, dsa};
 pkix_sign_types(?'id-dsaWithSHA1') ->
-    {sha, dsa}.
+    {sha, dsa};
+pkix_sign_types(?'ecdsa-with-SHA1') ->
+    {sha, ecdsa};
+pkix_sign_types(?'ecdsa-with-SHA256') ->
+    {sha256, ecdsa};
+pkix_sign_types(?'ecdsa-with-SHA384') ->
+    {sha384, ecdsa};
+pkix_sign_types(?'ecdsa-with-SHA512') ->
+    {sha512, ecdsa}.
 
 %%--------------------------------------------------------------------
 -spec sign(binary() | {digest, binary()},  rsa_digest_type() | dss_digest_type(),
@@ -386,6 +430,18 @@ sign(PlainText, sha, #'DSAPrivateKey'{p = P, q = Q, g = G, x = X}) ->
           [crypto:mpint(P), crypto:mpint(Q),
            crypto:mpint(G), crypto:mpint(X)]);
 
+sign(Digest, DigestType, Key = {?'id-ecPublicKey', _, _}) ->
+    sign(Digest, DigestType, ec_public_key_to_eckey(Key));
+
+sign(Digest, DigestType, Key = #'ECPrivateKey'{}) ->
+    sign(Digest, DigestType, ec_private_key_to_eckey(Key));
+
+sign({digest,_}=Digest, DigestType, {'ECKey', Key}) ->
+    crypto:ecdsa_sign(DigestType, Digest, Key);
+
+sign(PlainText, DigestType, {'ECKey', Key}) ->
+    crypto:ecdsa_sign(DigestType, sized_binary(PlainText), Key);
+
 %% Backwards compatible
 sign(Digest, none, #'DSAPrivateKey'{} = Key) ->
     sign({digest,Digest}, sha, Key).
@@ -414,6 +470,24 @@ verify({digest,_}=Digest, sha, Signature, {Key,  #'Dss-Parms'{p = P, q = Q, g =
     crypto:dss_verify(Digest, sized_binary(Signature),
 		      [crypto:mpint(P), crypto:mpint(Q), 
 		       crypto:mpint(G), crypto:mpint(Key)]);
+
+verify({digest,_}=Digest, DigestType, Signature, {'ECKey', Key}) ->
+    crypto:ecdsa_verify(DigestType, Digest,
+			sized_binary(Signature),
+			Key);
+
+verify(PlainText, DigestType, Signature, Key = #'ECPrivateKey'{}) ->
+    verify(PlainText, DigestType, Signature, ec_private_key_to_eckey(Key));
+
+verify(PlainText, DigestType, Signature, Key = {#'ECPoint'{}, _}) ->
+    verify(PlainText, DigestType, Signature, ec_public_key_to_eckey(Key));
+
+verify(PlainText, DigestType, Signature, {'ECKey', Key}) ->
+    crypto:ecdsa_verify(DigestType,
+			sized_binary(PlainText),
+			sized_binary(Signature),
+			Key);
+
 %% Backwards compatibility
 verify(Digest, none, Signature, {_,  #'Dss-Parms'{}} = Key ) ->
     verify({digest,Digest}, sha, Signature, Key);
@@ -458,7 +532,17 @@ pkix_verify(DerCert, {Key, #'Dss-Parms'{}} = DSAKey)
 pkix_verify(DerCert,  #'RSAPublicKey'{} = RSAKey) 
   when is_binary(DerCert) ->
     {DigestType, PlainText, Signature} = pubkey_cert:verify_data(DerCert),
-    verify(PlainText, DigestType, Signature, RSAKey).
+    verify(PlainText, DigestType, Signature, RSAKey);
+
+pkix_verify(DerCert,  #'ECPrivateKey'{} = ECKey)
+  when is_binary(DerCert) ->
+    {DigestType, PlainText, Signature} = pubkey_cert:verify_data(DerCert),
+    verify(PlainText, DigestType, Signature, ECKey);
+
+pkix_verify(DerCert, Key = {'ECKey', _})
+  when is_binary(DerCert) ->
+    {DigestType, PlainText, Signature} = pubkey_cert:verify_data(DerCert),
+    verify(PlainText, DigestType, Signature,  Key).
 
 %%--------------------------------------------------------------------
 -spec pkix_is_issuer(Cert :: der_encoded()| #'OTPCertificate'{} | #'CertificateList'{},
diff --git a/lib/public_key/test/erl_make_certs.erl b/lib/public_key/test/erl_make_certs.erl
index 897cf2f350..14efbcc7e0 100644
--- a/lib/public_key/test/erl_make_certs.erl
+++ b/lib/public_key/test/erl_make_certs.erl
@@ -45,7 +45,7 @@
 %%      {dnQualifer, DnQ}
 %%   issuer = {Issuer, IssuerKey}                   true (i.e. a ca cert is created) 
 %%                                                  (obs IssuerKey migth be {Key, Password}
-%%   key = KeyFile|KeyBin|rsa|dsa                   Subject PublicKey rsa or dsa generates key
+%%   key = KeyFile|KeyBin|rsa|dsa|ec                Subject PublicKey rsa, dsa or ec generates key
 %%   
 %%
 %%   (OBS: The generated keys are for testing only)
@@ -91,6 +91,16 @@ gen_dsa(LSize,NSize) when is_integer(LSize), is_integer(NSize) ->
     {Key, encode_key(Key)}.
 
 %%--------------------------------------------------------------------
+%% @doc Creates a ec key (OBS: for testing only)
+%%   the sizes are in bytes
+%% @spec (::integer()) -> {::atom(), ::binary(), ::opaque()}
+%% @end
+%%--------------------------------------------------------------------
+gen_ec(Curve) when is_atom(Curve) ->
+    Key = gen_ec2(Curve),
+    {Key, encode_key(Key)}.
+
+%%--------------------------------------------------------------------
 %% @doc Verifies cert signatures
 %% @spec (::binary(), ::tuple()) -> ::boolean()
 %% @end
@@ -102,7 +112,10 @@ verify_signature(DerEncodedCert, DerKey, _KeyParams) ->
 	    public_key:pkix_verify(DerEncodedCert, 
 				   #'RSAPublicKey'{modulus=Mod, publicExponent=Exp});
 	#'DSAPrivateKey'{p=P, q=Q, g=G, y=Y} ->
-	    public_key:pkix_verify(DerEncodedCert, {Y, #'Dss-Parms'{p=P, q=Q, g=G}})
+	    public_key:pkix_verify(DerEncodedCert, {Y, #'Dss-Parms'{p=P, q=Q, g=G}});
+	#'ECPrivateKey'{version = _Version, privateKey = _PrivKey,
+			parameters = _Params, publicKey = _PubKey} ->
+	    public_key:pkix_verify(DerEncodedCert, Key)
     end.
 
 %%%%%%%%%%%%%%%%%%%%%%%%% Implementation %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
@@ -112,6 +125,7 @@ get_key(Opts) ->
 	undefined -> make_key(rsa, Opts);
 	rsa ->       make_key(rsa, Opts);
 	dsa ->       make_key(dsa, Opts);
+	ec ->        make_key(ec, Opts);
 	Key ->
 	    Password = proplists:get_value(password, Opts, no_passwd),
 	    decode_key(Key, Password)
@@ -129,6 +143,8 @@ decode_key(#'RSAPrivateKey'{} = Key,_) ->
     Key;
 decode_key(#'DSAPrivateKey'{} = Key,_) ->
     Key;
+decode_key(#'ECPrivateKey'{} = Key,_) ->
+    Key;
 decode_key(PemEntry = {_,_,_}, Pw) ->
     public_key:pem_entry_decode(PemEntry, Pw);
 decode_key(PemBin, Pw) ->
@@ -140,7 +156,10 @@ encode_key(Key = #'RSAPrivateKey'{}) ->
     {'RSAPrivateKey', Der, not_encrypted};
 encode_key(Key = #'DSAPrivateKey'{}) ->
     {ok, Der} = 'OTP-PUB-KEY':encode('DSAPrivateKey', Key),
-    {'DSAPrivateKey', Der, not_encrypted}.
+    {'DSAPrivateKey', Der, not_encrypted};
+encode_key(Key = #'ECPrivateKey'{}) ->
+    {ok, Der} = 'OTP-PUB-KEY':encode('ECPrivateKey', Key),
+    {'ECPrivateKey', Der, not_encrypted}.
 
 make_tbs(SubjectKey, Opts) ->    
     Version = list_to_atom("v"++integer_to_list(proplists:get_value(version, Opts, 3))),
@@ -282,7 +301,14 @@ publickey(#'RSAPrivateKey'{modulus=N, publicExponent=E}) ->
 publickey(#'DSAPrivateKey'{p=P, q=Q, g=G, y=Y}) ->
     Algo = #'PublicKeyAlgorithm'{algorithm= ?'id-dsa', 
 				 parameters={params, #'Dss-Parms'{p=P, q=Q, g=G}}},
-    #'OTPSubjectPublicKeyInfo'{algorithm = Algo, subjectPublicKey = Y}.
+    #'OTPSubjectPublicKeyInfo'{algorithm = Algo, subjectPublicKey = Y};
+publickey(#'ECPrivateKey'{version = _Version,
+			  privateKey = _PrivKey,
+			  parameters = Params,
+			  publicKey = {0, PubKey}}) ->
+    Algo = #'PublicKeyAlgorithm'{algorithm= ?'id-ecPublicKey', parameters=Params},
+    #'OTPSubjectPublicKeyInfo'{algorithm = Algo,
+			       subjectPublicKey = #'ECPoint'{point = PubKey}}.
 
 validity(Opts) ->
     DefFrom0 = calendar:gregorian_days_to_date(calendar:date_to_gregorian_days(date())-1),
@@ -303,13 +329,24 @@ sign_algorithm(#'RSAPrivateKey'{}, Opts) ->
 	   end,
     {Type, 'NULL'};
 sign_algorithm(#'DSAPrivateKey'{p=P, q=Q, g=G}, _Opts) ->
-    {?'id-dsa-with-sha1', {params,#'Dss-Parms'{p=P, q=Q, g=G}}}.
+    {?'id-dsa-with-sha1', {params,#'Dss-Parms'{p=P, q=Q, g=G}}};
+sign_algorithm(#'ECPrivateKey'{}, Opts) ->
+    Type = case proplists:get_value(digest, Opts, sha1) of
+	       sha1 ->   ?'ecdsa-with-SHA1';
+	       sha512 -> ?'ecdsa-with-SHA512';
+	       sha384 -> ?'ecdsa-with-SHA384';
+	       sha256 -> ?'ecdsa-with-SHA256'
+	   end,
+    {Type, 'NULL'}.
 
 make_key(rsa, _Opts) ->
     %% (OBS: for testing only)
     gen_rsa2(64);
 make_key(dsa, _Opts) ->
-    gen_dsa2(128, 20).  %% Bytes i.e. {1024, 160} 
+    gen_dsa2(128, 20);  %% Bytes i.e. {1024, 160}
+make_key(ec, _Opts) ->
+    %% (OBS: for testing only)
+    gen_ec2(secp256k1).
     
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 %% RSA key generation  (OBS: for testing only)
@@ -368,6 +405,24 @@ gen_dsa2(LSize, NSize) ->
 	    #'DSAPrivateKey'{version=0, p=P, q=Q, g=G, y=Y, x=X}
     end.
     
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+%% EC key generation  (OBS: for testing only)
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+
+int2list(I) ->
+    L = (length(integer_to_list(I, 16)) + 1) div 2,
+    binary_to_list(<<I:(L*8)>>).
+
+gen_ec2(CurveId) ->
+    Key = crypto:ec_key_new(CurveId),
+    crypto:ec_key_generate(Key),
+    {_Curve, PrivKey, PubKey} = crypto:ec_key_to_term(Key),
+
+    #'ECPrivateKey'{version = 1,
+		    privateKey = int2list(PrivKey),
+		    parameters = {namedCurve, pubkey_cert_records:namedCurves(CurveId)},
+		    publicKey = {0, PubKey}}.
+
 %% See fips_186-3.pdf
 dsa_search(T, P0, Q, Iter) when Iter > 0 ->
     P = 2*T*Q*P0 + 1,