SEA.pair()
Generate a new cryptographic key pair for use with SEA. Each pair contains keys for both signing/verifying and encryption/decryption.
Syntax
Parameters
- callback (function, optional): Called with generated key pair
- options (object, optional): Reserved for future configuration
Returns
A Promise that resolves to a key pair object:
Basic Usage
With Async/Await
With Callback
With Promises
Key Pair Structure
Reference: ~/workspace/source/sea/pair.js:22-62
ECDSA Keys (Signing/Verifying)
Used with SEA.sign() and SEA.verify():
Algorithm: ECDSA with P-256 curve (also known as secp256r1 or prime256v1)
ECDH Keys (Encryption/Decryption)
Used with SEA.encrypt(), SEA.decrypt(), and SEA.secret():
Algorithm: ECDH with P-256 curve
How It Works
The key generation process:
-
ECDSA Generation: Creates a P-256 key pair for signing
- Uses Web Crypto API
generateKey()
- Exports to JWK format
- Extracts x, y coordinates (public) and d scalar (private)
-
ECDH Generation: Creates a P-256 key pair for encryption
- Uses Web Crypto API
generateKey()
- Exports to JWK format
- Extracts x, y coordinates (public) and d scalar (private)
-
Key Format: Combines into single object
- Public keys: Base64-encoded x.y format (URL-safe)
- Private keys: Base64-encoded d value
Reference: ~/workspace/source/sea/pair.js:23-62
Public keys are formatted as x.y where:
x and y are elliptic curve point coordinates
- Both are base64-encoded
- Separated by
. (a non-base64 character)
- URL and filename safe (RFC 3986)
Private keys are base64-encoded scalar values:
Never expose private keys! The priv and epriv values must be kept secret. Anyone with access to these can impersonate the user, decrypt their data, and sign messages on their behalf.
Use Cases
Creating a New User
Bot or Service Account
Derive Key ID
Generate a PGPv4-compliant key ID:
Cryptographic Details
Elliptic Curve: P-256
SEA uses the NIST P-256 curve (secp256r1):
- Security Level: 128-bit
- Key Size: 256 bits
- Standard: FIPS 186-4, SEC 2
- Also known as: prime256v1, secp256r1
Web Crypto API
Key generation uses the native Web Crypto API:
Keys are exported as JSON Web Keys (JWK):
Error Handling
Environment Compatibility
Browser
Requires Web Crypto API (available in modern browsers over HTTPS):
Node.js
Uses @peculiar/webcrypto polyfill:
Reference: ~/workspace/source/sea/pair.js:21
In some Node.js environments, ECDH key generation may fail if the @peculiar/webcrypto package is not installed. SEA will gracefully fall back to ECDSA-only keys in this case.
Security Considerations
Key Storage
Private keys should be:
- Encrypted at rest (use
SEA.encrypt() with a password)
- Never transmitted over insecure channels
- Never logged or exposed in error messages
- Stored in secure storage (not localStorage)
Example: Secure Storage
Key Rotation
Consider rotating keys periodically:
Entropy
Key generation relies on cryptographically secure random number generation. The Web Crypto API ensures sufficient entropy.
Common Patterns
Generate Multiple Pairs
Export for Backup
Share Public Keys Only
Key generation is computationally intensive:
- Time: ~10-50ms per pair (varies by device)
- Async: Always use async/await or callbacks
- Caching: Generate once, reuse the pair