Skip to main content

SEA.pair()

Generate a new cryptographic key pair for use with SEA. Each pair contains keys for both signing/verifying and encryption/decryption.

Syntax

Parameters

  • callback (function, optional): Called with generated key pair
  • options (object, optional): Reserved for future configuration

Returns

A Promise that resolves to a key pair object:

Basic Usage

With Async/Await

With Callback

With Promises

Key Pair Structure

Reference: ~/workspace/source/sea/pair.js:22-62

ECDSA Keys (Signing/Verifying)

Used with SEA.sign() and SEA.verify():
Algorithm: ECDSA with P-256 curve (also known as secp256r1 or prime256v1)

ECDH Keys (Encryption/Decryption)

Used with SEA.encrypt(), SEA.decrypt(), and SEA.secret():
Algorithm: ECDH with P-256 curve

How It Works

The key generation process:
  1. ECDSA Generation: Creates a P-256 key pair for signing
    • Uses Web Crypto API generateKey()
    • Exports to JWK format
    • Extracts x, y coordinates (public) and d scalar (private)
  2. ECDH Generation: Creates a P-256 key pair for encryption
    • Uses Web Crypto API generateKey()
    • Exports to JWK format
    • Extracts x, y coordinates (public) and d scalar (private)
  3. Key Format: Combines into single object
    • Public keys: Base64-encoded x.y format (URL-safe)
    • Private keys: Base64-encoded d value
Reference: ~/workspace/source/sea/pair.js:23-62

Key Format Details

Public Key Format

Public keys are formatted as x.y where:
  • x and y are elliptic curve point coordinates
  • Both are base64-encoded
  • Separated by . (a non-base64 character)
  • URL and filename safe (RFC 3986)

Private Key Format

Private keys are base64-encoded scalar values:
Never expose private keys! The priv and epriv values must be kept secret. Anyone with access to these can impersonate the user, decrypt their data, and sign messages on their behalf.

Use Cases

Creating a New User

Bot or Service Account

Derive Key ID

Generate a PGPv4-compliant key ID:

Cryptographic Details

Elliptic Curve: P-256

SEA uses the NIST P-256 curve (secp256r1):
  • Security Level: 128-bit
  • Key Size: 256 bits
  • Standard: FIPS 186-4, SEC 2
  • Also known as: prime256v1, secp256r1

Web Crypto API

Key generation uses the native Web Crypto API:

JWK Export Format

Keys are exported as JSON Web Keys (JWK):

Error Handling

Environment Compatibility

Browser

Requires Web Crypto API (available in modern browsers over HTTPS):

Node.js

Uses @peculiar/webcrypto polyfill:
Reference: ~/workspace/source/sea/pair.js:21
In some Node.js environments, ECDH key generation may fail if the @peculiar/webcrypto package is not installed. SEA will gracefully fall back to ECDSA-only keys in this case.

Security Considerations

Key Storage

Private keys should be:
  • Encrypted at rest (use SEA.encrypt() with a password)
  • Never transmitted over insecure channels
  • Never logged or exposed in error messages
  • Stored in secure storage (not localStorage)
Example: Secure Storage

Key Rotation

Consider rotating keys periodically:

Entropy

Key generation relies on cryptographically secure random number generation. The Web Crypto API ensures sufficient entropy.

Common Patterns

Generate Multiple Pairs

Export for Backup

Share Public Keys Only

Performance

Key generation is computationally intensive:
  • Time: ~10-50ms per pair (varies by device)
  • Async: Always use async/await or callbacks
  • Caching: Generate once, reuse the pair