feat(crypto): support the mainnet secp256r1 ECDSA keys in ic-pub-key

packages/ic-pub-key/BUILD.bazel

@@ -2,19 +2,23 @@ load("@rules_rust//rust:defs.bzl", "rust_doc", "rust_doc_test", "rust_library",
 
 package(default_visibility = ["//visibility:public"])
 
+FEATURES = [
+    "secp256k1",
+    "secp256r1",
+    "ed25519",
+    "vetkeys",
+]
+
 rust_library(
     name = "ic-pub-key",
     srcs = glob(["src/**/*.rs"]),
-    crate_features = [
-        "secp256k1",
-        "ed25519",
-        "vetkeys",
-    ],
+    crate_features = FEATURES,
     crate_name = "ic_pub_key",
     version = "0.3.0",
     deps = [
         "//packages/ic-ed25519",
         "//packages/ic-secp256k1",
+        "//packages/ic-secp256r1",
         "@crate_index//:ic-cdk-management-canister",
         "@crate_index//:ic-management-canister-types",
         "@crate_index//:ic-vetkeys",
@@ -27,42 +31,26 @@ rust_library(
 rust_doc(
     name = "doc",
     crate = ":ic-pub-key",
-    rustdoc_flags = [
-        "--cfg=feature=\"secp256k1\"",
-        "--cfg=feature=\"ed25519\"",
-        "--cfg=feature=\"vetkeys\"",
-    ],
+    rustdoc_flags = ["--cfg=feature=\"%s\"" % feature for feature in FEATURES],
 )
 
 rust_doc_test(
     name = "doc_test",
     crate = ":ic-pub-key",
-    crate_features = [
-        "secp256k1",
-        "ed25519",
-        "vetkeys",
-    ],
+    crate_features = FEATURES,
     deps = [":ic-pub-key"],
 )
 
 rust_test(
     name = "unit_tests",
     crate = ":ic-pub-key",
-    crate_features = [
-        "secp256k1",
-        "ed25519",
-        "vetkeys",
-    ],
+    crate_features = FEATURES,
 )
 
 rust_test_suite(
     name = "integration_tests",
     srcs = glob(["tests/**/*.rs"]),
-    crate_features = [
-        "secp256k1",
-        "ed25519",
-        "vetkeys",
-    ],
+    crate_features = FEATURES,
     deps = [
         ":ic-pub-key",
         "@crate_index//:hex",

packages/ic-pub-key/CHANGELOG.md

@@ -7,9 +7,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+
+- Add offline derivation for ECDSA keys over the secp256r1 curve, behind the new (default) `secp256r1` feature. It supports the mainnet keys `key_1` and `test_key_1` as well as the PocketIC keys.
+
 ### Changed
 
 - Upgrade the `ic-management-canister-types` dependency from `0.5.0` to `0.11.0`. The re-exported types now come from that version.
+- Upgrade the (optional) `ic-vetkeys` dependency from `0.6.0` to `0.7.0`.
+- The `vetkeys` feature now also depends on `ic-cdk-management-canister`.
 
 ## [0.3.0] - 2026-02-04
 

packages/ic-pub-key/Cargo.toml

@@ -11,14 +11,16 @@ edition.workspace = true
 documentation.workspace = true
 
 [features]
-default = ["secp256k1", "ed25519", "vetkeys"]
+default = ["secp256k1", "secp256r1", "ed25519", "vetkeys"]
 
 secp256k1 = ["dep:ic-secp256k1"]
+secp256r1 = ["dep:ic-secp256r1"]
 ed25519 = ["dep:ic-ed25519"]
 vetkeys = ["dep:ic-vetkeys", "dep:ic-cdk-management-canister"]
 
 [dependencies]
 ic-secp256k1 = { path = "../ic-secp256k1", version = "0.3.0", optional = true }
+ic-secp256r1 = { path = "../ic-secp256r1", version = "0.3.0", optional = true }
 ic-ed25519 = { path = "../ic-ed25519", version = "0.6.0", optional = true }
 ic-vetkeys = { workspace = true, optional = true }
 ic-cdk-management-canister = { workspace = true, optional = true }

packages/ic-pub-key/README.md

@@ -9,3 +9,11 @@ context data.
 This derivation can be performed "online" by a canister using a query call, but
 this is inconvenient in some usage scenarios. This crate offers an alternative,
 namely fully *offline* key derivation.
+
+### Features
+
+Each kind of key needs its feature, and all of them are enabled by default:
+`secp256k1` (ECDSA over secp256k1 and BIP340 Schnorr), `secp256r1` (ECDSA over
+secp256r1), `ed25519` (Ed25519 Schnorr) and `vetkeys` (VetKD). To build only some
+of them, for example to keep a canister's Wasm small, depend on this crate with
+`default-features = false` and enable the features you need.