Add default ECC P-256 support for mTLS keys

This change updates the default key generation algorithm for mTLS keys
from RSA 2048 to ECC P-256 (secp256r1) for improved security and
performance characteristics.

Key changes:
- Updated keylime-agent/src/main.rs to use Ecc256 instead of Rsa2048
  for mTLS key generation via load_or_generate_key()
- Updated keylime/src/cert.rs cert_from_server_key() function to
  generate ECC P-256 keys instead of RSA 2048 when creating new keys

Benefits:
- Smaller key sizes (256-bit vs 2048-bit) with equivalent security
- Faster key generation and cryptographic operations
- Lower memory and storage footprint
- Better performance in embedded and resource-constrained environments

Backward compatibility:
- Existing RSA keys will continue to work due to load_or_generate_key
  logic that loads existing keys regardless of algorithm
- Algorithm validation is disabled for mTLS keys to maintain compatibility
- Only affects new key generation when no existing key file is found

The ECC P-256 curve (X9_62_PRIME256V1/secp256r1) is widely supported,
FIPS 186-4 approved, and provides 128-bit security level equivalent
to RSA 3072.

Co-Authored-By: Claude <[email protected]>
Signed-off-by: Sergio Arroutbi <[email protected]>

Author: sarroutbi

keylime-agent/src/main.rs

@@ -515,11 +515,12 @@ async fn main() -> Result<()> {
 
     // Load or generate mTLS key pair (separate from payload keys)
     // The mTLS key is always persistent, stored at the configured path.
+    // Uses ECC P-256 by default for better security and performance
     let key_path = Path::new(&config.server_key);
     let (mtls_pub, mtls_priv) = crypto::load_or_generate_key(
         key_path,
         Some(config.server_key_password.as_ref()),
-        keylime::algorithms::EncryptionAlgorithm::Rsa2048,
+        keylime::algorithms::EncryptionAlgorithm::Ecc256,
         false, // Don't validate algorithm for mTLS keys (for backward compatibility)
     )?;
 

keylime/src/cert.rs

@@ -16,14 +16,19 @@ pub struct CertificateConfig {
 pub fn cert_from_server_key(
     config: &CertificateConfig,
 ) -> Result<(X509, PKey<Public>)> {
+    use openssl::ec::EcGroup;
+    use openssl::nid::Nid;
+
     let cert: X509;
     let (mtls_pub, mtls_priv) = match config.server_key.as_ref() {
         "" => {
             debug!(
                 "The server_key option was not set in the configuration file"
             );
-            debug!("Generating new key pair");
-            crypto::rsa_generate_pair(2048)?
+            debug!("Generating new ECC P-256 key pair");
+            let group = EcGroup::from_curve_name(Nid::X9_62_PRIME256V1)
+                .map_err(crypto::CryptoError::ECGroupFromNidError)?;
+            crypto::ecc_generate_pair(&group)?
         }
         path => {
             let key_path = Path::new(&path);
@@ -37,8 +42,11 @@ pub fn cert_from_server_key(
                     Some(&config.server_key_password),
                 )?
             } else {
-                debug!("Generating new key pair");
-                let (public, private) = crypto::rsa_generate_pair(2048)?;
+                debug!("Generating new ECC P-256 key pair");
+                let group =
+                    EcGroup::from_curve_name(Nid::X9_62_PRIME256V1)
+                        .map_err(crypto::CryptoError::ECGroupFromNidError)?;
+                let (public, private) = crypto::ecc_generate_pair(&group)?;
                 // Write the generated key to the file
                 crypto::write_key_pair(
                     &private,