vapid.py

def generate_vapid_key():
    # from the ruby gem:
    # > @curve = OpenSSL::PKey::EC.new('prime256v1')
    # > private_key = encode64(curve.private_key.to_s(2))
    # > public_key = encode64(curve.public_key.to_bn.to_s(2))
    # encode64 is urlsafe_encode64, RFC4648
    # to_s(2) on an openssl bn is BN_bn2bin for some fucked up reason
    # (while to_s(10) is ASCII decimal and to_s(16) ASCII hex)
    # (while on standard ruby bignum to_s(2) is ASCII 0/1 string)

    # py-vapid generates keys, but then it's a dependency for 4 lines.
    from cryptography.hazmat.backends import default_backend
    from cryptography.hazmat.primitives.asymmetric import ec
    skey = ec.generate_private_key(ec.SECP256R1, default_backend())
    pkey = skey.public_key()

    from math import ceil
    skey = (skey.private_numbers().private_value
            .to_bytes(int(ceil(skey.key_size / 8)), 'big'))
    pkey = pkey.public_numbers().encode_point()

    skey = base64.urlsafe_b64encode(skey).decode('ascii')
    pkey = base64.urlsafe_b64encode(pkey).decode('ascii')

    return skey, pkey