How are ECC keys stored? I am trying to figure out what typical formats and sizes, etc. are, for storing ECC public and private keys.
Some quick research turned up X9.62 (to which I don't have access) and SEC1. But then there is also X.690 which includes DER and of course ASN.1. And let's not forget PEM.
If somebody could shed some light onto the relations of these things and what is commonly used I think it would be useful.
Broadly, the question that I am trying to get answered is: What do I need to implement to decently support ECC. That would include ECDH and transferring public keys over the wire to maybe a TLS or SSH implementation but also importing and exporting of keys generated using other tools.
Somewhat related: Public-key format for ECDSA as in FIPS 186-4?
For the private key, it's common to use PKCS#8, which is a container format - a header specifying the type of the key (RSA? ECC? Which ECC curve?) and the key itself. The key itself is specified in section C.4 of SEC 1. Everything here is encoded in ASN.1 DER (DER is a concrete encoding of the abstract ASN.1 encoding), which can be saved in raw binary format to disk, or in an ASCII format called PEM which has the DER encoded in Base64 and a header/footer. Which one to use (DER/PEM) is up to the application.
You can generate a key in this format by using the openssl genpkey command, e.g. openssl genpkey -algorithm EC -out eckey.pem -pkeyopt ec_paramgen_curve:P-256 -pkeyopt ec_param_enc:named_curve. The PEM header will be &quot;PRIVATE KEY&quot;.
Other possible formats are:

&quot;The key itself&quot; mentioned above directly, without the PKCS#8 header. There is no official name for this format. You can generate a key in this format with the openssl ecparam command. The PEM header will be &quot;EC PRIVATE KEY&quot;.
PKCS#12/PFX which is a container format like PKCS#8, but allows bundling the matching certificate.

The public key usually follows the &quot;Subject Public Key Info&quot; structure (which is a ASN.1 structured used in certificates to include the subject's public key). This is also specified in SEC 1, and you will have the same choice between DER and PEM. It's worth nothing that it's not very usual to store the public key by itself, it's either included with the private key or inside a certificate.
For Edwards and Montgomery curves everything is similar, but the &quot;key itself&quot; is encoded per RFC 8410.