OpenSSL ECDH key exchange mechanism I am using FIPS based OpenSSL module for encryption of sensitive data for my desktop socket server and client applications. I am using ECDH for key agreement.The keys public and private pair is generated for server and client on same curve NID_secp521r1. Now I want to exchange the public key between client and server and has following questions.

The generated private key is same for both client and server is it true? Client send its public key first or Server? The public key should be send plain or it should be signed? If signed then what will be the mechanism? I want to reuse my public/private key on server where I store that keys in application exe? PEM file? Any other options?
The generated private key is same for both client and server is it true? 


No, that's not true. The key pairs and thus the private keys will be different. They will only be the same if the random number generator creates 521 identical bits for both the server and the client when the key pairs are generated.


  Client send its public key first or Server?


That doesn't matter, whatever is more efficient.


  The public key should be send plain or it should be signed?


Plain will do, if you perform authentication afterwards. TLS signs and verifies all the packets send, after the key agreement. You do need to check if the public key represents a valid point on the curve though.


  If signed then what will be the mechanism?


Depends on the protocol. Anything that can perform signing or MAC authentication really.


  I want to reuse my public/private key on server where I store that keys in application exe?


Whereever they are most secure. If you use them in software then for OpenSSL the PKCS#12 format probably makes the most sense. It doesn't matter if the PKCS#12 key store is stored as PEM or DER format.



Unless you need an ultra lightweight protocol using TLS itself makes an awful lot of sense. If you really must design your own protocol, then first learn and understand TLS.