Are different elliptic curves compatible? Regarding SubtleCrypto and curves P-256, P-384 and P-521.
Can I mix two different curves for key derivation?
For example performing key derivation between P-256 and P-521.
EDIT:
Can I mix two different curves to derive data?
(So not to derive keys, it is not what I meant)
No, it is not possible to mix domain parameters / curves when performing key derivation.
First of all, the implementations are likely to fail if they find curve identifiers. These can be single protocol specific bytes, OID's or named curves or full parameter sets, depending on the protocol.
Second, it is very likely that implementations will reject the public key value if the key value identifies the curve. It might also be that the key is related to the curve field (at least 2x curve field size for uncompressed keys and 1B + 1x curve field size for compressed keys).
Thirdly, it should try and see if the point is actually on the curve, it is very possible that this fails as well, if the implementation is correct. Some curves are designed in such as way that such checks are not necessary.
Finally when the operations are performed then the calculations would result in a non-matching &quot;shared&quot; secret. Subsequent validation that the shared secret is valid would fail (e.g. using an explicit MAC calculated from the shared secret or the first message MAC, usually from derived keys).
So no, you cannot &quot;mix curves&quot; in general, there needs to be some way to make sure that both sender / receiver use the same set of domain parameters / curve. This is rather independent of SubtleCrypto, of which I'm not a full expert (but it is a rather generic cryptographic API, so yeah).