// May be overridden by a flag at startup.
	KubeletHealthzPort = 10248
	// ProxyHealthzPort is the default port for the proxy healthz server.
	// May be overridden by a flag at startup.
	ProxyHealthzPort = 10256
	// KubeControllerManagerPort is the default port for the controller manager status server.
	// May be overridden by a flag at startup.
	KubeControllerManagerPort = 10257

	tests := []struct {
		name           string
		cfg            *ClusterConfiguration
		expectedResult EncryptionAlgorithmType
	}{
		{
			name: "feature gate is set to true, return ECDSA-P256",
			cfg: &ClusterConfiguration{
				FeatureGates: map[string]bool{
					features.PublicKeysECDSA: true,
				},
				EncryptionAlgorithm: EncryptionAlgorithmRSA4096,
			},

		p256BigToLittle(&r.x, (*[32]byte)(b[1:33]))
		if p256LessThanP(&r.x) == 0 {
			return nil, errors.New("invalid P256 element encoding")
		}
		p256Mul(&r.x, &r.x, &rr)

		// y² = x³ - 3x + b
		p256Polynomial(&r.y, &r.x)
		if !p256Sqrt(&r.y, &r.y) {
			return nil, errors.New("invalid P256 compressed point encoding")
		}

		// Select the positive or negative root, as indicated by the least

	// KLMD function codes
	ghash function = 65 // GHASH
)

const (
	// KDSA function codes
	ecdsaVerifyP256    function = 1  // NIST P256
	ecdsaVerifyP384    function = 2  // NIST P384
	ecdsaVerifyP521    function = 3  // NIST P521
	ecdsaSignP256      function = 9  // NIST P256
	ecdsaSignP384      function = 10 // NIST P384
	ecdsaSignP521      function = 11 // NIST P521
	eddsaVerifyEd25519 function = 32 // Curve25519

	keySize = flag.Int("key-size", 2048, "Size of the generated private key")
	ec      = flag.String("ec-sig-alg", "", "Generate an elliptical curve private key with the specified algorithm")
	curve   = flag.String("curve", "P256", "Specify the elliptic curve to use to generate an elliptical curve private key")
)

func saveCreds(csrPem []byte, privPem []byte) {
	err := os.WriteFile(*outCsr, csrPem, 0o644)
	if err != nil {

		return ecdh.X25519(), true
	case CurveP256:
		return ecdh.P256(), true
	case CurveP384:
		return ecdh.P384(), true
	case CurveP521:
		return ecdh.P521(), true
	default:
		return nil, false
	}
}

func curveIDForCurve(curve ecdh.Curve) (CurveID, bool) {
	switch curve {
	case ecdh.X25519():
		return X25519, true
	case ecdh.P256():
		return CurveP256, true
	case ecdh.P384():

			sigAlgs = []SignatureScheme{
				ECDSAWithP256AndSHA256,
				ECDSAWithP384AndSHA384,
				ECDSAWithP521AndSHA512,
				ECDSAWithSHA1,
			}
			break
		}
		switch pub.Curve {
		case elliptic.P256():
			sigAlgs = []SignatureScheme{ECDSAWithP256AndSHA256}
		case elliptic.P384():
			sigAlgs = []SignatureScheme{ECDSAWithP384AndSHA384}
		case elliptic.P521():
			sigAlgs = []SignatureScheme{ECDSAWithP521AndSHA512}

// SupportedEllipticCurves are the types of curves
// to be used in key generation (e.g. P256, P384)
type SupportedEllipticCurves string

const (
	// only ECDSA is currently supported
	EcdsaSigAlg SupportedECSignatureAlgorithms = "ECDSA"

	// supported curves when using ECC
	P256Curve SupportedEllipticCurves = "P256"
	P384Curve SupportedEllipticCurves = "P384"
)

		Gy: bigFromHex("bd376388b5f723fb4c22dfe6cd4375a05a07476444d5819985007e34"),
	}
}

type p256Curve struct {
	nistCurve[*nistec.P256Point]
}

var p256 = &p256Curve{nistCurve[*nistec.P256Point]{
	newPoint: nistec.NewP256Point,
}}

func initP256() {
	p256.params = &CurveParams{
		Name:    "P-256",
		BitSize: 256,
		// FIPS 186-4, section D.1.2.3

	if options.ECSigAlg != "" {
		switch options.ECSigAlg {
		case EcdsaSigAlg:
			var curve elliptic.Curve
			switch options.ECCCurve {
			case P384Curve:
				curve = elliptic.P384()
			default:
				curve = elliptic.P256()
			}
			priv, err = ecdsa.GenerateKey(curve, rand.Reader)
			if err != nil {
				return nil, nil, fmt.Errorf("EC key generation failed (%v)", err)
			}
		default: