func (km *nistPECDHKWPrivateKeyManager) validateKey(key *ecdhpb.EcdhAeadPrivateKey) (elliptic.Curve, error) {
	err := keyset.ValidateKeyVersion(key.Version, nistpECDHKWPrivateKeyVersion)
	if err != nil {
		return nil, fmt.Errorf("nistpkw_ecdh_private_key_manager: invalid key: %w", err)
	}
	return validateKeyFormat(key.PublicKey.Params)
}
validateKey validates the given ECDHPrivateKey and returns the KW curve.
package ecdh
import (
	"crypto/elliptic"
	"errors"
	"fmt"
	"github.com/golang/protobuf/proto"
	"github.com/google/tink/go/core/registry"
	hybrid "github.com/google/tink/go/hybrid/subtle"
	"github.com/google/tink/go/keyset"
	tinkpb "github.com/google/tink/go/proto/tink_go_proto"
	"github.com/hyperledger/aries-framework-go/pkg/crypto/tinkcrypto/primitive/composite"
	"github.com/hyperledger/aries-framework-go/pkg/crypto/tinkcrypto/primitive/composite/ecdh/subtle"
	ecdhpb "github.com/hyperledger/aries-framework-go/pkg/crypto/tinkcrypto/primitive/proto/ecdh_aead_go_proto"
)
const (
	nistpECDHKWPrivateKeyVersion = 0
	nistpECDHKWPrivateKeyTypeURL = "type.hyperledger.org/hyperledger.aries.crypto.tink.NistPEcdhKwPrivateKey"
)
var (
	errInvalidNISTPECDHKWPrivateKey       = errors.New("nistpkw_ecdh_private_key_manager: invalid key")
	errInvalidNISTPECDHKWPrivateKeyFormat = errors.New("nistpkw_ecdh_private_key_manager: invalid key format")
)
type nistPECDHKWPrivateKeyManager struct{}
var _ registry.PrivateKeyManager = (*nistPECDHKWPrivateKeyManager)(nil)
func newECDHNISTPAESPrivateKeyManager() *nistPECDHKWPrivateKeyManager {
	return new(nistPECDHKWPrivateKeyManager)
}
func (km *nistPECDHKWPrivateKeyManager) Primitive(serializedKey []byte) (interface{}, error) {
	if len(serializedKey) == 0 {
		return nil, errInvalidNISTPECDHKWPrivateKey
	}
	key := new(ecdhpb.EcdhAeadPrivateKey)
	err := proto.Unmarshal(serializedKey, key)
	if err != nil {
		return nil, errInvalidNISTPECDHKWPrivateKey
	}
	_, err = km.validateKey(key)
	if err != nil {
		return nil, errInvalidNISTPECDHKWPrivateKey
	}
	rEnc, err := composite.NewRegisterCompositeAEADEncHelper(key.PublicKey.Params.EncParams.AeadEnc)
	if err != nil {
		return nil, fmt.Errorf("nistpkw_ecdh_private_key_manager: NewRegisterCompositeAEADEncHelper "+
			"failed: %w", err)
	}
	return subtle.NewECDHAEADCompositeDecrypt(rEnc, key.PublicKey.Params.EncParams.CEK), nil
}
func (km *nistPECDHKWPrivateKeyManager) NewKey(serializedKeyFormat []byte) (proto.Message, error) {
	if len(serializedKeyFormat) == 0 {
		return nil, errInvalidNISTPECDHKWPrivateKeyFormat
	}
	keyFormat := new(ecdhpb.EcdhAeadKeyFormat)
	err := proto.Unmarshal(serializedKeyFormat, keyFormat)
	if err != nil {
		return nil, errInvalidNISTPECDHKWPrivateKeyFormat
	}
	curve, err := validateKeyFormat(keyFormat.Params)
	if err != nil {
		return nil, errInvalidNISTPECDHKWPrivateKeyFormat
	}
	if keyFormat.Params.EncParams.CEK != nil {
		return &ecdhpb.EcdhAeadPrivateKey{
			Version:  nistpECDHKWPrivateKeyVersion,
			KeyValue: []byte{},
			PublicKey: &ecdhpb.EcdhAeadPublicKey{
				Version: nistpECDHKWPrivateKeyVersion,
				Params:  keyFormat.Params,
				X:       []byte{},
				Y:       []byte{},
			},
		}, nil
	}
	pvt, err := hybrid.GenerateECDHKeyPair(curve)
	if err != nil {
		return nil, fmt.Errorf("nistpkw_ecdh_private_key_manager: GenerateECDHKeyPair failed: %w", err)
	}
	return &ecdhpb.EcdhAeadPrivateKey{
		Version:  nistpECDHKWPrivateKeyVersion,
		KeyValue: pvt.D.Bytes(),
		PublicKey: &ecdhpb.EcdhAeadPublicKey{
			Version: nistpECDHKWPrivateKeyVersion,
			Params:  keyFormat.Params,
			X:       pvt.PublicKey.Point.X.Bytes(),
			Y:       pvt.PublicKey.Point.Y.Bytes(),
		},
	}, nil
}
func (km *nistPECDHKWPrivateKeyManager) NewKeyData(serializedKeyFormat []byte) (*tinkpb.KeyData, error) {
	key, err := km.NewKey(serializedKeyFormat)
	if err != nil {
		return nil, err
	}
	serializedKey, err := proto.Marshal(key)
	if err != nil {
		return nil, fmt.Errorf("nistpkw_ecdh_private_key_manager: Proto.Marshal failed: %w", err)
	}
	return &tinkpb.KeyData{
		TypeUrl:         nistpECDHKWPrivateKeyTypeURL,
		Value:           serializedKey,
		KeyMaterialType: tinkpb.KeyData_ASYMMETRIC_PRIVATE,
	}, nil
}
func (km *nistPECDHKWPrivateKeyManager) PublicKeyData(serializedPrivKey []byte) (*tinkpb.KeyData, error) {
	privKey := new(ecdhpb.EcdhAeadPrivateKey)
	err := proto.Unmarshal(serializedPrivKey, privKey)
	if err != nil {
		return nil, errInvalidNISTPECDHKWPrivateKey
	}
	serializedPubKey, err := proto.Marshal(privKey.PublicKey)
	if err != nil {
		return nil, errInvalidNISTPECDHKWPrivateKey
	}
	return &tinkpb.KeyData{
		TypeUrl:         nistpECDHKWPublicKeyTypeURL,
		Value:           serializedPubKey,
		KeyMaterialType: tinkpb.KeyData_ASYMMETRIC_PUBLIC,
	}, nil
}
func (km *nistPECDHKWPrivateKeyManager) DoesSupport(typeURL string) bool {
	return typeURL == nistpECDHKWPrivateKeyTypeURL
}
func (km *nistPECDHKWPrivateKeyManager) TypeURL() string {
	return nistpECDHKWPrivateKeyTypeURL
}