ECDH Private Key Bytes

Let's get the bad news out first, because you will hit it on your very first run: this node, as shipped, crashes with its default settings. It throws UnboundLocalError: local variable 'enc_alg' referenced before assignment. I reproduced it against the actual code - the encryption input defaults to "Best Available" but the encryption_password input defaults to empty, and the code only creates the encryption algorithm object when the password is non-empty. So you get a freshly generated key and then a crash on serialization. The fix is trivial and so is the workaround: either set encryption to None, or give it a password. Once you do, it works exactly as intended.

So what is it? It's the "make me a private key" node in the ComfyUI ARG Toolkit's Modern Cryptography section. It generates a fresh elliptic-curve private key and hands you the serialized bytes plus the live key object. This is the starting point for any ECDH workflow in this pack - generate here, derive your public key with XPublicKeyFormat, exchange with XExchange.

The inputs:

• key_type - x25519 or x448. X25519 is the modern default (fast, tiny, what everyone uses); x448 is the heavyweight alternative. Pick x25519 unless you have a reason not to.
• encoding - PEM, DER, or Raw. PEM is the human-readable, armor-plated text format you see in key files; DER is the same thing as raw bytes; Raw is just the bare key material.
• formatting - PKCS8 or Raw. PKCS8 is the standard container that encodes the key type alongside the key; use it unless you specifically need bare bytes.
• encryption - Best Available or None. The name is doing a lot of work: "Best Available" only actually encrypts if you also supply a password, and as noted, it requires the password.
• encryption_password - optional text. The tooltip is blunt: "Required if encryption is used."

Outputs are the interesting part:

• private_bytes (BYTESLIKE) - the serialized key in whatever encoding/format/encryption you chose. This is what you'd save to disk or transmit.
• private_key (KEYOBJ) - the live key object. You can wire this directly into other nodes in the pack that take a key object, which skips the serialize-and-reparse dance entirely.

A subtle thing this node does not have: no key_source input. It always generates a fresh key. That's by design - creating a private key from existing bytes is a different operation, and the pack handles the "From Private Bytes" path on the sibling nodes. So every run of this node gives you a brand-new keypair. If your workflow needs a specific persistent key, you'll want to export private_bytes once and feed it back in elsewhere, not re-run this node.

Install is the pack standard: ComfyUI Manager → search "ComfyUI ARG Toolkit" → install → restart, or:

cd ComfyUI/custom_nodes
git clone https://github.com/AzelusLightvale/ComfyUI-ARG-Toolkit
# restart ComfyUI

The pack is one-author and GPLv3, with a README that openly admits it's an amateur project with tests covering only common cases - which, given this exact bug, you should read as a warning to test before you trust. The underlying cryptography is the cryptography library's x25519/x448, so the crypto itself is solid; it's the wrapper that's rough around the edges. Also, exporting private_bytes to a readable form takes the pack's ByteslikeDecode node - and remember, an encrypted private key is only as safe as the password sitting in that ComfyUI workflow file.