ECDH Public Key Bytes

In an ECDH workflow, the public key is the thing you're allowed to share. It's derived from your private key, can't be reversed into it, and it's what the other side uses to compute a shared secret with you. This node is the "derive and serialize my public key" step in the ComfyUI ARG Toolkit, and unlike its private-key sibling, it behaves itself - I ran it against the shipped code and it produced a valid PEM-encoded X25519 public key without drama.

The flow makes more sense if you've used the pack's XPrivateKeyFormat first: generate a private key there, then either wire its private_key object in here or re-supply its bytes. This node turns that into a public key and hands you both the serialized bytes and the live key object.

The inputs:

• key_source - Fresh Key (default) generates a brand-new private key on the fly and derives from it; From Private Bytes takes the private_key input instead. If you want a public key that matches an existing private key, this must be From Private Bytes - otherwise you get a random new keypair every run.
• key_type - x25519 or x448. Match whatever you used for the private key.
• encoding - PEM, DER, or Raw. PEM is the -----BEGIN PUBLIC KEY----- format people actually paste around; DER is the binary equivalent; Raw is just the 32 bytes of X25519 key material.
• formatting - SubjectPublicKeyInfo (default) or Raw. SPKI is the standard container that carries the algorithm identifier with the key. Note the tooltip's hint: OpenSSH expects PEM encoding.
• private_key - optional BYTESLIKE, only used when key_source is From Private Bytes.

Outputs:

• public_bytes (BYTESLIKE) - the serialized public key. This is the shareable artifact; save it, base64 it, hand it to your collaborator.
• public_key (KEYOBJ) - the live key object, for wiring directly into other pack nodes.

Here's the gotcha that will bite you with XExchange: ECDH needs the other person's public key, and the exchange node assumes it's in Raw format. So when you're preparing a public key to feed into XExchange, choose encoding Raw (and formatting Raw if you want to be unambiguous) - feed it a PEM blob and it'll throw on from_public_bytes. The KEYOBJ output avoids all of this if you're staying inside the pack, but the BYTESLIKE path is where the format mismatch lives.

A security note worth stating plainly: the public key is safe to share, but the key_source = Fresh Key default means every workflow run mints a new keypair unless you wire in a fixed private key. That's fine for one-off experiments and terrible for anything where the other side needs a stable identity. For real usage, persist your private key bytes and always set key_source to From Private Bytes.

Install is the pack standard: ComfyUI Manager → search "ComfyUI ARG Toolkit" → install → restart, or:

cd ComfyUI/custom_nodes
git clone https://github.com/AzelusLightvale/ComfyUI-ARG-Toolkit
# restart ComfyUI

The pack is one-author (AzelusLightvale), GPLv3, and its README is honest that it began as an amateur project with tests only over common cases. The crypto underneath is the cryptography library's battle-tested x25519/x448, so the math is sound; the wrapper is where you'll find rough edges. To turn public_bytes into something readable, the pack's ByteslikeDecode node is your friend.