Currently (as of GnuPG 2.4.5), PKDECRYPT computation for ECC is a bit different to the computation of RSA (or DSA).
It is basically only a part of computation of decryption for ECC (that is, (only), ECDH computation with private key to get shared secret).
Although the both data of e (ephemeral key) and s (encrypted session key) are sent to gpg-agent, gpg-agent only use e to get shared secret.
(And it is actually client of gpg-agent to get the session key (by decryption of AESKEYWRAP) from encrypted session key using the result of gpg-agent.
It would be good to enhance PKDECRYPT command (say, by adding option --kem for ECC) to support computation including decryption by AESWRAP. This way, ECC computation of PKDECRYPT is aligned to the one of RSA and DSA.
This makes sense in the context of PQC, which uses hybrid KEM.
The enhanced PKDECRYPT would go like this:
- SETKEY <KEYGRIP-of-ECC>
- SETKEY --another <KEYGRIP-of-Kyber> ; new option for SETKEY command
- PKDECRYPT --kem <KEM_ID>; new option for PKDECRYPT command
- gpg-agent inquires CIPHERTEXT (e and s in S-expression)
- gpg-agent inquires OPTION (for optional data, KDF parameter in the term of RFC 6637)
- compute decaps with KEYGRIP-of-ECC key, using ECC part in the e part of CIPHERTEXT (KEM_ID should match the ECC key)
- compute decaps with KEYGRIP-of-Kyber key, using Kyber part in the e part of CIPHERTEXT (KEM_ID should match the Kyber key)
- determined by KEM_ID, compute KEM combiner using OPTION, results --> KEK
- compute AESKeyUnwrap using the KEK and s part of CIPHERTEXT, results --> session key