echo "--- 2. Extracting RAW Public Key (608 bytes) ---"

# The ML-KEM public key is 608 bytes long.
# The 'pubout' option converts to DER, and 'tail' removes the ASN.1 wrapper.
# NOTE: The ASN.1 wrapper size may vary by OpenSSL version/config. We must
# determine the exact offset to trim off the SubjectPublicKeyInfo header.
# For standard ML-KEM-768 PKCS#8 output, the header is typically 24 bytes.
HEADER_BYTES=24 # Common offset for ML-KEM-768 PKCS#8 SubjectPublicKeyInfo header

openssl pkey -in "$PUB_FILE" -pubin -outform DER -out "$RAW_PUB_FILE"
# Trim the ASN.1 header to get the raw 608-byte key
# (Skip first $HEADER_BYTES, save the next 608 bytes)
dd if="$RAW_PUB_FILE" of="client_public_key_raw_final.bin" bs=1 skip=$HEADER_BYTES count=608 status=none

echo "Raw public key saved to client_public_key_raw_final.bin"
# Print the hex array for C code
echo "Public Key Hex Array:"
xxd -p "client_public_key_raw_final.bin" | tr -d '\n' | sed 's/../&, 0x/g' | sed 's/^, 0x/0x/' | sed 's/, $//'
echo
echo "----------------------------------------------------------------"