def generate_and_write_ecdsa_keypair(filepath=None, password=None):
<EOL>ecdsa_key = securesystemslib.keys.generate_ecdsa_key()<EOL>if not filepath:<EOL><INDENT>filepath = os.path.join(os.getcwd(), ecdsa_key['<STR_LIT>'])<EOL><DEDENT>else:<EOL><INDENT>logger.debug('<STR_LIT>'<EOL>'<STR_LIT>')<EOL><DEDENT>securesystemslib.formats.PATH_SCHEMA.check_match(filepath)<EOL>if password is None: <EOL><INDENT>password = get_password('<STR_LIT>'<EOL>'<STR_LIT>' + Fore.RED + filepath + Fore.RESET + '<STR_LIT>',<EOL>confirm=True)<EOL><DEDENT>else:<EOL><INDENT>logger.debug('<STR_LIT>')<EOL><DEDENT>securesystemslib.formats.PASSWORD_SCHEMA.check_match(password)<EOL>securesystemslib.util.ensure_parent_dir(filepath)<EOL>file_object = securesystemslib.util.TempFile()<EOL>keytype = ecdsa_key['<STR_LIT>']<EOL>keyval = ecdsa_key['<STR_LIT>']<EOL>scheme = ecdsa_key['<STR_LIT>']<EOL>ecdsakey_metadata_format = securesystemslib.keys.format_keyval_to_metadata(<EOL>keytype, scheme, keyval, private=False)<EOL>file_object.write(json.dumps(ecdsakey_metadata_format).encode('<STR_LIT:utf-8>'))<EOL>file_object.move(filepath + '<STR_LIT>')<EOL>file_object = securesystemslib.util.TempFile()<EOL>encrypted_key = securesystemslib.keys.encrypt_key(ecdsa_key, password)<EOL>file_object.write(encrypted_key.encode('<STR_LIT:utf-8>'))<EOL>file_object.move(filepath)<EOL>return filepath<EOL>
<Purpose>
  Generate an ECDSA keypair, where the encrypted key (using 'password' as the
  passphrase) is saved to <'filepath'>.  The public key portion of the
  generated ECDSA key is saved to <'filepath'>.pub.  If the filepath is not
  given, the KEYID is used as the filename and the keypair saved to the
  current working directory.

  The 'cryptography' library is currently supported.  The private key is
  encrypted according to 'cryptography's approach: "Encrypt using the best
  available encryption for a given key's backend. This is a curated
  encryption choice and the algorithm may change over time."

<Arguments>
  filepath:
    The public and private key files are saved to <filepath>.pub and
    <filepath>, respectively.  If the filepath is not given, the public and
    private keys are saved to the current working directory as <KEYID>.pub
    and <KEYID>.  KEYID is the generated key's KEYID.

  password:
    The password, or passphrase, to encrypt the private portion of the
    generated ECDSA key.  A symmetric encryption key is derived from
    'password', so it is not directly used.

<Exceptions>
  securesystemslib.exceptions.FormatError, if the arguments are improperly
  formatted.

  securesystemslib.exceptions.CryptoError, if 'filepath' cannot be encrypted.

<Side Effects>
  Writes key files to '<filepath>' and '<filepath>.pub'.

<Returns>
  The 'filepath' of the written key.