---
name: "gnutls_x509_privkey_generate2"
section: "3"
platform: "linux"
package: "gnutls"
version: "3.8.13-3"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/gnutls_x509_privkey_generate2"
---

# gnutls\_x509\_privkey\_generate2(3)

API function

## NAME

gnutls\_x509\_privkey\_generate2 - API function

## SYNOPSIS

**#include \<gnutls/x509.h\>**

**int gnutls\_x509\_privkey\_generate2(gnutls\_x509\_privkey\_t** *key***, gnutls\_pk\_algorithm\_t** *algo***, unsigned int** *bits***, unsigned int** *flags***, const gnutls\_keygen\_data\_st \*** *data***, unsigned** *data\_size***);**

## ARGUMENTS

- gnutls\_x509\_privkey\_t key

  a key

- gnutls\_pk\_algorithm\_t algo

  is one of the algorithms in **gnutls\_pk\_algorithm\_t**.

- unsigned int bits

  the size of the modulus

- unsigned int flags

  Must be zero or flags from **gnutls\_privkey\_flags\_t**.

- const gnutls\_keygen\_data\_st \* data

  Allow specifying **gnutls\_keygen\_data\_st** types such as the seed to be used.

- unsigned data\_size

  The number of  *data* available.

## DESCRIPTION

This function will generate a random private key. Note that this function must be called on an initialized private key.

The flag **GNUTLS\_PRIVKEY\_FLAG\_PROVABLE** instructs the key generation process to use algorithms like Shawe-Taylor (from FIPS PUB186-4) which generate provable parameters out of a seed for RSA and DSA keys. On DSA keys the PQG parameters are generated using the seed, while on RSA the two primes. To specify an explicit seed (by default a random seed is used), use the  *data* with a **GNUTLS\_KEYGEN\_SEED** type.

Note that when generating an elliptic curve key, the curve can be substituted in the place of the bits parameter using the **GNUTLS\_CURVE\_TO\_BITS()** macro.

To export the generated keys in memory or in files it is recommended to use the PKCS**8** form as it can handle all key types, and can store additional parameters such as the seed, in case of provable RSA or DSA keys. Generated keys can be exported in memory using **gnutls\_privkey\_export\_x509()**, and then with **gnutls\_x509\_privkey\_export2\_pkcs8()**.

If key generation is part of your application, avoid setting the number of bits directly, and instead use **gnutls\_sec\_param\_to\_pk\_bits()**. That way the generated keys will adapt to the security levels of the underlying GnuTLS library.

See also **gnutls\_privkey\_generate2()**.

## RETURNS

On success, **GNUTLS\_E\_SUCCESS** (0) is returned, otherwise a negative error value.

## REPORTING BUGS

Report bugs to \<bugs@gnutls.org\>.\
 Home page: https://www.gnutls.org

## COPYRIGHT

Copyright © 2001-2023 Free Software Foundation, Inc., and others.\
 Copying and distribution of this file, with or without modification, are permitted in any medium without royalty provided the copyright notice and this notice are preserved.

## SEE ALSO

The full documentation for **gnutls** is maintained as a Texinfo manual. If the /usr/share/doc/gnutls/ directory does not contain the HTML form visit

- https://www.gnutls.org/manual/