---
name: "libressl-RSA_generate_key"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-RSA_generate_key"
---

# libressl-RSA\_generate\_key(3)

generate RSA key pair

## NAME

**RSA\_generate\_key\_ex**, **RSA\_generate\_key** – generate RSA key pair

## SYNOPSIS

Crypto Library (libcrypto, -lcrypto)

**#include \<openssl/rsa.h\>**

*int*\

**RSA\_generate\_key\_ex**(*RSA \*rsa*, *int bits*, *BIGNUM \*e*, *BN\_GENCB \*cb*);

Deprecated:

*RSA* *\**\

**RSA\_generate\_key**(*int num*, *unsigned long e*, *void (\*callback)(int, int, void \*)*, *void \*cb\_arg*);

## DESCRIPTION

**RSA\_generate\_key\_ex**() generates a key pair and stores it in *rsa*.

The modulus size will be of length *bits*, and the public exponent will be *e*. Key sizes with *num* \< 1024 should be considered insecure. The exponent is an odd number, typically 3, 17 or 65537.

A callback function may be used to provide feedback about the progress of the key generation. If *cb* is not NULL, it will be called as follows using the BN\_GENCB\_call(3) function:

- While a random prime number is generated, it is called as described in BN\_generate\_prime(3).

- When the *n*-th randomly generated prime is rejected as not suitable for the key, **BN\_GENCB\_call**(*cb*, *2*, *n*) is called.

- When a random p has been found with p-1 relatively prime to *e*, it is called as **BN\_GENCB\_call**(*cb*, *3*, *0*).

The process is then repeated for prime q with **BN\_GENCB\_call**(*cb*, *3*, *1*).

**RSA\_generate\_key**() is deprecated. New applications should use **RSA\_generate\_key\_ex**() instead. **RSA\_generate\_key**() works in the same way as **RSA\_generate\_key\_ex**() except it uses "old style" call backs. See BN\_generate\_prime(3) for further details.

## RETURN VALUES

**RSA\_generate\_key\_ex**() returns 1 on success or 0 on error. **RSA\_generate\_key**() returns the key on success or NULL on error.

The error codes can be obtained by ERR\_get\_error(3).

## SEE ALSO

BN\_generate\_prime(3), RSA\_get0\_key(3), RSA\_meth\_set\_keygen(3), RSA\_new(3)

## HISTORY

**RSA\_generate\_key**() appeared in SSLeay 0.4 or earlier and had its *cb\_arg* argument added in SSLeay 0.9.0. It has been available since OpenBSD 2.4.

**RSA\_generate\_key\_ex**() first appeared in OpenSSL 0.9.8 and has been available since OpenBSD 4.5.

## BUGS

**BN\_GENCB\_call**(*cb*, *2*, *x*) is used with two different meanings.

**RSA\_generate\_key**() goes into an infinite loop for illegal input values.