gnutls_pkcs11_privkey_generate2(3)

📦
version 3.8.13 · 7 versions
, in alpine 3.22, alpine 3.23, alpine 3.24, arch rolling, fedora 43, fedora 44, ubuntu stonking

💖 gnutls_pkcs11_privkey_generate2 — the manual page, bestie edition 💖

okay so this is a page from the gnutls manual, and honestly? it's giving "quietly powerful little function that makes keys inside your HSM and refuses to let them leave." main character energy fr. let's get into it 🫶

✨ NAME ✨

gnutls_pkcs11_privkey_generate2 — it's an API function, bestie. that's the whole vibe.

🌸 SYNOPSIS 🌸

#include <gnutls/pkcs11.h>

int gnutls_pkcs11_privkey_generate2(const char * url,
gnutls_pk_algorithm_t pk, unsigned int bits, const char * label,
gnutls_x509_crt_fmt_t fmt, gnutls_datum_t * pubkey, unsigned int flags);

like yes, that's a lot of parameters. it's fine. we'll go one by one 💅

🎀 ARGUMENTS 🎀

  • const char * url — a token URL. the place where the magic happens, literally.
  • gnutls_pk_algorithm_t pk — the public key algorithm. what flavor of key are we cooking today.
  • unsigned int bits — the security bits. size matters, and we're not pretending otherwise.
  • const char * label — a label. a little name tag for your key 🏷️
  • gnutls_x509_crt_fmt_t fmt — the format of output params. it's either PEM or DER, pick one.
  • gnutls_datum_t * pubkey — will hold the public key. heads up: this one may be NULL 👀
  • unsigned int flags — zero, or an OR'ed sequence of GNUTLS_PKCS11_OBJ_FLAGs. you know the ones.

🦋 DESCRIPTION 🦋

so what does it DO. it generates a private key in the token specified by the url. and here's the iconic part: the private key is generated within the token and will not be exportable. it lives there. it stays there. it is not coming out. that's the whole point, bestie, that's the security model, periodt 🔥

this function will store the DER-encoded public key in the SubjectPublicKeyInfo format in pubkey. and when you're done with that pubkey, you need to deinitialize it using gnutls_free(). don't ghost it, clean it up properly 🧚

💡 little note, and this one's important: when you're generating an elliptic curve key, you can substitute the curve in the place of the bits parameter using the GNUTLS_CURVE_TO_BITS() macro. cute little trick, no cap.

⭐ RETURNS ⭐

on success, you get GNUTLS_E_SUCCESS (which is 0, the number we all love to see 🥳). otherwise you get a negative error value, which is the universe telling you something went wrong.

🌈 SINCE 🌈

3.1.5 — an OG, honestly. been here since forever.

💀 REPORTING BUGS 💀

found a bug? don't suffer in silence, bestie. report bugs to <bugs@gnutls.org>.

home page: https://www.gnutls.org — go say hi 🌐

Copyright © 2001-2023 Free Software Foundation, Inc., and others.

copying and distribution of this file, with or without modification, are permitted in any medium without royalty provided the copyright notice and this notice are preserved. so share it, remix it, just keep the receipts 🫶

🍓 SEE ALSO 🍓

the full documentation for gnutls is maintained as a Texinfo manual. and if the /usr/share/doc/gnutls/ directory does not contain the HTML form, then bestie, just go here:

https://www.gnutls.org/manual/

and that's the page!! this was gnutls 3.8.13, and the page is gnutls_pkcs11_privkey_generate2(3). go forth and generate keys that never leave home 💖✨🎀🦋🌸💅

📦 where this page comes from