gnutls_privkey_generate2(3)

💖 gnutls_privkey_generate2 💖

okay bestie, welcome to the gnutls manual, we're doing the whole ~abstract key~ thing today and honestly? iconic. this one's about making brand new private keys from scratch, no cap. 🗝️✨

---

✨ NAME ✨

gnutls_privkey_generate2 — it's literally an API function, that's the whole vibe

---

🌸 SYNOPSIS 🌸

#include <gnutls/abstract.h>

int gnutls_privkey_generate2(gnutls_privkey_t pkey,
gnutls_pk_algorithm_t algo, unsigned int bits, unsigned int flags, const
gnutls_keygen_data_st * data, unsigned data_size);

like yes, six args, she's a lot, but we'll get through it together 🫶

---

🎀 ARGUMENTS 🎀

• gnutls_privkey_t pkey — the private key itself. your main character. 💅
• gnutls_pk_algorithm_t algo — pick your fighter, it's one of the algorithms from gnutls_pk_algorithm_t.
• unsigned int bits — the size of the modulus, aka how beefy we're going. 💪
• unsigned int flags — has to be zero, or flags from gnutls_privkey_flags_t. no random numbers here bestie.
• const gnutls_keygen_data_st * data — lets you specify gnutls_keygen_data_st types, like the seed you wanna use. 🍓
• unsigned data_size — how many data you actually have. the count, fr fr.

---

🦋 DESCRIPTION 🦋

so this function generates a random private key. 💫 and heads up: you must call it on an initialized private key. don't come in with an uninitialized key, she will simply not cooperate. 😭

the flag GNUTLS_PRIVKEY_FLAG_PROVABLE tells the key generation process to use algorithms like Shawe-Taylor (from FIPS PUB186-4) which generate provable parameters out of a seed for RSA and DSA keys. lowkey obsessed with how that works. on DSA keys the PQG parameters get generated using the seed, while on RSA it's the two primes. and if you wanna specify an explicit seed (by default a random seed is used, the classic), you use the data with a GNUTLS_KEYGEN_SEED type. 🎯

also, when you're generating an elliptic curve key, the curve can be substituted in the place of the bits parameter using the GNUTLS_CURVE_TO_BITS() macro. yes the macro. it's giving "we don't have a curve argument so we're being clever." 💀

to export the generated keys in memory or in files it is recommended to use the PKCS8 form, because it can handle all key types, and can store additional parameters such as the seed, in case of provable RSA or DSA keys. slay, flexible format. ✨ generated keys can be exported in memory using gnutls_privkey_export_x509(), and then with gnutls_x509_privkey_export2_pkcs8().

and here's the tip that will save you: if key generation is part of your application, avoid setting the number of bits directly, and instead use gnutls_sec_param_to_pk_bits(). that way the generated keys will adapt to the security levels of the underlying GnuTLS library. future-proofing?? we love to see it. 👑

---

🌈 RETURNS 🌈

on success, GNUTLS_E_SUCCESS (0) comes back to you, otherwise you get a negative error value. simple as that, bestie. 💖

---

⭐ SINCE ⭐

3.5.0 — she's been around, she's got history.

---

🙈 REPORTING BUGS 🙈

found a bug? don't suffer in silence, report it to <bugs@gnutls.org>. 📧

home page: https://www.gnutls.org

---

👑 COPYRIGHT 👑

Copyright © 2001-2023 Free Software Foundation, Inc., and others.

copying and distribution of this file, with or without modification, are permitted in any medium without royalty provided the copyright notice and this notice are preserved. no notes, that's actually so generous of them. 🫶

---

🌸 SEE ALSO 🌸

the full documentation for gnutls is maintained as a Texinfo manual. if the /usr/share/doc/gnutls/ directory does not contain the HTML form, visit:

https://www.gnutls.org/manual/

---

okay that's the whole page!! this was gnutls version 3.8.13, page gnutls_privkey_generate2(3), and you absolutely ate that reading bestie. go generate some keys, stay provable, and drink water. 💖✨🎀🦋