EVP_PKEY-RSA(7ossl)

📦
version 3.5.9 · 8 versions
, in alpine 3.23, alpine 3.24

💅 EVP_PKEY-RSA — the OpenSSL manual page, but make it make sense

okay so bestie, welcome to EVP_PKEY-RSA(7ossl) from the OpenSSL fam 💖 this is the whole ~vibe~ of the RSA keytype and algorithm support — also known in the streets as EVP_PKEY-RSA, EVP_KEYMGMT-RSA, and plain old RSA. yes, three names. it's giving main character energy with aliases ✨

🌸 DESCRIPTION 🌸

The RSA keytype lives inside OpenSSL's default provider and the FIPS provider. no cap. That implementation handles the basic RSA keys, which contain:

  • the modulus n
  • the public exponent e
  • the private exponent d
  • and a whole little friend group of prime factors, exponents and coefficients for CRT calculations — the first few are literally known as p and q, dP and dQ, and qInv 🫶

💜 Common RSA parameters

On top of the common parameters that all keytypes should support (peep "Common parameters" in provider-keymgmt(7)), the RSA keytype implementation also supports all of these cuties:

  • "n" (OSSL_PKEY_PARAM_RSA_N) <unsigned integer> — the RSA modulus "n" value ✨
  • "e" (OSSL_PKEY_PARAM_RSA_E) <unsigned integer> — the RSA public exponent "e" value. This one must always be set when you're creating a raw key using EVP_PKEY_fromdata(3). also important: when a decryption operation is performed, this value gets used for blinding purposes to prevent timing attacks 👑
  • "d" (OSSL_PKEY_PARAM_RSA_D) <unsigned integer> — the RSA private exponent "d" value 🙈
  • "rsa-factor1" (OSSL_PKEY_PARAM_RSA_FACTOR1) <unsigned integer>
  • "rsa-factor2" (OSSL_PKEY_PARAM_RSA_FACTOR2) <unsigned integer>
  • "rsa-factor3" (OSSL_PKEY_PARAM_RSA_FACTOR3) <unsigned integer>
  • "rsa-factor4" (OSSL_PKEY_PARAM_RSA_FACTOR4) <unsigned integer>
  • "rsa-factor5" (OSSL_PKEY_PARAM_RSA_FACTOR5) <unsigned integer>
  • "rsa-factor6" (OSSL_PKEY_PARAM_RSA_FACTOR6) <unsigned integer>
  • "rsa-factor7" (OSSL_PKEY_PARAM_RSA_FACTOR7) <unsigned integer>
  • "rsa-factor8" (OSSL_PKEY_PARAM_RSA_FACTOR8) <unsigned integer>
  • "rsa-factor9" (OSSL_PKEY_PARAM_RSA_FACTOR9) <unsigned integer>
  • "rsa-factor10" (OSSL_PKEY_PARAM_RSA_FACTOR10) <unsigned integer>

these are the RSA prime factors 💀 in RFC8017 they're known as "p", "q" and "r_i". up to eight additional "r_i" prime factors are supported, so yes, you can go multi-prime. slay.

  • "rsa-exponent1" (OSSL_PKEY_PARAM_RSA_EXPONENT1) <unsigned integer>
  • "rsa-exponent2" (OSSL_PKEY_PARAM_RSA_EXPONENT2) <unsigned integer>
  • "rsa-exponent3" (OSSL_PKEY_PARAM_RSA_EXPONENT3) <unsigned integer>
  • "rsa-exponent4" (OSSL_PKEY_PARAM_RSA_EXPONENT4) <unsigned integer>
  • "rsa-exponent5" (OSSL_PKEY_PARAM_RSA_EXPONENT5) <unsigned integer>
  • "rsa-exponent6" (OSSL_PKEY_PARAM_RSA_EXPONENT6) <unsigned integer>
  • "rsa-exponent7" (OSSL_PKEY_PARAM_RSA_EXPONENT7) <unsigned integer>
  • "rsa-exponent8" (OSSL_PKEY_PARAM_RSA_EXPONENT8) <unsigned integer>
  • "rsa-exponent9" (OSSL_PKEY_PARAM_RSA_EXPONENT9) <unsigned integer>
  • "rsa-exponent10" (OSSL_PKEY_PARAM_RSA_EXPONENT10) <unsigned integer>

the RSA CRT (Chinese Remainder Theorem) exponents 🌈 in RFC8017 these are known as "dP", "dQ" and "d_i". up to eight additional "d_i" exponents are supported 💅

  • "rsa-coefficient1" (OSSL_PKEY_PARAM_RSA_COEFFICIENT1) <unsigned integer>
  • "rsa-coefficient2" (OSSL_PKEY_PARAM_RSA_COEFFICIENT2) <unsigned integer>
  • "rsa-coefficient3" (OSSL_PKEY_PARAM_RSA_COEFFICIENT3) <unsigned integer>
  • "rsa-coefficient4" (OSSL_PKEY_PARAM_RSA_COEFFICIENT4) <unsigned integer>
  • "rsa-coefficient5" (OSSL_PKEY_PARAM_RSA_COEFFICIENT5) <unsigned integer>
  • "rsa-coefficient6" (OSSL_PKEY_PARAM_RSA_COEFFICIENT6) <unsigned integer>
  • "rsa-coefficient7" (OSSL_PKEY_PARAM_RSA_COEFFICIENT7) <unsigned integer>
  • "rsa-coefficient8" (OSSL_PKEY_PARAM_RSA_COEFFICIENT8) <unsigned integer>
  • "rsa-coefficient9" (OSSL_PKEY_PARAM_RSA_COEFFICIENT9) <unsigned integer>

the RSA CRT (Chinese Remainder Theorem) coefficients 🎀 these ones are known as "qInv" and "t_i". up to eight additional "t_i" exponents are supported ⭐

🦋 RSA key generation parameters

when you're generating RSA keys, these are the key generation parameters you can use:

  • "bits" (OSSL_PKEY_PARAM_RSA_BITS) <unsigned integer> — this value should be the cryptographic length for the RSA cryptosystem, in bits ✨
  • "primes" (OSSL_PKEY_PARAM_RSA_PRIMES) <unsigned integer> — should be the number of primes for the generated RSA key. the default is 2. it is not permitted to specify a larger number of primes than 10. also, the number of primes is limited by the length of the key being generated, so the maximum number could be less 👀 and some providers may only support a value of 2.
  • "e" (OSSL_PKEY_PARAM_RSA_E) <unsigned integer> — the RSA "e" value. it may be any odd number greater than or equal to 65537. default value is 65537. for legacy reasons a value of 3 is currently accepted but is deprecated 💀
  • "rsa-derive-from-pq" (OSSL_PKEY_PARAM_RSA_DERIVE_FROM_PQ) <unsigned integer> — indicates that missing parameters not passed in the parameter list should be derived if not provided. setting a nonzero value will cause all needed exponents and coefficients to be derived if not available. setting this option requires at least OSSL_PARAM_RSA_FACTOR1, OSSL_PARAM_RSA_FACTOR2, and OSSL_PARAM_RSA_N to be provided. this option is ignored if OSSL_KEYMGMT_SELECT_PRIVATE_KEY is not set in the selection parameter 🙈

🔥 RSA key generation FIPS indicator

this next key generation parameter can be retrieved with EVP_PKEY_CTX_get_params(3) from the OpenSSL FIPS provider:

  • "fips-indicator" (OSSL_PKEY_PARAM_FIPS_APPROVED_INDICATOR) <integer> — returns 1 if the operation is FIPS approved, or 0 otherwise. see "FIPS indicators" in fips_module(7) for more info. heads up: using any of the FIPS module testing parameters described below causes this indicator to return 0 ⭐

🧚 RSA key generation parameters for FIPS module testing

when generating RSA keys, these extra key generation parameters may be used for algorithm testing purposes only.

🚨 bestie listen to me: do not use these to generate RSA keys for a production environment. i'm so serious. this is lab-coat territory only.
  • "xp" (OSSL_PKEY_PARAM_RSA_TEST_XP) <unsigned integer>
  • "xq" (OSSL_PKEY_PARAM_RSA_TEST_XQ) <unsigned integer>

these 2 fields are normally randomly generated, and they're used to generate "p" and "q" 💫

  • "xp1" (OSSL_PKEY_PARAM_RSA_TEST_XP1) <unsigned integer>
  • "xp2" (OSSL_PKEY_PARAM_RSA_TEST_XP2) <unsigned integer>
  • "xq1" (OSSL_PKEY_PARAM_RSA_TEST_XQ1) <unsigned integer>
  • "xq2" (OSSL_PKEY_PARAM_RSA_TEST_XQ2) <unsigned integer>

these 4 fields are normally randomly generated. the prime factors "p1", "p2", "q1" and "q2" are determined from these values 🌸

💀 RSA key parameters for FIPS module testing

these intermediate values can only be retrieved if the values specified in "RSA key generation parameters for FIPS module testing" are set. again: should not be accessed in a production environment 🙅‍♀️

  • "p1" (OSSL_PKEY_PARAM_RSA_TEST_P1) <unsigned integer>
  • "p2" (OSSL_PKEY_PARAM_RSA_TEST_P2) <unsigned integer>
  • "q1" (OSSL_PKEY_PARAM_RSA_TEST_Q1) <unsigned integer>
  • "q2" (OSSL_PKEY_PARAM_RSA_TEST_Q2) <unsigned integer>

these are the auxiliary probable primes ✨

👑 RSA key validation

🌈 CONFORMING TO 🌈

  • FIPS186-4 — Section B.3.6 Generation of Probable Primes with Conditions Based on Auxiliary Probable Primes 📜
  • RFC 8017, excluding RSA-PSS and RSA-OAEP

✨ EXAMPLES ✨

you can get an EVP_PKEY context by calling:

EVP_PKEY_CTX *pctx =
    EVP_PKEY_CTX_new_from_name(NULL, "RSA", NULL);

an RSA key can be generated simply like this:

pkey = EVP_RSA_gen(4096);

or like this:

EVP_PKEY *pkey = NULL;
EVP_PKEY_CTX *pctx =
    EVP_PKEY_CTX_new_from_name(NULL, "RSA", NULL);

EVP_PKEY_keygen_init(pctx);
EVP_PKEY_generate(pctx, &pkey);
EVP_PKEY_CTX_free(pctx);

and an RSA key can be generated with key generation parameters — look at her go 😭💖

unsigned int primes = 3;
unsigned int bits = 4096;
OSSL_PARAM params[3];
EVP_PKEY *pkey = NULL;
EVP_PKEY_CTX *pctx = EVP_PKEY_CTX_new_from_name(NULL, "RSA", NULL);

EVP_PKEY_keygen_init(pctx);

params[0] = OSSL_PARAM_construct_uint("bits", &bits);
params[1] = OSSL_PARAM_construct_uint("primes", &primes);
params[2] = OSSL_PARAM_construct_end();
EVP_PKEY_CTX_set_params(pctx, params);

EVP_PKEY_generate(pctx, &pkey);
EVP_PKEY_print_private(bio_out, pkey, 0, NULL);
EVP_PKEY_CTX_free(pctx);

🎀 SEE ALSO 🎀

EVP_RSA_gen(3), EVP_KEYMGMT(3), EVP_PKEY(3), provider-keymgmt(7) — go read them, iykyk 🦋

Copyright 2020-2026 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

okay that's the whole page, periodt 🫶 this was OpenSSL version 3.5.9, dated 2026-09-29 — love that for us. now go generate some primes, bestie 💖🌸✨

📦 where this page comes from