EVP_PKEY-RSA(7SSL)

📦
version 4.0.3 · 13 versions
, in ubuntu stonking

🎀 NAME 🎀

okay bestie, welcome to the EVP_PKEY-RSA(7SSL) page from the OpenSSL manual 💖

EVP_PKEY-RSA, EVP_KEYMGMT-RSA, RSA — that's the EVP_PKEY RSA keytype and algorithm support, all of it, every last parameter. buckle up. 🦋

✨ DESCRIPTION ✨

so the RSA keytype lives in OpenSSL's default provider and the FIPS provider. both of them. 💅

that implementation handles the basic RSA keys, and a basic RSA key is carrying around the modulus n, the public exponent e, the private exponent d, plus a whole little squad of prime factors, exponents and coefficient for CRT calculations — the famous first few being p and q, dP and dQ, and qInv. 👑

RSA key generation uses FIPS 186-5 Section A.1.6 "Generation of Probable Primes with Conditions Based on Auxiliary Probable Primes" for the OpenSSL FIPS provider. and it's also used for the OpenSSL default provider when the generation parameters hit all of these conditions:

  • There are 2 "primes" (p, q)
  • The exponent "e" >= 65537 and is odd
  • The cryptographic length "bits" >= 2048

if they don't hit those conditions? then the OpenSSL default provider falls back to an older general multi-prime key generator. ngl, vintage. 🫶

🌸 Common RSA parameters 🌸

on top of the common parameters that all keytypes should support (peep "Common parameters" in provider-keymgmt(7)), the RSA keytype implementation also supports these:

  • "n" (OSSL_PKEY_PARAM_RSA_N) <unsigned integer> — the RSA modulus n value. 💖
  • "e" (OSSL_PKEY_PARAM_RSA_E) <unsigned integer> — the RSA public exponent e value. this one must always be set when you're creating a raw key using EVP_PKEY_fromdata(3). also fun fact: when a decryption operation happens, this value gets used for blinding purposes to prevent timing attacks. protecting the vibes AND the secrets. 🔥
  • "d" (OSSL_PKEY_PARAM_RSA_D) <unsigned integer> — the RSA private exponent d value.
  • "rsa-factor1" (OSSL_PKEY_PARAM_RSA_FACTOR1) <unsigned integer>
  • "rsa-factor2" (OSSL_PKEY_PARAM_RSA_FACTOR2) <unsigned integer>
  • "rsa-factor3" (OSSL_PKEY_PARAM_RSA_FACTOR3) <unsigned integer>
  • "rsa-factor4" (OSSL_PKEY_PARAM_RSA_FACTOR4) <unsigned integer>
  • "rsa-factor5" (OSSL_PKEY_PARAM_RSA_FACTOR5) <unsigned integer>
  • "rsa-factor6" (OSSL_PKEY_PARAM_RSA_FACTOR6) <unsigned integer>
  • "rsa-factor7" (OSSL_PKEY_PARAM_RSA_FACTOR7) <unsigned integer>
  • "rsa-factor8" (OSSL_PKEY_PARAM_RSA_FACTOR8) <unsigned integer>
  • "rsa-factor9" (OSSL_PKEY_PARAM_RSA_FACTOR9) <unsigned integer>
  • "rsa-factor10" (OSSL_PKEY_PARAM_RSA_FACTOR10) <unsigned integer>

those are the RSA prime factors. the factors are known as "p", "q" and "r_i" in RFC8017, and up to eight additional "r_i" prime factors are supported. 🌸

  • "rsa-exponent1" (OSSL_PKEY_PARAM_RSA_EXPONENT1) <unsigned integer>
  • "rsa-exponent2" (OSSL_PKEY_PARAM_RSA_EXPONENT2) <unsigned integer>
  • "rsa-exponent3" (OSSL_PKEY_PARAM_RSA_EXPONENT3) <unsigned integer>
  • "rsa-exponent4" (OSSL_PKEY_PARAM_RSA_EXPONENT4) <unsigned integer>
  • "rsa-exponent5" (OSSL_PKEY_PARAM_RSA_EXPONENT5) <unsigned integer>
  • "rsa-exponent6" (OSSL_PKEY_PARAM_RSA_EXPONENT6) <unsigned integer>
  • "rsa-exponent7" (OSSL_PKEY_PARAM_RSA_EXPONENT7) <unsigned integer>
  • "rsa-exponent8" (OSSL_PKEY_PARAM_RSA_EXPONENT8) <unsigned integer>
  • "rsa-exponent9" (OSSL_PKEY_PARAM_RSA_EXPONENT9) <unsigned integer>
  • "rsa-exponent10" (OSSL_PKEY_PARAM_RSA_EXPONENT10) <unsigned integer>

these are the RSA CRT (Chinese Remainder Theorem) exponents. they're known as "dP", "dQ" and "d_i" in RFC8017, and up to eight additional "d_i" exponents are supported. ✨

  • "rsa-coefficient1" (OSSL_PKEY_PARAM_RSA_COEFFICIENT1) <unsigned integer>
  • "rsa-coefficient2" (OSSL_PKEY_PARAM_RSA_COEFFICIENT2) <unsigned integer>
  • "rsa-coefficient3" (OSSL_PKEY_PARAM_RSA_COEFFICIENT3) <unsigned integer>
  • "rsa-coefficient4" (OSSL_PKEY_PARAM_RSA_COEFFICIENT4) <unsigned integer>
  • "rsa-coefficient5" (OSSL_PKEY_PARAM_RSA_COEFFICIENT5) <unsigned integer>
  • "rsa-coefficient6" (OSSL_PKEY_PARAM_RSA_COEFFICIENT6) <unsigned integer>
  • "rsa-coefficient7" (OSSL_PKEY_PARAM_RSA_COEFFICIENT7) <unsigned integer>
  • "rsa-coefficient8" (OSSL_PKEY_PARAM_RSA_COEFFICIENT8) <unsigned integer>
  • "rsa-coefficient9" (OSSL_PKEY_PARAM_RSA_COEFFICIENT9) <unsigned integer>

these are the RSA CRT (Chinese Remainder Theorem) coefficients. the coefficients are known as "qInv" and "t_i". up to eight additional "t_i" exponents are supported. 🧚

💅 RSA key generation parameters 💅

when you're generating RSA keys, you can use these key generation parameters:

  • "bits" (OSSL_PKEY_PARAM_RSA_BITS) <unsigned integer> — the value should be the cryptographic length for the RSA cryptosystem, in bits. 📏
  • "primes" (OSSL_PKEY_PARAM_RSA_PRIMES) <unsigned integer> — the value should be the number of primes for the generated RSA key. the default is 2. it is not permitted to specify a larger number of primes than 10. also, the number of primes is limited by the length of the key being generated, so the maximum number could be less than that. some providers may only support a value of 2. 😭
  • "e" (OSSL_PKEY_PARAM_RSA_E) <unsigned integer> — the RSA "e" value. it may be any odd number greater than or equal to 65537. the default value is 65537. and for legacy reasons a value of 3 is currently accepted but deprecated. 🙈
  • "rsa-derive-from-pq" (OSSL_PKEY_PARAM_RSA_DERIVE_FROM_PQ) <unsigned integer> — this one says: any missing parameters that weren't passed in the parameter list should be derived if they're not provided. setting a nonzero value will cause all needed exponents and coefficients to be derived if they're not available. setting this option requires at least OSSL_PARAM_RSA_FACTOR1, OSSL_PARAM_RSA_FACTOR2, and OSSL_PARAM_RSA_N to be provided. and heads up: this option is ignored if OSSL_KEYMGMT_SELECT_PRIVATE_KEY is not set in the selection parameter. 👀
  • "rsa-a" (OSSL_PKEY_PARAM_RSA_A) <unsigned integer> — set this to one of 1, 3, 5 or 7 and it applies an additional constraint requiring that the computed prime p is congruent to this value mod 8. if this value is zero then it's ignored. an error will occur if the value is not set to one of the above values. ⚠️
  • "rsa-b" (OSSL_PKEY_PARAM_RSA_B) <unsigned integer> — same energy, but for q: set it to one of 1, 3, 5 or 7 and it applies an additional constraint requiring that the computed prime q is congruent to this value mod 8. if this value is zero then it's ignored. an error will occur if the value is not set to one of the above values. 💖

🌈 RSA key generation FIPS indicator 🌈

this next key generation parameter can be retrieved with EVP_PKEY_CTX_get_params(3) from the OpenSSL FIPS provider:

  • "fips-indicator" (OSSL_PKEY_PARAM_FIPS_APPROVED_INDICATOR) <integer> — returns 1 if the operation is FIPS approved, or 0 otherwise. check "FIPS indicators" in fips_module(7) for more info. and note: using any of the FIPS module testing parameters described below causes this indicator to return 0. 👑

⭐ RSA key generation parameters for FIPS module testing ⭐

when generating RSA keys, these extra key generation parameters may be used for algorithm testing purposes only.

bestie. do NOT use these to generate RSA keys for a production environment. i'm so serious. 🚨
  • "xp" (OSSL_PKEY_PARAM_RSA_TEST_XP) <unsigned integer>
  • "xq" (OSSL_PKEY_PARAM_RSA_TEST_XQ) <unsigned integer>

these 2 fields are normally randomly generated and are used to generate "p" and "q". 🦋

  • "xp1" (OSSL_PKEY_PARAM_RSA_TEST_XP1) <unsigned integer>
  • "xp2" (OSSL_PKEY_PARAM_RSA_TEST_XP2) <unsigned integer>
  • "xq1" (OSSL_PKEY_PARAM_RSA_TEST_XQ1) <unsigned integer>
  • "xq2" (OSSL_PKEY_PARAM_RSA_TEST_XQ2) <unsigned integer>

these 4 fields are normally randomly generated. the prime factors "p1", "p2", "q1" and "q2" are determined from these values. ✨

💜 RSA key parameters for FIPS module testing 💜

these following intermediate values can be retrieved only if the values specified in "RSA key generation parameters for FIPS module testing" are set.

and again: these should not be accessed in a production environment. 🙈
  • "p1" (OSSL_PKEY_PARAM_RSA_TEST_P1) <unsigned integer>
  • "p2" (OSSL_PKEY_PARAM_RSA_TEST_P2) <unsigned integer>
  • "q1" (OSSL_PKEY_PARAM_RSA_TEST_Q1) <unsigned integer>
  • "q2" (OSSL_PKEY_PARAM_RSA_TEST_Q2) <unsigned integer>

the auxiliary probable primes. 🎀

🔥 RSA key validation 🔥

for RSA keys, EVP_PKEY_param_check(3) and EVP_PKEY_param_check_quick(3) both return 1 unconditionally. no notes. slay.

for RSA keys, EVP_PKEY_public_check(3) conforms to the SP800-56Br1 public key check when the OpenSSL FIPS provider is used. the OpenSSL default provider performs similar tests but relaxes the keysize restrictions for backwards compatibility. 💅

for RSA keys, EVP_PKEY_public_check_quick(3) is the same as EVP_PKEY_public_check(3). twins fr fr.

for RSA keys, EVP_PKEY_private_check(3) conforms to the SP800-56Br1 private key test. 🫶

for RSA keys, EVP_PKEY_pairwise_check(3) conforms to the SP800-56Br1 KeyPair Validation check for the OpenSSL FIPS provider. the OpenSSL default provider allows testing of the validity of multi-primes. 👑

🌟 CONFORMING TO 🌟

  • FIPS186-5 — Section A.1.6 Generation of Probable Primes with Conditions Based on Auxiliary Probable Primes
  • RFC 8017, excluding RSA-PSS and RSA-OAEP

🎀 EXAMPLES 🎀

an EVP_PKEY context can be obtained by calling:

EVP_PKEY_CTX *pctx =
    EVP_PKEY_CTX_new_from_name(NULL, "RSA", NULL);

an RSA key can be generated simply like this:

pkey = EVP_RSA_gen(4096);

or like this:

EVP_PKEY *pkey = NULL;
EVP_PKEY_CTX *pctx =
    EVP_PKEY_CTX_new_from_name(NULL, "RSA", NULL);

EVP_PKEY_keygen_init(pctx);
EVP_PKEY_generate(pctx, &pkey);
EVP_PKEY_CTX_free(pctx);

an RSA key can be generated with key generation parameters:

unsigned int primes = 3;
unsigned int bits = 4096;
OSSL_PARAM params[3];
EVP_PKEY *pkey = NULL;
EVP_PKEY_CTX *pctx = EVP_PKEY_CTX_new_from_name(NULL, "RSA", NULL);

EVP_PKEY_keygen_init(pctx);

params[0] = OSSL_PARAM_construct_uint("bits", &bits);
params[1] = OSSL_PARAM_construct_uint("primes", &primes);
params[2] = OSSL_PARAM_construct_end();
EVP_PKEY_CTX_set_params(pctx, params);

EVP_PKEY_generate(pctx, &pkey);
EVP_PKEY_print_private(bio_out, pkey, 0, NULL);
EVP_PKEY_CTX_free(pctx);

🦋 SEE ALSO 🦋

💖 HISTORY 💖

the RSA key generation parameters "a" and "b" were added in OpenSSL 4.0. ✨

Copyright 2020-2026 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

and that's the whole page, bestie!! 🌈 this was OpenSSL 4.0.3, dated 2026-09-29 — go forth and generate responsibly, mwah 💅💖🎀

📦 where this page comes from