<!--
{
  "documentType" : "article",
  "framework" : "Security",
  "identifier" : "/documentation/Security/key-generation-attributes",
  "metadataVersion" : "0.1.0",
  "role" : "collectionGroup",
  "title" : "Key Generation Attributes"
}
-->

# Key Generation Attributes

Use attribute dictionary keys during cryptographic key generation.

## Discussion

Use these dictionary keys in the `parameter` dictionary when you create new cryptographic keys with the [`SecKeyCreateRandomKey(_:_:)`](/documentation/Security/SecKeyCreateRandomKey(_:_:)) function. The type and size attributes are required, while all others are optional.

With the exception of [`kSecAttrTokenID`](/documentation/Security/kSecAttrTokenID), you can specify the optional keys in either the top-level `parameter` dictionary or in one of the key-specific sub-dictionaries specified by the [`kSecPrivateKeyAttrs`](/documentation/Security/kSecPrivateKeyAttrs) and [`kSecPublicKeyAttrs`](/documentation/Security/kSecPublicKeyAttrs) attributes. In the latter case, the given attribute applies only to the private or public key, respectively.

Use these keys in exactly the same way for the `parameter` dictionary you supply to the legacy [`SecKeyGeneratePair(_:_:_:)`](/documentation/Security/SecKeyGeneratePair(_:_:_:)) function.

## Topics

### Required

[`kSecAttrKeyType`](/documentation/Security/kSecAttrKeyType)

A key whose value indicates the item’s algorithm.

[`kSecAttrKeySizeInBits`](/documentation/Security/kSecAttrKeySizeInBits)

A key whose value indicates the number of bits in a cryptographic key.

### Key Specific

[`kSecPrivateKeyAttrs`](/documentation/Security/kSecPrivateKeyAttrs)

A key whose value is a dictionary of cryptographic key attributes specific to a private key.

[`kSecPublicKeyAttrs`](/documentation/Security/kSecPublicKeyAttrs)

A key whose value is a dictionary of cryptographic key attributes specific to a public key.

### Optional

[`kSecAttrLabel`](/documentation/Security/kSecAttrLabel)

A key with a value that’s a string indicating the item’s label.

[`kSecAttrTokenID`](/documentation/Security/kSecAttrTokenID)

A key whose value indicates that a cryptographic key is in an external store.

[`kSecAttrIsPermanent`](/documentation/Security/kSecAttrIsPermanent)

A key whose value indicates the item’s permanence.

[`kSecAttrApplicationTag`](/documentation/Security/kSecAttrApplicationTag)

A key whose value indicates the item’s private tag.

[`kSecAttrEffectiveKeySize`](/documentation/Security/kSecAttrEffectiveKeySize)

A key whose value indicates the effective number of bits in a cryptographic key.

[`kSecAttrCanEncrypt`](/documentation/Security/kSecAttrCanEncrypt)

A key whose value is a Boolean that indicates whether the cryptographic key can be used for encryption.

[`kSecAttrCanDecrypt`](/documentation/Security/kSecAttrCanDecrypt)

A key whose value is a Boolean that indicates whether the cryptographic key can be used for decryption.

[`kSecAttrCanDerive`](/documentation/Security/kSecAttrCanDerive)

A key whose value is a Boolean that indicates whether the cryptographic key can be used for derivation.

[`kSecAttrCanSign`](/documentation/Security/kSecAttrCanSign)

A key whose value is a Boolean that indicates whether the cryptographic key can be used for digital signing.

[`kSecAttrCanVerify`](/documentation/Security/kSecAttrCanVerify)

A key whose value is a Boolean that indicates whether the cryptographic key can be used for signature verification.

[`kSecAttrCanWrap`](/documentation/Security/kSecAttrCanWrap)

A key whose value is a Boolean that indicates whether the cryptographic key can be used for wrapping.

[`kSecAttrCanUnwrap`](/documentation/Security/kSecAttrCanUnwrap)

A key whose value is a Boolean that indicates whether the cryptographic key can be used for unwrapping.


---

Copyright &copy; 2026 Apple Inc. All rights reserved. | [Terms of Use](https://www.apple.com/legal/internet-services/terms/site.html) | [Privacy Policy](https://www.apple.com/privacy/privacy-policy)