# SecKeyGeneratePair(_:_:_:) Creates an asymmetric key pair. ``` func SecKeyGeneratePair(_ parameters: CFDictionary, _ publicKey: UnsafeMutablePointer?, _ privateKey: UnsafeMutablePointer?) -> OSStatus ``` ## Parameters `parameters` A dictionary of key-value pairs that specify the type of keys to be generated. `publicKey` On return, points to the keychain item object of the new public key. In Objective-C, call the function to release this object when you are finished with it. `privateKey` On return, points to the keychain item object of the new private key. In Objective-C, call the function to release this object when you are finished with it. ## Return Value A result code. See [Security Framework Result Codes](/documentation/Security/security-framework-result-codes). ## Discussion In order to generate a key pair, the dictionary passed in the `parameters` parameter must contain at least the following key-value pairs: - A [`kSecAttrKeyType`](/documentation/Security/kSecAttrKeyType) key with a value of any key type defined in `SecItem.h` (see [Keychain services](/documentation/Security/keychain-services)), for example, [`kSecAttrKeyTypeRSA`](/documentation/Security/kSecAttrKeyTypeRSA). - A [`kSecAttrKeySizeInBits`](/documentation/Security/kSecAttrKeySizeInBits) key with a value specifying the requested key size in bits. This can be specified as either a `CFNumberRef` or `CFStringRef` value. For example, RSA keys may have key size values of 512, 768, 1024, or 2048. In addition, you can specify a number of other optional attributes for the public and private keys. The way you do this depends on whether you are writing code for macOS or iOS: - In macOS, add the key-value pairs to the `parameters` dictionary directly. The specified attributes are applied to both the public and private keys. - In iOS, add dictionaries for the keys [`kSecPublicKeyAttrs`](/documentation/Security/kSecPublicKeyAttrs) and [`kSecPrivateKeyAttrs`](/documentation/Security/kSecPrivateKeyAttrs) to the `parameters` dictionary, and provide the attributes in those dictionaries. The attributes specified in these dictionaries are added to either the public or private key, respectively, allowing you to apply separate attributes to each key. The possible attributes are as follows; for details on each attribute, see [Keychain services](/documentation/Security/keychain-services): - [`kSecAttrLabel`](/documentation/Security/kSecAttrLabel)—Default `NULL`. - [`kSecAttrIsPermanent`](/documentation/Security/kSecAttrIsPermanent)—If this key is present and has a Boolean value of `true`, the key or key pair is added to the default    keychain. - [`kSecAttrApplicationTag`](/documentation/Security/kSecAttrApplicationTag)—Default `NULL`. - [`kSecAttrEffectiveKeySize`](/documentation/Security/kSecAttrEffectiveKeySize)—Default (`NULL`) sets the effective key size to the same as the total key size (`kSecAttrKeySizeInBits`). - [`kSecAttrCanEncrypt`](/documentation/Security/kSecAttrCanEncrypt)—Default `false` for private keys, `true` for public keys. - [`kSecAttrCanDecrypt`](/documentation/Security/kSecAttrCanDecrypt)—Default `true` for private keys, `false` for public keys. - [`kSecAttrCanDerive`](/documentation/Security/kSecAttrCanDerive)—Default `true`. - [`kSecAttrCanSign`](/documentation/Security/kSecAttrCanSign)—Default `true` for private keys, `false` for public keys. - [`kSecAttrCanVerify`](/documentation/Security/kSecAttrCanVerify)—Default `false` for private keys, `true` for public keys. - [`kSecAttrCanUnwrap`](/documentation/Security/kSecAttrCanUnwrap)—Default `true` for private keys, `false` for public keys. --- Copyright © 2026 Apple Inc. All rights reserved. | [Terms of Use](https://www.apple.com/legal/internet-services/terms/site.html) | [Privacy Policy](https://www.apple.com/privacy/privacy-policy)