ckaesgen [ -n | -p PIN ] [ -s token-name ] [ template options ]

Generates an AES secret key.

Option Description

-n, --nopin

Doesn’t call C_Login, makes key public object.

-p, --pin-for-testing=PIN

Use PIN for C_Login.

Exposes PIN, use for testing only.

-s, --slot-name=SLOT

Use only named SLOT.

Template options

-l, --keylength=VALUE_LEN

Sets key length to 128 or 256.
Default: 128

-L, --label=LABEL

Sets CKA_LABEL. Default: Example label


Sets CKA_SIGN to true (default).


Sets CKA_SIGN to false.


Sets CKA_ENCRYPT and CKA_DECRYPT to true (default).


Sets CKA_ENCRYPT and CKA_DECRYPT to false.


Sets CKA_WRAP and CKA_UNWRAP to true (default).


Sets CKA_WRAP and CKA_UNWRAP to false.


Sets CKA_DERIVE to true (default).


Sets CKA_DERIVE to false.


Sets CKA_SENSITIVE to true (default).


Sets CKA_SENSITIVE to false.




Sets CKA_EXTRACTABLE to false (default).


Sets CKA_MODIFIABLE to true (default).


Sets CKA_MODIFIABLE to false.

Help options

-h, --help

Displays help for ckaesgen.

-u, --usage

Displays a brief usage summary for ckaesgen.

-V, --version

Displays the version number of the Security World Software that deploys ckaesgen.