PKCS11 key pair generation - attributes MODULUS_BITS and PUBLIC_EXPONENT

Question

We're using a rather low-level PKCS#11 interface and are trying to generate a key-pair for RSA with it. We're using the mechanism RSA_PKCS_KEY_PAIR_GEN (0x00). Among others we have copied the following two attributes from one of the interface's code samples:

MODULUS_BITS (0x0121) = 1024
PUBLIC_EXPONENT (0x0122) = { 0x01, 0x00, 0x01 }

We're pretty sure that the used values are demo values only and we need to use different ones in our production code.

Two questions actually:

1. Is MODULUS_BITS the length of the generated key? I.e., is 4096 a good value nowadays?
2. Is PUBLIC_EXPONENT really required? What is it?

Answer 1

1. Yes, MODULUS_BITS is the key length. 4096 supposed to be good nowadays.
2. PUBLIC_EXPONENT is public and { 0x01, 0x00, 0x01 } = 65537 is widely used value since:
   • it's prime
   • it's not too short
   • it's not too long and contains only two '1' in it's binary representation - that makes binary exponentiation fast (you can encrypt or check signature quicker)

PUBLIC_EXPONENT is really required in the RSA algorithm, but it's possible that if you omit it, the generation algorithm would use 65537 by default.