diff --git a/libseckey/sk_cca.c b/libseckey/sk_cca.c
index 24ae8bc5..14a260e1 100644
--- a/libseckey/sk_cca.c
+++ b/libseckey/sk_cca.c
@@ -258,7 +258,9 @@ static int sk_cca_get_library_functions(const struct sk_ext_cca_lib *cca_lib,
  *
  * @param cca_lib           the CCA library structure
  * @param curve_nid         the nid specifying the curve.
- * @param key_token         a buffer to store the generated key token
+ * @param key_token         a buffer to store the generated key token. If NULL,
+ *                          the required buffer size is returned in
+ *                          key_token_length (size query).
  * @param key_token_length  On entry: the size of the buffer
  *                          On return: the size of the key token
  * @param debug             if true, debug messages are printed
@@ -286,7 +288,7 @@ int SK_CCA_generate_ec_key_pair(const struct sk_ext_cca_lib *cca_lib,
 	long param1 = 0;
 	int rc;
 
-	if (cca_lib == NULL || key_token == NULL || key_token_length == NULL)
+	if (cca_lib == NULL || key_token_length == NULL)
 		return -EINVAL;
 
 	if (key_token == NULL) {
@@ -384,7 +386,9 @@ int SK_CCA_generate_ec_key_pair(const struct sk_ext_cca_lib *cca_lib,
  *                          3, 5, 17, 257, or 65537. Specify zero to choose the
  *                          exponent by random (only possible for modulus_bits
  *                          up to 2048).
- * @param key_token         a buffer to store the generated key token
+ * @param key_token         a buffer to store the generated key token. If NULL,
+ *                          the required buffer size is returned in
+ *                          key_token_length (size query).
  * @param key_token_length  On entry: the size of the buffer
  *                          On return: the size of the key token
  * @param debug             if true, debug messages are printed
@@ -412,7 +416,7 @@ int SK_CCA_generate_rsa_key_pair(const struct sk_ext_cca_lib *cca_lib,
 	long param1 = 0;
 	int rc;
 
-	if (cca_lib == NULL || key_token == NULL || key_token_length == NULL)
+	if (cca_lib == NULL || key_token_length == NULL)
 		return -EINVAL;
 
 	if (key_token == NULL) {
diff --git a/libseckey/sk_ep11.c b/libseckey/sk_ep11.c
index 8b166873..6f461962 100644
--- a/libseckey/sk_ep11.c
+++ b/libseckey/sk_ep11.c
@@ -195,7 +195,7 @@ static int sk_ep11_generate_key_pair(const struct sk_ext_ep11_lib *ep11_lib,
 	CK_RV rv;
 	int rc;
 
-	if (ep11_lib == NULL || key_token == NULL || key_token_length == NULL)
+	if (ep11_lib == NULL || key_token_length == NULL)
 		return -EINVAL;
 
 	if (key_token == NULL) {
@@ -262,7 +262,9 @@ static int sk_ep11_generate_key_pair(const struct sk_ext_ep11_lib *ep11_lib,
  *
  * @param ep11_lib          the Ep11 library structure
  * @param curve_nid         the nid specifying the curve.
- * @param key_token         a buffer to store the generated key token
+ * @param key_token         a buffer to store the generated key token. If NULL,
+ *                          the required buffer size is returned in
+ *                          key_token_length (size query).
  * @param key_token_length  On entry: the size of the buffer
  *                          On return: the size of the key token
  * @param debug             if true, debug messages are printed
@@ -292,7 +294,7 @@ int SK_EP11_generate_ec_key_pair(const struct sk_ext_ep11_lib *ep11_lib,
 	const struct sk_ec_curve_info *curve;
 	int rc;
 
-	if (ep11_lib == NULL || key_token == NULL || key_token_length == NULL)
+	if (ep11_lib == NULL || key_token_length == NULL)
 		return -EINVAL;
 
 	sk_debug(debug, "curve_nid: %d", curve_nid);
@@ -331,7 +333,9 @@ int SK_EP11_generate_ec_key_pair(const struct sk_ext_ep11_lib *ep11_lib,
  *                          3, 5, 17, 257, or 65537. Specify zero to choose the
  *                          exponent by random.
  * @param x9_31             if true, generate a X9.31 RSA key
- * @param key_token         a buffer to store the generated key token
+ * @param key_token         a buffer to store the generated key token. If NULL,
+ *                          the required buffer size is returned in
+ *                          key_token_length (size query).
  * @param key_token_length  On entry: the size of the buffer
  *                          On return: the size of the key token
  * @param debug             if true, debug messages are printed
@@ -365,7 +369,7 @@ int SK_EP11_generate_rsa_key_pair(const struct sk_ext_ep11_lib *ep11_lib,
 	CK_ULONG priv_tmpl_num = sizeof(priv_tmpl) / sizeof(CK_ATTRIBUTE);
 	int rc;
 
-	if (ep11_lib == NULL || key_token == NULL || key_token_length == NULL)
+	if (ep11_lib == NULL || key_token_length == NULL)
 		return -EINVAL;
 
 	sk_debug(debug, "modulus_bits: %lu pub_exp: %u x9_31: %d",