def generate_and_write_rsa_keypair(filepath=None, bits=DEFAULT_RSA_KEY_BITS,<EOL>password=None):
<EOL>securesystemslib.formats.RSAKEYBITS_SCHEMA.check_match(bits)<EOL>rsa_key = securesystemslib.keys.generate_rsa_key(bits)<EOL>public = rsa_key['<STR_LIT>']['<STR_LIT>']<EOL>private = rsa_key['<STR_LIT>']['<STR_LIT>']<EOL>if not filepath:<EOL><INDENT>filepath = os.path.join(os.getcwd(), rsa_key['<STR_LIT>'])<EOL><DEDENT>else:<EOL><INDENT>logger.debug('<STR_LIT>'<EOL>'<STR_LIT>')<EOL><DEDENT>securesystemslib.formats.PATH_SCHEMA.check_match(filepath)<EOL>if password is None: <EOL><INDENT>password = get_password('<STR_LIT>'<EOL>'<STR_LIT>' + Fore.RED + filepath + Fore.RESET + '<STR_LIT>',<EOL>confirm=True)<EOL><DEDENT>else:<EOL><INDENT>logger.debug('<STR_LIT>')<EOL><DEDENT>securesystemslib.formats.PASSWORD_SCHEMA.check_match(password)<EOL>if len(password):<EOL><INDENT>private = securesystemslib.keys.create_rsa_encrypted_pem(private, password)<EOL><DEDENT>else:<EOL><INDENT>logger.debug('<STR_LIT>')<EOL><DEDENT>securesystemslib.util.ensure_parent_dir(filepath)<EOL>file_object = securesystemslib.util.TempFile()<EOL>file_object.write(public.encode('<STR_LIT:utf-8>'))<EOL>file_object.move(filepath + '<STR_LIT>')<EOL>file_object = securesystemslib.util.TempFile()<EOL>file_object.write(private.encode('<STR_LIT:utf-8>'))<EOL>file_object.move(filepath)<EOL>return filepath<EOL>
<Purpose>
  Generate an RSA key pair.  The public portion of the generated RSA key is
  saved to <'filepath'>.pub, whereas the private key portion is saved to
  <'filepath'>.  If no password is given, the user is prompted for one.  If
  the 'password' is an empty string, the private key is saved unencrypted to
  <'filepath'>.  If the filepath is not given, the KEYID is used as the
  filename and the keypair saved to the current working directory.

  The best available form of encryption, for a given key's backend, is used
  with pyca/cryptography.  According to their documentation, "it is a curated
  encryption choice and the algorithm may change over time."

<Arguments>
  filepath:
    The public and private key files are saved to <filepath>.pub and
    <filepath>, respectively.  If the filepath is not given, the public and
    private keys are saved to the current working directory as <KEYID>.pub
    and <KEYID>.  KEYID is the generated key's KEYID.

  bits:
    The number of bits of the generated RSA key.

  password:
    The password to encrypt 'filepath'.  If None, the user is prompted for a
    password.  If an empty string is given, the private key is written to
    disk unencrypted.

<Exceptions>
  securesystemslib.exceptions.FormatError, if the arguments are improperly
  formatted.

<Side Effects>
  Writes key files to '<filepath>' and '<filepath>.pub'.

<Returns>
  The 'filepath' of the written key.