EVP_PKEY_CTX_NEW(3ossl)

📦
version 15.1 · 2 versions
, in freebsd 15.1

💖 EVP_PKEY_CTX_NEW(3ossl) — OpenSSL public key algorithm context manual, bestie cut 💖

okay so real talk: this is the 3ossl page for all the EVP_PKEY_CTX new/dup/free/is_a functions, and it’s lowkey the backstage pass to OpenSSL’s high-level public key API. no cap. 💅

🌸 NAME 🌸

EVP_PKEY_CTX_new, EVP_PKEY_CTX_new_id, EVP_PKEY_CTX_new_from_name, EVP_PKEY_CTX_new_from_pkey, EVP_PKEY_CTX_dup, EVP_PKEY_CTX_free, EVP_PKEY_CTX_is_a — these are the public key algorithm context functions. yes bestie, all of them, we’re covering every single one 🫶

✨ SYNOPSIS ✨

#include <openssl/evp.h>

EVP_PKEY_CTX *EVP_PKEY_CTX_new(EVP_PKEY *pkey, ENGINE *e);
EVP_PKEY_CTX *EVP_PKEY_CTX_new_id(int id, ENGINE *e);
EVP_PKEY_CTX *EVP_PKEY_CTX_new_from_name(OSSL_LIB_CTX *libctx,
                                         const char *name,
                                         const char *propquery);
EVP_PKEY_CTX *EVP_PKEY_CTX_new_from_pkey(OSSL_LIB_CTX *libctx,
                                         EVP_PKEY *pkey,
                                         const char *propquery);
EVP_PKEY_CTX *EVP_PKEY_CTX_dup(const EVP_PKEY_CTX *ctx);
void EVP_PKEY_CTX_free(EVP_PKEY_CTX *ctx);
int EVP_PKEY_CTX_is_a(EVP_PKEY_CTX *ctx, const char *keytype);

🦋 DESCRIPTION 🦋

okay so here’s the vibe check on every function, one by one:

  • EVP_PKEY_CTX_new() — allocates a public key algorithm context using the pkey key type and ENGINE e. that’s the O.G. move 💅
  • EVP_PKEY_CTX_new_id() — allocates a public key algorithm context using the key type specified by id and ENGINE e. iconic, honestly ✨
  • EVP_PKEY_CTX_new_from_name() — allocates a public key algorithm context using the library context libctx (see OSSL_LIB_CTX(3)), the key type specified by name, and the property query propquery. and bestie, listen: none of the arguments are duplicated, so they must remain unchanged for the lifetime of the returned EVP_PKEY_CTX or of any of its duplicates. read further about the possible names in NOTES below 👀
  • EVP_PKEY_CTX_new_from_pkey() — allocates a public key algorithm context using the library context libctx (see OSSL_LIB_CTX(3)) and the algorithm specified by pkey and the property query propquery. again: none of the arguments are duplicated, so they must remain unchanged for the lifetime of the returned EVP_PKEY_CTX or any of its duplicates. noted, queen 🎀
  • EVP_PKEY_CTX_new_id() and EVP_PKEY_CTX_new_from_name() are normally used when no EVP_PKEY structure is associated with the operations, for example during parameter generation or key generation for some algorithms. it’s giving “no pkey? no problem” energy 🔥
  • EVP_PKEY_CTX_dup() — duplicates the context ctx. it is not supported for a keygen operation. it is however possible to duplicate a context freshly created via any of the above “new” functions, provided EVP_PKEY_keygen_init(3) has not yet been called on the source context, and then use the copy for key generation. lowkey specific, but important 🫶
  • EVP_PKEY_CTX_free() — frees up the context ctx. if ctx is NULL, nothing is done. clean, simple, no drama 💖
  • EVP_PKEY_is_a() — checks if the key type associated with ctx is keytype. yes, that’s exactly how the page says it here, bestie 😭

📝 NOTES 📝

🫶 On EVP_PKEY_CTX 🫶

the EVP_PKEY_CTX structure is an opaque public key algorithm context used by the OpenSSL high-level public key API.

🚨 major warning, bestie: contexts MUST NOT be shared between threads: that is it is not permissible to use the same context simultaneously in two threads. do not do it. i’m serious. 💀

🦋 On Key Types 🦋

we mention “key type” in this manual, which is the same as “algorithm” in most cases, allowing either term to be used interchangeably.

there are algorithms where the key type and the algorithm of the operations that use the keys are not the same, such as EC keys being used for ECDSA and ECDH operations. iykyk 🌈

key types are given in two different manners:

💜 Legacy NID or EVP_PKEY type 💜

this is the id used with EVP_PKEY_CTX_new_id().

these are EVP_PKEY_RSA, EVP_PKEY_RSA_PSS, EVP_PKEY_DSA, EVP_PKEY_DH, EVP_PKEY_EC, EVP_PKEY_SM2, EVP_PKEY_X25519, EVP_PKEY_X448, and are used by legacy methods. vintage, but make it cryptographic ✨

🎀 Name strings 🎀

this is the name used with EVP_PKEY_CTX_new_from_name().

these are names like "RSA", "DSA", and what’s available depends on what providers are currently accessible.

the OpenSSL providers offer a set of key types available this way, please see OSSL_PROVIDER-FIPS(7) and OSSL_PROVIDER-default(7) and related documentation for more information. provider girlies stay winning 💅

⭐ RETURN VALUES ⭐

  • EVP_PKEY_CTX_new(), EVP_PKEY_CTX_new_id() and EVP_PKEY_CTX_dup() return either the newly allocated EVP_PKEY_CTX structure or NULL if an error occurred. classic “it’s giving success or it’s giving NULL” 😭
  • EVP_PKEY_CTX_free() does not return a value. it’s above returning things, honestly 🎀
  • EVP_PKEY_CTX_is_a() returns 1 for true and 0 for false. binary queen 👑

👀 SEE ALSO 👀

EVP_PKEY_new(3)

🕰️ HISTORY 🕰️

the EVP_PKEY_CTX_new(), EVP_PKEY_CTX_new_id(), EVP_PKEY_CTX_dup() and EVP_PKEY_CTX_free() functions were added in OpenSSL 1.0.0.

the EVP_PKEY_CTX_new_from_name() and EVP_PKEY_CTX_new_from_pkey() functions were added in OpenSSL 3.0. glow-up timeline fr fr ✨

Copyright 2006-2025 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the “License”). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

🌈 that’s the whole page, bestie! this one is from OpenSSL 3.5.6, dated 2026-04-07, and it’s the EVP_PKEY_CTX_NEW(3ossl) manual. mwah 💋
📦 where this page comes from