EVP_PKEY_GET...LT_DIGEST_NID(3ossl)

📦
version 15.1 · 3 versions
, in freebsd 15.1

💅 EVP_PKEY_GET_DEFAULT_DIGEST_NAME / EVP_PKEY_GET_DEFAULT_DIGEST_NID 💅

okay bestie, so this is a page from the OpenSSL manual — yes, that OpenSSL, the one your whole internet secretly runs on 🫶 — and it's all about the two lil' functions that tell you which digest a key wants for signing. grab a boba, we're getting into it ✨

🌸 NAME 🌸

EVP_PKEY_get_default_digest_nid, EVP_PKEY_get_default_digest_name — get the default signature digest, that's the whole vibe 💫

🦋 SYNOPSIS 🦋

#include <openssl/evp.h>

int EVP_PKEY_get_default_digest_name(EVP_PKEY *pkey,
                                     char *mdname, size_t mdname_sz);
int EVP_PKEY_get_default_digest_nid(EVP_PKEY *pkey, int *pnid);

look at them, so tidy, so iconic 👑

🎀 DESCRIPTION 🎀

✨ EVP_PKEY_get_default_digest_name() ✨

so this one fills in the default message digest name for the public key signature operations that go with the key pkey — and it drops that name into mdname, writing up to at most mdname_sz bytes, and that count includes the ending NUL byte, so don't forget to leave room for the terminator bestie 😭

and here's the fun part: the name could be "UNDEF", which is basically the function saying "idk, digest is optional-ish" — it means a digest must (that's for return value 2) or may (that's for return value 1) be left unspecified. iykyk 💅

✨ EVP_PKEY_get_default_digest_nid() ✨

this one sets pnid to the default message digest NID for the public key signature operations associated with pkey. lowkey important detail: some signature algorithms — looking at you, Ed25519 and Ed448 👀 — do not use a digest during signing. in that case pnid gets set to NID_undef, no drama.

and ngl, this function is only reliable for legacy keys — meaning keys with a EVP_PKEY_ASN1_METHOD. those keys have typically been loaded from engines, or created with EVP_PKEY_assign_RSA(3) or something similar. bestie please note the "only reliable", it's giving fine-print for a reason 🙈

🌈 NOTES 🌈

for all current standard OpenSSL public key algorithms, SHA256 is returned. that's it, that's the note. slay, consistency 💖

🔥 RETURN VALUES 🔥

both EVP_PKEY_get_default_digest_name() and EVP_PKEY_get_default_digest_nid() return:

  1. 1 if the message digest is advisory — meaning, other digests can be used 🫶
  2. 2 if it is mandatory — meaning, other digests can not be used, periodt 🚫

and for failure? they return 0 or a negative value. and in particular — mark this in your notes bestie —

a return value of -2 means the operation is not supported by the public key algorithm 💀

👑 SEE ALSO 👑

go read these next, they're in the group chat too:

🧚 HISTORY 🧚

this function was added in OpenSSL 1.0.0 — a true elder, been serving looks since day one ⭐

Copyright 2006-2023 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

so yeah, read the license, it's the rules 🎀

and that's the page!! mwah 💋 — this little beauty is from OpenSSL 3.5.6, dated 2026-04-0, and it's the EVP_PKEY_GET...LT_DIGEST_NID(3ossl) page, so now you know exactly who to thank when your signatures just work 🌸🦋✨

📦 where this page comes from