EVP_PKEY_SIGN(3ossl)

💖 EVP_PKEY_SIGN(3ossl) — the OpenSSL signing glow-up 💖

okay so bestie, you know how a manpage header is like EVP_PKEY_SIGN(3ossl) and OpenSSL up in the corner? that's this page. it's the whole "sign stuff with a public key algorithm" saga, and honestly it ate. let's get into it 🫶

---

✨ NAME ✨

EVP_PKEY_sign_init, EVP_PKEY_sign_init_ex, EVP_PKEY_sign_init_ex2, EVP_PKEY_sign, EVP_PKEY_sign_message_init, EVP_PKEY_sign_message_update, EVP_PKEY_sign_message_final — all of them, together, signing using a public key algorithm. that's the whole vibe 💅

---

🌸 SYNOPSIS 🌸

#include <openssl/evp.h>

int EVP_PKEY_sign_init(EVP_PKEY_CTX *ctx);
int EVP_PKEY_sign_init_ex(EVP_PKEY_CTX *ctx, const OSSL_PARAM params[]);
int EVP_PKEY_sign_init_ex2(EVP_PKEY_CTX *ctx, EVP_SIGNATURE *algo,
                           const OSSL_PARAM params[]);
int EVP_PKEY_sign_message_init(EVP_PKEY_CTX *ctx, EVP_SIGNATURE *algo,
                               const OSSL_PARAM params[]);
int EVP_PKEY_sign_message_update(EVP_PKEY_CTX *ctx,
                                 unsigned char *in, size_t inlen);
int EVP_PKEY_sign_message_final(EVP_PKEY_CTX *ctx, unsigned char *sig,
                                size_t *siglen, size_t sigsize);
int EVP_PKEY_sign(EVP_PKEY_CTX *ctx,
                  unsigned char *sig, size_t *siglen,
                  const unsigned char *tbs, size_t tbslen);

no cap, that's a lot of functions, but they all make sense once you meet them individually 💜

---

🦋 DESCRIPTION 🦋

• EVP_PKEY_sign_init() — bestie this one initializes a public key algorithm context ctx for signing, using whatever algorithm was given when the context got created via EVP_PKEY_CTX_new(3) or its little variants. the algorithm is used to fetch a EVP_SIGNATURE method implicitly, and if you wanna know what that even means, go read "Implicit fetch" in provider(7) — it explains implicit fetches way better than I could over text 💀
• EVP_PKEY_sign_init_ex() — literally the same as EVP_PKEY_sign_init(), except it also sets the passed parameters params on the context before it returns. that's it. that's the whole upgrade. iconic behavior honestly ✨
• EVP_PKEY_sign_init_ex2() — this one initializes a public key algorithm context ctx for signing a pre-computed message digest, using the algorithm given by algo and the key given through EVP_PKEY_CTX_new(3) or EVP_PKEY_CTX_new_from_pkey(3). important: a context ctx that has no pre-loaded key cannot be used with this function, periodt. it does almost the exact same thing as EVP_PKEY_sign_init_ex(), except it's uniquely intended for a pre-computed message digest, and it lets you pre-determine the exact conditions for that message digest — if, say, a composite signature algorithm (think RSA-SHA256) got fetched 👑. after you call this, setting parameters that mess with the digest implementation or padding is not normally supported, so like… don't 🙈
• EVP_PKEY_sign_message_init() — initializes a public key algorithm context ctx for signing a message of unlimited size, using the algorithm given by algo and the key given through EVP_PKEY_CTX_new(3) or EVP_PKEY_CTX_new_from_pkey(3). you can pass the message one-shot style with EVP_PKEY_sign(), or do the combo of EVP_PKEY_sign_message_update() + EVP_PKEY_sign_message_final(). this function is what lets you use algorithms that can process input of arbitrary length — ED25519, RSA-SHA256, and similar girlies 🌈
• EVP_PKEY_sign_message_update() — adds inlen bytes from in to the data that's gonna be processed for the signature. the signature algorithm spec and implementation get to decide how those input bytes are processed and whether there's a limit on the total input size. scroll down to "NOTES" for the deeper lore on that one 🧚
• EVP_PKEY_sign_message_final() — signs the processed data and drops it into sig, then puts the number of signature bytes into *siglen… but only if that number of bytes doesn't surpass the size given by sigsize. and here's the cute part: sig may be NULL, and in that case only *siglen gets updated with the number of signature bytes. size-query era 💅
• EVP_PKEY_sign() — the one-shot baddie that works with all the init functions above. the behavior is giving "depends on how you initialized":
  • when initialization happened with EVP_PKEY_sign_init(), EVP_PKEY_sign_init_ex() or EVP_PKEY_sign_init_ex2(), the data specified by tbs and tbslen is signed after appropriate padding.
  • when initialization happened with EVP_PKEY_sign_message_init(), the data specified by tbs and tbslen is digested by the implied message digest algorithm first, and then the result is signed after appropriate padding.
  • if sig is NULL, the maximum size of the output buffer gets written to the siglen parameter 📏
  • if sig is not NULL, then before the call the siglen parameter should contain the length of the sig buffer, and if the call succeeds, the signature is written to sig and the amount of data written goes into siglen. slay 💖

---

💀 NOTES 💀

🌟 General 🌟

okay so some signature implementations are literally just accumulating your input data and doing zero further processing before signing it — they expect the input to be a digest already. others compress the data, typically by internally producing a digest and signing that result. and some overachievers support both modes of operation at the same time 😭. the caller (that's you, bestie) is expected to know how the chosen algorithm is supposed to behave and under what conditions. iykyk.

for example:

• an RSA implementation can be expected to only expect a message digest as input.
• ED25519 can be expected to process the input with a hash, i.e. produce the message digest internally.
• RSA-SHA256 can be expected to handle either mode of operation, depending on whether the operation was initialized with EVP_PKEY_sign_init_ex2() or with EVP_PKEY_sign_message_init(). main character energy, honestly 👑

similarly, an RSA implementation usually expects you to set additional details, like the message digest algorithm that the input is supposed to be digested with, plus the padding mode (peep EVP_PKEY_CTX_set_signature_md(3) and EVP_PKEY_CTX_set_rsa_padding(3) and similar others) — while an RSA-SHA256 implementation usually has all those details pre-set and immutable. no take-backsies 🔥

⚠️ okay this next bit is important, don't scroll past it: the functions described here can't be used to combine separate algorithms. specifically, neither EVP_PKEY_CTX_set_signature_md(3) nor the OSSL_PARAM parameter "digest" (OSSL_SIGNATURE_PARAM_DIGEST) can be used to combine a signature algorithm with a hash algorithm to process the input. in other words: you can't specify a ctx pre-loaded with an RSA pkey, or an algo that fetched "RSA", and then try to specify SHA256 separately to get the functionality of RSA-SHA256. not the vibe. if combining algorithms in that manner is what you desire, please use EVP_DigestSignInit(3) and associated functions instead 🫶

🎀 Performing multiple signatures 🎀

• when initialized using EVP_PKEY_sign_init_ex() or EVP_PKEY_sign_init_ex2(), EVP_PKEY_sign() can be called more than once on the same context, so you can have several one-shot operations performed using the same parameters. reusing the context? we love a sustainable queen 🌸
• when initialized using EVP_PKEY_sign_message_init(), it is not possible to call EVP_PKEY_sign() multiple times. one and done, bestie 💀

---

⭐ RETURN VALUES ⭐

all the functions return 1 for success, and 0 or a negative value for failure. that's the whole scale ✨

and in particular — listen — EVP_PKEY_sign_init() and its other variants may return -2 to indicate that the operation is not supported by the public key algorithm. not a crash, not a vibe check failure, just -2 🙈

---

(part 1 done, part 2 is still coming bestie, don't go anywhere 💜)

✨ EXAMPLES ✨

okay bestie, this is the part where it actually gets good 💅 — four whole worked examples, like a little tutorial arc. every code block is verbatim, so copy-paste away, no cap.

RSA with PKCS#1 padding for SHA256

so you wanna sign data using RSA with PKCS#1 padding and a SHA256 digest as input. here's the whole vibe:

#include <openssl/evp.h>
#include <openssl/rsa.h>

EVP_PKEY_CTX *ctx;
/* md is a SHA-256 digest in this example. */
unsigned char *md, *sig;
size_t mdlen = 32, siglen;
EVP_PKEY *signing_key;

/*
 * NB: assumes signing_key and md are set up before the next
 * step. signing_key must be an RSA private key and md must
 * point to the SHA-256 digest to be signed.
 */
ctx = EVP_PKEY_CTX_new(signing_key, NULL /* no engine */);
if (ctx == NULL)
    /* Error occurred */
if (EVP_PKEY_sign_init(ctx) <= 0)
    /* Error */
if (EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_PADDING) <= 0)
    /* Error */
if (EVP_PKEY_CTX_set_signature_md(ctx, EVP_sha256()) <= 0)
    /* Error */

/* Determine buffer length */
if (EVP_PKEY_sign(ctx, NULL, &siglen, md, mdlen) <= 0)
    /* Error */

sig = OPENSSL_malloc(siglen);

if (sig == NULL)
    /* malloc failure */

if (EVP_PKEY_sign(ctx, sig, &siglen, md, mdlen) <= 0)
    /* Error */

/* Signature is siglen bytes written to buffer sig */

that two-pass thing where you call EVP_PKEY_sign() with a NULL buffer first just to learn the length? yeah, that's the whole move. icon behavior honestly 🔥

---

RSA-SHA256 with a pre-computed digest

next up: signing a digest with RSA-SHA256 using one-shot functions. important note bestie — RSA-SHA256 is assumed to be an implementation of "sha256WithRSAEncryption", for which the padding is pre-determined to be RSA_PKCS1_PADDING, and the input digest is assumed to have been computed using SHA256. so like, the algorithm already knows what it's doing, you don't gotta tell it twice 🫶

#include <openssl/evp.h>
#include <openssl/rsa.h>

EVP_PKEY_CTX *ctx;
/* md is a SHA-256 digest in this example. */
unsigned char *md, *sig;
size_t mdlen = 32, siglen;
EVP_PKEY *signing_key;

/*
 * NB: assumes signing_key and md are set up before the next
 * step. signing_key must be an RSA private key and md must
 * point to the SHA-256 digest to be signed.
 */
ctx = EVP_PKEY_CTX_new(signing_key, NULL /* no engine */);
alg = EVP_SIGNATURE_fetch(NULL, "RSA-SHA256", NULL);

if (ctx == NULL)
    /* Error occurred */
if (EVP_PKEY_sign_init_ex2(ctx, alg, NULL) <= 0)
    /* Error */

/* Determine buffer length */
if (EVP_PKEY_sign(ctx, NULL, &siglen, md, mdlen) <= 0)
    /* Error */

sig = OPENSSL_malloc(siglen);

if (sig == NULL)
    /* malloc failure */

if (EVP_PKEY_sign(ctx, sig, &siglen, md, mdlen) <= 0)
    /* Error */

/* Signature is siglen bytes written to buffer sig */

see how we swapped in EVP_PKEY_sign_init_ex2() and fetched the alg with EVP_SIGNATURE_fetch()? main character energy, truly 🎀

---

RSA-SHA256, one-shot

okay so now we're signing a document with RSA-SHA256 using one-shot functions. same deal as before: RSA-SHA256 is assumed to be an implementation of "sha256WithRSAEncryption", for which the padding is pre-determined to be RSA_PKCS1_PADDING.

#include <openssl/evp.h>
#include <openssl/rsa.h>

EVP_PKEY_CTX *ctx;
/* in is the input in this example. */
unsigned char *in, *sig;
/* inlen is the length of the input in this example. */
size_t inlen, siglen;
EVP_PKEY *signing_key;
EVP_SIGNATURE *alg;

/*
 * NB: assumes signing_key, in and inlen are set up before
 * the next step. signing_key must be an RSA private key,
 * in must point to data to be digested and signed, and
 * inlen must be the size of the data in bytes.
 */
ctx = EVP_PKEY_CTX_new(signing_key, NULL /* no engine */);
alg = EVP_SIGNATURE_fetch(NULL, "RSA-SHA256", NULL);

if (ctx == NULL || alg == NULL)
    /* Error occurred */
if (EVP_PKEY_sign_message_init(ctx, alg, NULL) <= 0)
    /* Error */

/* Determine sig buffer length */
if (EVP_PKEY_sign(ctx, NULL, &siglen, in, inlen) <= 0)
    /* Error */

sig = OPENSSL_malloc(siglen);

if (sig == NULL)
    /* malloc failure */

if (EVP_PKEY_sign(ctx, sig, &siglen, in, inlen) <= 0)
    /* Error */

/* Signature is siglen bytes written to buffer sig */

✨ EVP_PKEY_sign_message_init() is the glow-up here — it lets the algorithm handle the digesting and the signing in one go, and you just hand it raw data. literally so convenient.

---

RSA-SHA256, using update and final

this one is the same as the previous example, but allowing stream-like functionality. so you can feed it data in chunks like a lil conveyor belt 🌈

#include <openssl/evp.h>
#include <openssl/rsa.h>

EVP_PKEY_CTX *ctx;
/* in is the input in this example. */
unsigned char *in, *sig;
/* inlen is the length of the input in this example. */
size_t inlen, siglen;
EVP_PKEY *signing_key;
EVP_SIGNATURE *alg;

/*
 * NB: assumes signing_key, in and inlen are set up before
 * the next step. signing_key must be an RSA private key,
 * in must point to data to be digested and signed, and
 * inlen must be the size of the data in bytes.
 */
ctx = EVP_PKEY_CTX_new(signing_key, NULL /* no engine */);
alg = EVP_SIGNATURE_fetch(NULL, "RSA-SHA256", NULL);

if (ctx == NULL || alg == NULL)
    /* Error occurred */
if (EVP_PKEY_sign_message_init(ctx, alg, NULL) <= 0)
    /* Error */

while (inlen > 0) {
    if (EVP_PKEY_sign_message_update(ctx, in, inlen)) <= 0)
        /* Error */
    if (inlen > 256) {
        inlen -= 256;
        in += 256;
    } else {
        inlen = 0;
    }
}

/* Determine sig buffer length */
if (EVP_PKEY_sign_message_final(ctx, NULL, &siglen) <= 0)
    /* Error */

sig = OPENSSL_malloc(siglen);

if (sig == NULL)
    /* malloc failure */

if (EVP_PKEY_sign_message_final(ctx, sig, &siglen) <= 0)
    /* Error */

/* Signature is siglen bytes written to buffer sig */

ngl bestie, clock the if (EVP_PKEY_sign_message_update(ctx, in, inlen)) <= 0) line — that's exactly how it's printed in the original, extra paren and all, so we're keeping it character for character 💀 don't "fix" it, just be aware.

the loop chews through 256 bytes at a time with EVP_PKEY_sign_message_update(), then EVP_PKEY_sign_message_final() seals the deal — once to get the length, once to actually write it. chef's kiss 👑

---

👀 SEE ALSO 👀

go read these next, bestie, they're all linked lore:

• EVP_PKEY_CTX_new(3)
• EVP_PKEY_CTX_ctrl(3)
• EVP_PKEY_encrypt(3)
• EVP_PKEY_decrypt(3)
• EVP_PKEY_verify(3)
• EVP_PKEY_verify_recover(3)
• EVP_PKEY_derive(3)

---

📜 HISTORY 📜

the receipts, in chronological order:

• EVP_PKEY_sign_init() and EVP_PKEY_sign() — added in OpenSSL 1.0.0. the OGs 🧓
• EVP_PKEY_sign_init_ex() — added in OpenSSL 3.0.
• EVP_PKEY_sign_init_ex2(), EVP_PKEY_sign_message_init(), EVP_PKEY_sign_message_update() and EVP_PKEY_sign_message_final() — where added in OpenSSL 3.4. (yes, "where" — that's the original's wording, we're not touching it 🙈)

---

©️ COPYRIGHT ©️

Copyright 2006-2025 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

and that's the whole page, bestie!! 🎀💖 this was EVP_PKEY_SIGN(3ossl), straight out of OpenSSL 3.5.6, dated 2026-04-07 — go forth and sign things, you absolute icon 🌸✨🫶