EC_KEY_METHOD_NEW(3)

💜 NAME 💜

okay so bestie, this is EC_KEY_METHOD_NEW(3) from the Library Functions Manual, and it's literally the whole custom EC_KEY implementation starter pack. like, all of it:

EC_KEY_METHOD_new, EC_KEY_METHOD_free, EC_KEY_METHOD_set_init, EC_KEY_METHOD_get_init, EC_KEY_METHOD_set_sign, EC_KEY_METHOD_get_sign, EC_KEY_METHOD_set_verify, EC_KEY_METHOD_get_verify, EC_KEY_METHOD_set_keygen, EC_KEY_METHOD_get_keygen, EC_KEY_METHOD_set_compute_key, EC_KEY_METHOD_get_compute_key, EC_KEY_OpenSSL, EC_KEY_set_default_method, EC_KEY_get_default_method, EC_KEY_new_method, EC_KEY_set_method, EC_KEY_get_method — custom EC_KEY implementations. periodt. 🎀

---

✨ SYNOPSIS ✨

library:

library “libcrypto” #include <openssl/ec.h>

EC_KEY_METHOD *
EC_KEY_METHOD_new(const EC_KEY_METHOD *meth);

void
EC_KEY_METHOD_free(EC_KEY_METHOD *meth);

void
EC_KEY_METHOD_set_init(EC_KEY_METHOD *meth, int (*init)(EC_KEY *key),
    void (*finish)(EC_KEY *key),
    int (*copy)(EC_KEY *dest, const EC_KEY *src),
    int (*set_group)(EC_KEY *key, const EC_GROUP *grp),
    int (*set_private)(EC_KEY *key, const BIGNUM *priv_key),
    int (*set_public)(EC_KEY *key, const EC_POINT *pub_key));

void
EC_KEY_METHOD_get_init(const EC_KEY_METHOD *meth,
    int (**pinit)(EC_KEY *key), void (**pfinish)(EC_KEY *key),
    int (**pcopy)(EC_KEY *dest, const EC_KEY *src),
    int (**pset_group)(EC_KEY *key, const EC_GROUP *grp),
    int (**pset_private)(EC_KEY *key, const BIGNUM *priv_key),
    int (**pset_public)(EC_KEY *key, const EC_POINT *pub_key));

void
EC_KEY_METHOD_set_sign(EC_KEY_METHOD *meth,
    int (*sign)(int type, const unsigned char *dgst, int dgstlen, unsigned char *sig, unsigned int *siglen, const BIGNUM *kinv, const BIGNUM *r, EC_KEY *eckey),
    int (*sign_setup)(EC_KEY *eckey, BN_CTX *ctx, BIGNUM **kinv, BIGNUM **rp),
    ECDSA_SIG *(*sign_sig)(const unsigned char *dgst, int dgstlen, const BIGNUM *kinv, const BIGNUM *rp, EC_KEY *eckey));

void
EC_KEY_METHOD_get_sign(const EC_KEY_METHOD *meth,
    int (**psign)(int type, const unsigned char *dgst, int dgstlen, unsigned char *sig, unsigned int *siglen, const BIGNUM *kinv, const BIGNUM *r, EC_KEY *eckey),
    int (**psign_setup)(EC_KEY *eckey, BN_CTX *ctx, BIGNUM **kinv, BIGNUM **rp),
    ECDSA_SIG *(**psign_sig)(const unsigned char *dgst, int dgstlen, const BIGNUM *kinv, const BIGNUM *rp, EC_KEY *eckey));

void
EC_KEY_METHOD_set_verify(EC_KEY_METHOD *meth,
    int (*verify)(int type, const unsigned char *dgst, int dgst_len, const unsigned char *sigbuf, int sig_len, EC_KEY *eckey),
    int (*verify_sig)(const unsigned char *dgst, int dgst_len, const ECDSA_SIG *sig, EC_KEY *eckey));

void
EC_KEY_METHOD_get_verify(const EC_KEY_METHOD *meth,
    int (**pverify)(int type, const unsigned char *dgst, int dgst_len, const unsigned char *sigbuf, int sig_len, EC_KEY *eckey),
    int (**pverify_sig)(const unsigned char *dgst, int dgst_len, const ECDSA_SIG *sig, EC_KEY *eckey));

void
EC_KEY_METHOD_set_keygen(EC_KEY_METHOD *meth,
    int (*keygen)(EC_KEY *key));

void
EC_KEY_METHOD_get_keygen(const EC_KEY_METHOD *meth,
    int (**pkeygen)(EC_KEY *key));

void
EC_KEY_METHOD_set_compute_key(EC_KEY_METHOD *meth,
    int (*ckey)(void *out, size_t outlen, const EC_POINT *pub_key, EC_KEY *ecdh, void *(*KDF) (const void *in, size_t inlen, void *out, size_t *outlen)));

void
EC_KEY_METHOD_get_compute_key(const EC_KEY_METHOD *meth,
    int (**pck)(void *out, size_t outlen, const EC_POINT *pub_key, EC_KEY *ecdh, void *(*KDF) (const void *in, size_t inlen, void *out, size_t *outlen)));

const EC_KEY_METHOD *
EC_KEY_OpenSSL(void);

void
EC_KEY_set_default_method(const EC_KEY_METHOD *meth);

const EC_KEY_METHOD *
EC_KEY_get_default_method(void);

EC_KEY *
EC_KEY_new_method(ENGINE *engine);

int
EC_KEY_set_method(EC_KEY *key, const EC_KEY_METHOD *meth);

const EC_KEY_METHOD *
EC_KEY_get_method(const EC_KEY *key);

---

🌸 DESCRIPTION 🌸

okay so picture this: an EC_KEY_METHOD object is basically a little bag of function pointers, and those pointers are what get used for EC_KEY operations. it's giving "build-your-own-implementation" energy. 💅

• EC_KEY_METHOD_new() — makes a shallow copy of meth. no meth? no problem, you get an empty EC_KEY_METHOD object instead (i.e. when meth is NULL).
• EC_KEY_METHOD_free() — frees meth. but like, if meth is NULL, or if it's the return value of EC_KEY_OpenSSL(), then nothing happens. no action, zero drama. 🫶

🦋 the init/finish crew

EC_KEY_METHOD_set_init() and EC_KEY_METHOD_get_init() set and retrieve the optional callback functions, and these cuties get called at very specific places:

• init — at the end of EC_KEY_new_method() and EC_KEY_set_method()
• finish — at the beginning of EC_KEY_free(3), EC_KEY_copy(3), and EC_KEY_set_method()
• copy — at the end of EC_KEY_copy(3)
• set_group — at the end of EC_KEY_set_group(3) and EC_KEY_new_by_curve_name(3)
• set_private — at the beginning of EC_KEY_set_private_key(3)
• set_public — at the beginning of EC_KEY_set_public_key(3)

⚠️ if any of these callbacks returns 0, the calling function fails. that's the rule, bestie.

by default, all these callbacks are NULL. and the arguments of EC_KEY_METHOD_get_init() can be set to NULL so you can selectively retrieve callback function pointers — like picking only the ones you want out of the group chat. 🙈

🌈 the sign + verify girlies

• EC_KEY_METHOD_set_sign() and EC_KEY_METHOD_get_sign() — set and retrieve the functions implementing ECDSA_sign(3) and ECDSA_do_sign(3).
• EC_KEY_METHOD_set_verify() and EC_KEY_METHOD_get_verify() — set and retrieve the functions implementing ECDSA_verify(3) and ECDSA_do_verify(3).

⭐ keygen + compute_key

• EC_KEY_METHOD_set_keygen() and EC_KEY_METHOD_get_keygen() — set and retrieve the function implementing EC_KEY_generate_key(3).
• EC_KEY_METHOD_set_compute_key() and EC_KEY_METHOD_get_compute_key() — set and retrieve the function implementing ECDH_compute_key(3).

👑 default method behaviour

• EC_KEY_set_default_method() — chooses the meth that future invocations of EC_KEY_new_method() will use when creating new EC_KEY objects. and if meth is NULL? it reverts to the default implementation. iconic.
• EC_KEY_new_method() — creates and initializes a new EC_KEY object using the EC_KEY_METHOD set with EC_KEY_set_default_method(). the ENGINE *engine argument is always ignored, and passing NULL is recommended. literally just pass NULL, it's not that deep. 😭
• EC_KEY_set_method() — dissociates the key from the ENGINE it's using (if any), and causes it to use meth in the future.

---

💖 RETURN VALUES 💖

• EC_KEY_METHOD_new() — returns the newly allocated EC_KEY_METHOD object, or NULL if an error occurs.
• EC_KEY_OpenSSL() — returns a static object representing the default EC_KEY implementation.
• EC_KEY_get_default_method() — returns the EC_KEY_METHOD that EC_KEY_new_method() will use for the creation of new EC_KEY objects in the future.
• EC_KEY_new_method() — returns the newly allocated EC_KEY object, or NULL if an error occurs.
• EC_KEY_set_method() — returns 1 for success or 0 for failure.
• EC_KEY_get_method() — returns the EC_KEY implementation used by the given key.

---

🎀 SEE ALSO 🎀

crypto(3), EC_GROUP_check(3), EC_GROUP_get_curve_name(3), EC_GROUP_new_by_curve_name(3), EC_GROUP_new_curve_GFp(3), EC_KEY_new(3), EC_POINT_add(3), EC_POINT_get_affine_coordinates(3), EC_POINT_new(3), EC_POINT_point2oct(3), ECDSA_sign(3)

---

🦋 HISTORY 🦋

these functions first appeared in OpenSSL 1.1.0 and have been available since OpenBSD 6.5. vintage but make it current, yk? ✨

---

mwah 💋 that's the whole page — brought to you by the Debian crew, dated June 8, 2025, and yes the page title is literally EC_KEY_METHOD_NEW(3) again because some things never change. go forth and implement your own EC_KEY, bestie, you're gonna slay 🫶