LIBRESSL-EVP_PKEY_CTX_GET_OPERATION(3)

💅 EVP_PKEY_CTX_get_operation — inspect EVP_PKEY_CTX objects

okay so bestie, this is from the libcrypto library (that's the libcrypto manpage tag up top, iykyk) and it's literally just two little peekaboo functions that let you look inside an EVP_PKEY_CTX and see what it's up to. No cap, that's the whole vibe. 🎀

---

✨ SYNOPSIS ✨

#include <openssl/evp.h>

int
EVP_PKEY_CTX_get_operation(EVP_PKEY_CTX *ctx);

EVP_PKEY *
EVP_PKEY_CTX_get0_pkey(EVP_PKEY_CTX *ctx);

---

🦋 DESCRIPTION 🦋

🌸 EVP_PKEY_CTX_get_operation()

She tells you which initialization function has been called on ctx — like, if any. If nothing's been set up yet you just get EVP_PKEY_OP_UNDEFINED and that's totally fine, she's just chillin'. 💜

Here's the full tea, one bullet per row of the table so nothing gets lost:

• EVP_PKEY_OP_DECRYPT — initialized with EVP_PKEY_decrypt_init(3) — e.g. for RSA, SM2
• EVP_PKEY_OP_DERIVE — initialized with EVP_PKEY_derive_init(3) — e.g. for HKDF
• EVP_PKEY_OP_ENCRYPT — initialized with EVP_PKEY_encrypt_init(3) — e.g. for RSA, SM2
• EVP_PKEY_OP_KEYGEN — initialized with EVP_PKEY_keygen_init(3) — e.g. for almost all
• EVP_PKEY_OP_PARAMGEN — initialized with EVP_PKEY_paramgen_init(3) — e.g. for DH, DSA, EC
• EVP_PKEY_OP_SIGN — initialized with EVP_PKEY_sign_init(3) — e.g. for DSA,EC,RSA,SM2
• EVP_PKEY_OP_SIGN — initialized with EVP_DigestSignInit(3) — e.g. for ED25519
• EVP_PKEY_OP_SIGNCTX — initialized with EVP_DigestSignInit(3) — e.g. for CMAC, HMAC
• EVP_PKEY_OP_UNDEFINED — not initialized — e.g. NONE
• EVP_PKEY_OP_VERIFY — initialized with EVP_PKEY_verify_init(3) — e.g. for DSA,EC,RSA,SM2
• EVP_PKEY_OP_VERIFY — initialized with EVP_DigestVerifyInit(3) — e.g. for ED25519
• EVP_PKEY_OP_VERIFYCTX — initialized with EVP_DigestVerifyInit(3) — e.g. for no built-in
• EVP_PKEY_OP_VERIFYRECOVER — initialized with EVP_PKEY_verify_recover_init(3) — e.g. for RSA

That rightmost column is just examples of algorithms where those return values can show up — it's giving "here's a vibe, not a rule". 🫶 So for example: if EVP_PKEY_base_id(3) returns EVP_PKEY_HKDF, then calling EVP_PKEY_CTX_get_operation() on an EVP_PKEY_CTX using that key may return EVP_PKEY_OP_DERIVE. Slay.

🧚 the SIGNCTX / VERIFYCTX distinction (this matters, bestie)

If the return value is EVP_PKEY_OP_SIGNCTX or EVP_PKEY_OP_VERIFYCTX, then the ctx supports EVP_DigestSignUpdate(3) or EVP_DigestVerifyUpdate(3), respectively. 👑

If the return value is EVP_PKEY_OP_SIGN or EVP_PKEY_OP_VERIFY, it does not — and only one-shot signing or verification is supported. That's the whole difference, don't sleep on it. 😭

💀 when you get EVP_PKEY_OP_UNDEFINED

The return value EVP_PKEY_OP_UNDEFINED can for example occur if the ctx was freshly returned from EVP_PKEY_CTX_new(3) or EVP_PKEY_CTX_new_id(3) and not yet initialized. Baby's brand new, hasn't picked a lane yet. 🌱

🌈 the masks

The following masks are defined as the logical OR of two or more of the above EVP_PKEY_OP_* bits:

EVP_PKEY_OP_TYPE_CRYPT  DECRYPT | ENCRYPT
EVP_PKEY_OP_TYPE_GEN    KEYGEN | PARAMGEN
EVP_PKEY_OP_TYPE_NOGEN  CRYPT | DERIVE | SIG
EVP_PKEY_OP_TYPE_SIG    SIGN | SIGNCTX | VERIFY | VERIFYCTX |
                        VERIFYRECOVER

Group-chat energy: CRYPT is the encrypt/decrypt girlies, GEN is the keygen/paramgen girlies, NOGEN is everyone else who isn't generating, and SIG is the whole signing squad. 🎀

---

🔥 RETURN VALUES 🔥

• EVP_PKEY_CTX_get_operation() returns one of the single-bit EVP_PKEY_OP_* constants, or EVP_PKEY_OP_UNDEFINED if ctx is not initialized. No ambiguity, one bit, periodt. ✨
• EVP_PKEY_CTX_get0_pkey() returns an internal pointer to the EVP_PKEY object used by ctx, without incrementing its reference count. ⚠️ Read that again bestie — it's a borrowed pointer, you don't own it, don't go freeing it, that's not your main character moment.

---

👀 SEE ALSO 👀

evp(3), EVP_PKEY_base_id(3), EVP_PKEY_CTX_ctrl(3), EVP_PKEY_CTX_new(3), EVP_PKEY_new(3)

---

📜 HISTORY 📜

EVP_PKEY_CTX_get_operation() and EVP_PKEY_CTX_get0_pkey() first appeared in OpenSSL 1.0.0 and have been available since OpenBSD 4.9. Veterans fr fr, they've been serving looks since forever. 👑

---

kisses, bestie 💋 — this drop is from the Debian build, dated June 8, 2025, and the page itself is EVP_PKEY_CTX_GET_OPERATION(3). go forth and inspect those contexts, you absolute icon 🦋✨