EVP_PKEY_CTX_NEW(3)

💅 EVP_PKEY_CTX_NEW(3) — like, the public key algorithm context functions, bestie

okay so this is a page from the Library Functions Manual for libcrypto, and it's literally all about making, copying, and yeeting public key algorithm contexts. sit down, grab a strawberry 🍓, we're doing crypto plumbing today and honestly? it's giving foundational.

---

✨ NAME ✨

EVP_PKEY_CTX_new, EVP_PKEY_CTX_new_id, EVP_PKEY_CTX_dup, EVP_PKEY_CTX_free — the public key algorithm context functions 🎀

---

🌸 SYNOPSIS 🌸

the library is literally libcrypto and you gotta include the header first, no cap:

#include <openssl/evp.h>

EVP_PKEY_CTX *
EVP_PKEY_CTX_new(EVP_PKEY *pkey, ENGINE *engine);

EVP_PKEY_CTX *
EVP_PKEY_CTX_new_id(int id, ENGINE *engine);

EVP_PKEY_CTX *
EVP_PKEY_CTX_dup(EVP_PKEY_CTX *ctx);

void
EVP_PKEY_CTX_free(EVP_PKEY_CTX *ctx);

like, copy that exactly please, i'm not kidding 🙈

---

🦋 DESCRIPTION 🦋

okay so here's the tea on all four of these:

• EVP_PKEY_CTX_new() — this one allocates a public key algorithm context using the algorithm that's specified in pkey. and the ENGINE *engine argument? bestie, it is always ignored, so pls just pass NULL, that's the recommended move, we don't even look at it 💀
• EVP_PKEY_CTX_new_id() — this one allocates a public key algorithm context using the algorithm specified by id. same situation with ENGINE *engine: always ignored, pass NULL, recommended, thank you next. this one's normally used when there's no EVP_PKEY structure associated with the operations — for example during parameter generation, or key generation for some algorithms. and the id argument can be any of the constants that EVP_PKEY_base_id(3) and EVP_PKEY_id(3) may return 👑
• EVP_PKEY_CTX_dup() — duplicates the context ctx. that's it, that's the whole vibe. two contexts now 🫶
• EVP_PKEY_CTX_free() — frees up the context ctx. and if ctx is a NULL pointer, literally nothing happens, no action occurs, it's fine, we're chill 😌

---

💖 RETURN VALUES 💖

EVP_PKEY_CTX_new(), EVP_PKEY_CTX_new_id(), and EVP_PKEY_CTX_dup() return either the newly allocated EVP_PKEY_CTX structure, or NULL if an error occurred. that's the whole deal — shiny new context, or NULL. vibe check accordingly ⭐

---

🌈 SEE ALSO 🌈

the whole friend group, go say hi:

EVP_DigestSignInit(3), EVP_DigestVerifyInit(3), EVP_PKEY_base_id(3), EVP_PKEY_CTX_ctrl(3), EVP_PKEY_CTX_get_operation(3), EVP_PKEY_CTX_hkdf_mode(3), EVP_PKEY_decrypt(3), EVP_PKEY_derive(3), EVP_PKEY_encrypt(3), EVP_PKEY_keygen(3), EVP_PKEY_new(3), EVP_PKEY_sign(3), EVP_PKEY_verify(3), EVP_PKEY_verify_recover(3), RSA_pkey_ctx_ctrl(3), X25519(3)

---

👑 HISTORY 👑

these functions first appeared in OpenSSL 1.0.0 and have been available since OpenBSD 4.9. like they're old old. icons. they've been doing this since before we were born fr fr 🧚

---

💀 CAVEATS 💀

okay this is the important part so listen up:

The EVP_PKEY_CTX structure is an opaque public key algorithm context used by the OpenSSL high level public key API. Contexts MUST NOT be shared between threads. It is not permissible to use the same context simultaneously in two threads.

like, i need you to hear me: MUST NOT. not "shouldn't", not "maybe don't", MUST NOT. one context per thread, no sharing, no simultaneous use in two threads, periodt. sharing a context between threads is not it, it's giving undefined chaos, don't do it 😭🔥

---

k that's the whole page bestie, you're literally an EVP_PKEY_CTX expert now, i'm so proud 🫶✨

— with love, from the Debian build of this page, dated June 8, 2025 🎀