EVP_KEYMGMT(3ossl)

💅 EVP_KEYMGMT — the OpenSSL key-management bestie page (3ossl)

okay so this is the EVP_KEYMGMT(3ossl) page from the OpenSSL fam — it's all about key management and honestly it's lowkey the backstage crew of every key operation you've ever done. come get your lore 🎀

✨ NAME ✨

EVP_KEYMGMT, EVP_KEYMGMT_fetch, EVP_KEYMGMT_up_ref, EVP_KEYMGMT_free, EVP_KEYMGMT_get0_provider, EVP_KEYMGMT_is_a, EVP_KEYMGMT_get0_description, EVP_KEYMGMT_get0_name, EVP_KEYMGMT_do_all_provided, EVP_KEYMGMT_names_do_all, EVP_KEYMGMT_gettable_params, EVP_KEYMGMT_settable_params, EVP_KEYMGMT_gen_gettable_params, EVP_KEYMGMT_gen_settable_params — literally all your EVP key management routines in one group chat 💖

🌸 SYNOPSIS 🌸

#include <openssl/evp.h>

typedef struct evp_keymgmt_st EVP_KEYMGMT;

EVP_KEYMGMT *EVP_KEYMGMT_fetch(OSSL_LIB_CTX *ctx, const char *algorithm,
                               const char *properties);
int EVP_KEYMGMT_up_ref(EVP_KEYMGMT *keymgmt);
void EVP_KEYMGMT_free(EVP_KEYMGMT *keymgmt);
const OSSL_PROVIDER *EVP_KEYMGMT_get0_provider(const EVP_KEYMGMT *keymgmt);
int EVP_KEYMGMT_is_a(const EVP_KEYMGMT *keymgmt, const char *name);
const char *EVP_KEYMGMT_get0_name(const EVP_KEYMGMT *keymgmt);
const char *EVP_KEYMGMT_get0_description(const EVP_KEYMGMT *keymgmt);

void EVP_KEYMGMT_do_all_provided(OSSL_LIB_CTX *libctx,
                                 void (*fn)(EVP_KEYMGMT *keymgmt, void *arg),
                                 void *arg);
int EVP_KEYMGMT_names_do_all(const EVP_KEYMGMT *keymgmt,
                             void (*fn)(const char *name, void *data),
                             void *data);
const OSSL_PARAM *EVP_KEYMGMT_gettable_params(const EVP_KEYMGMT *keymgmt);
const OSSL_PARAM *EVP_KEYMGMT_settable_params(const EVP_KEYMGMT *keymgmt);
const OSSL_PARAM *EVP_KEYMGMT_gen_settable_params(const EVP_KEYMGMT *keymgmt);
const OSSL_PARAM *EVP_KEYMGMT_gen_gettable_params(const EVP_KEYMGMT *keymgmt);

🦋 DESCRIPTION 🦋

EVP_KEYMGMT is a method object that reps the key management implementations for all your different cryptographic algorithms. think of it as the main character of key logistics ✨ this method object gives you the functionality to have providers import key material from the outside, and also export key material back out to the outside. but here's the tea: most of the functionality can only be used internally and has no public interface — so this object is literally just passed into other functions whenever it's needed. it's giving supporting-role-with-a-huge-job 🫶

EVP_KEYMGMT_fetch() goes looking for an algorithm inside the provider that's been loaded into the OSSL_LIB_CTX given by ctx, and it needs to have the name given by algorithm plus the properties given by properties. very "you must be this tall to ride" of it ngl.

EVP_KEYMGMT_up_ref() bumps the reference count for the given EVP_KEYMGMT keymgmt. 📈

EVP_KEYMGMT_free() brings the reference count back down for the given EVP_KEYMGMT keymgmt, and when that count hits zero, it frees it. and if the argument is NULL? nothing happens, no drama, we simply do not engage 💅

EVP_KEYMGMT_get0_provider() returns the provider that has this particular implementation. like, who's your provider bestie, we need names.

EVP_KEYMGMT_is_a() checks if keymgmt is an implementation of an algorithm that's identifiable with name. identity check, slay 🔥

EVP_KEYMGMT_get0_name() returns the algorithm name from the provided implementation for the given keymgmt. heads up bestie: the keymgmt may have multiple synonyms associated with it — in that case, the first name from the algorithm definition is the one that comes back. ownership of the returned string stays with the keymgmt object, so do not free it yourself, that's not your string, hands off 🙈

EVP_KEYMGMT_names_do_all() traverses all the names for the keymgmt, and calls fn with each name and data. it's a whole name tour 🌈

EVP_KEYMGMT_get0_description() returns a description of the keymgmt, meant for display and human consumption. and the description is entirely at the discretion of the keymgmt implementation — so like, they decide their own bio, iconic 👑

EVP_KEYMGMT_do_all_provided() traverses all key keymgmt implementations by all activated providers in the library context libctx, and for each of the implementations it calls fn with the implementation method and data as arguments. scrolling the whole feed 🦋

EVP_KEYMGMT_gettable_params() and EVP_KEYMGMT_settable_params() return a constant OSSL_PARAM(3) array that describes the names and types of key parameters that can be retrieved or set. EVP_KEYMGMT_gettable_params() is used by EVP_PKEY_gettable_params(3). 🎀

EVP_KEYMGMT_gen_gettable_params() and EVP_KEYMGMT_gen_settable_params() return a constant OSSL_PARAM(3) array that describes the names and types of key generation parameters that can be retrieved or set via EVP_PKEY_CTX_get_params(3) or EVP_PKEY_CTX_set_params(3) respectively. yes, respectively, we're being precise today 💖

⭐ NOTES ⭐

EVP_KEYMGMT_fetch() may be called implicitly by other fetching functions, using the same library context and properties. and any other API that uses keys will typically do this. so like, it's happening in the background whether you clocked it or not — iykyk 👀

💜 RETURN VALUES 💜

EVP_KEYMGMT_fetch() returns a pointer to the key management implementation represented by an EVP_KEYMGMT object, or NULL on error.
EVP_KEYMGMT_up_ref() returns 1 on success, or 0 on error.
EVP_KEYMGMT_names_do_all() returns 1 if the callback was called for all names. a return value of 0 means that the callback was not called for any names.
EVP_KEYMGMT_free() doesn't return any value. it simply does not participate in that conversation 💀
EVP_KEYMGMT_get0_provider() returns a pointer to a provider object, or NULL on error.
EVP_KEYMGMT_is_a() returns 1 of keymgmt was identifiable, otherwise 0. (yes, the page says "of" — we're keeping it fr fr, no cap, character for character 🫶)
EVP_KEYMGMT_get0_name() returns the algorithm name, or NULL on error.
EVP_KEYMGMT_get0_description() returns a pointer to a description, or NULL if there isn't one.
EVP_KEYMGMT_gettable_params(), EVP_KEYMGMT_settable_params(), EVP_KEYMGMT_gen_gettable_params() and EVP_KEYMGMT_gen_settable_params() return a constant OSSL_PARAM(3) array or NULL on error.

🌟 SEE ALSO 🌟

EVP_MD_fetch(3), OSSL_LIB_CTX(3) — go read those too bestie, they're connected 🧚

🍓 HISTORY 🍓

The function EVP_KEYMGMT_gen_gettable_params() was added in OpenSSL 3.4.0. all other functions described here were added in OpenSSL 3.0. glow-up timeline ✨

👑 COPYRIGHT 👑

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

💅 real talk: that license line is not a vibe, it's a rule — don't skip it, don't tweak it. periodt.

okay that's the whole page, you're officially keymgmt-pilled 🎀 mwah, go import some key material responsibly 💖 — this was the EVP_KEYMGMT(3ossl) page, 3.5.0, dated 2026-09-25. catch you in the next man page, love u, bye 🦋

📦 where this page comes from

opensuse-leap 16.0: openssl-3-doc 3.5.0-160000.11.1 · Apache-2.0
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash-1017 on 2026-11-04: a language model's rewrite of the original, under its terms