EVP_PKEY_CTX_NEW(3ossl)

📦 version 3.5.0, in opensuse-leap 16.0

💖 EVP_PKEY_CTX_NEW(3ossl) 💖

okay so bestie, welcome to the OpenSSL manual, page EVP_PKEY_CTX_NEW(3ossl) — this is the whole public key algorithm context situation, and honestly? it's giving backstage-pass energy. these are the functions that make the context objects that everything else in the high-level public key API runs on. let's get into it 🎀

✨ NAME ✨

EVP_PKEY_CTX_new, EVP_PKEY_CTX_new_id, EVP_PKEY_CTX_new_from_name, EVP_PKEY_CTX_new_from_pkey, EVP_PKEY_CTX_dup, EVP_PKEY_CTX_free, EVP_PKEY_CTX_is_a — the public key algorithm context functions, aka the whole friend group 🫶

🌸 SYNOPSIS 🌸

#include <openssl/evp.h>

EVP_PKEY_CTX *EVP_PKEY_CTX_new(EVP_PKEY *pkey, ENGINE *e);
EVP_PKEY_CTX *EVP_PKEY_CTX_new_id(int id, ENGINE *e);
EVP_PKEY_CTX *EVP_PKEY_CTX_new_from_name(OSSL_LIB_CTX *libctx,
                                         const char *name,
                                         const char *propquery);
EVP_PKEY_CTX *EVP_PKEY_CTX_new_from_pkey(OSSL_LIB_CTX *libctx,
                                         EVP_PKEY *pkey,
                                         const char *propquery);
EVP_PKEY_CTX *EVP_PKEY_CTX_dup(const EVP_PKEY_CTX *ctx);
void EVP_PKEY_CTX_free(EVP_PKEY_CTX *ctx);
int EVP_PKEY_CTX_is_a(EVP_PKEY_CTX *ctx, const char *keytype);

🦋 DESCRIPTION 🦋

EVP_PKEY_CTX_new() allocates a public key algorithm context using the pkey key type and ENGINE e. it's the classic, the og 💅

EVP_PKEY_CTX_new_id() allocates a public key algorithm context using the key type specified by id and ENGINE e. same vibe, you just hand it a number instead of a key.

EVP_PKEY_CTX_new_from_name() allocates a public key algorithm context using the library context libctx (peep OSSL_LIB_CTX(3)), the key type specified by name, and the property query propquery.

🚨 ok this part matters, do not skip it: none of the arguments are duplicated, so they must remain unchanged for the lifetime of the returned EVP_PKEY_CTX or of any of its duplicates. like, they're not copied, they're borrowed. don't be out here mutating stuff underneath it 😭

read further about the possible names in "NOTES" below 👇

EVP_PKEY_CTX_new_from_pkey() allocates a public key algorithm context using the library context libctx (see OSSL_LIB_CTX(3)), the algorithm specified by pkey, and the property query propquery.

same warning, same energy: none of the arguments are duplicated, so they must remain unchanged for the lifetime of the returned EVP_PKEY_CTX or any of its duplicates. bestie. write it on your mirror fr fr 🙈

EVP_PKEY_CTX_new_id() and EVP_PKEY_CTX_new_from_name() are normally used when there's no EVP_PKEY structure associated with the operations — think parameter generation, or key generation for some algorithms. no key yet, so no key struct to pass. makes sense, right? 💡

EVP_PKEY_CTX_dup() duplicates the context ctx. it is not supported for a keygen operation. that's a hard no, not a soft no 💀

EVP_PKEY_CTX_free() frees up the context ctx. if ctx is NULL, nothing is done — it just politely minds its business 🧚

EVP_PKEY_is_a() checks if the key type associated with ctx is keytype. (yes, that's literally how it's written in the page, we're being faithful here 👑)

⭐ NOTES ⭐

🌈 On EVP_PKEY_CTX

the EVP_PKEY_CTX structure is an opaque public key algorithm context used by the OpenSSL high-level public key API.

⚠️ Contexts MUST NOT be shared between threads — like, that is to say, it is not permissible to use the same context simultaneously in two threads. no sharing, no splitting, no "it'll be fine". it will not be fine 💀

🌈 On Key Types

we keep saying "key type" in this manual, and it's the same as "algorithm" in most cases — either term, use them interchangeably, it's fine, we're all friends here 🫶

but! there are algorithms where the key type and the algorithm of the operations that use the keys are not the same. example: EC keys being used for ECDSA and ECDH operations. same key, different little outfits ✨

key types are given in two different manners:

💜 Legacy NID or EVP_PKEY type

this is the id used with EVP_PKEY_CTX_new_id().

these are EVP_PKEY_RSA, EVP_PKEY_RSA_PSS, EVP_PKEY_DSA, EVP_PKEY_DH, EVP_PKEY_EC, EVP_PKEY_SM2, EVP_PKEY_X25519, EVP_PKEY_X448, and they're used by legacy methods. vintage, but make it functional 🎀

💜 Name strings

this is the name used with EVP_PKEY_CTX_new_from_name().

these are names like "RSA", "DSA", and what's available depends on what providers are currently accessible. so it's kinda mood-ring depending on your provider setup 🌸

the OpenSSL providers offer a set of key types available this way — please see OSSL_PROVIDER-FIPS(7) and OSSL_PROVIDER-default(7) and related documentation for more info. go read them, i'll wait 🫡

🔥 RETURN VALUES 🔥

  • EVP_PKEY_CTX_new(), EVP_PKEY_CTX_new_id() and EVP_PKEY_CTX_dup() return either the newly allocated EVP_PKEY_CTX structure or NULL if an error occurred. so like, always check for NULL, bestie, i'm begging 🙏
  • EVP_PKEY_CTX_free() does not return a value. it's a void, it gives you nothing and it's at peace with that.
  • EVP_PKEY_CTX_is_a() returns 1 for true and 0 for false. classic.

👑 SEE ALSO 👑

EVP_PKEY_new(3)

🕰️ HISTORY 🕰️

  • EVP_PKEY_CTX_new(), EVP_PKEY_CTX_new_id(), EVP_PKEY_CTX_dup() and EVP_PKEY_CTX_free() were added in OpenSSL 1.0.0. ancient. iconic. still slaying.
  • EVP_PKEY_CTX_new_from_name() and EVP_PKEY_CTX_new_from_pkey() were added in OpenSSL 3.0. the newer recruits, and they came in swinging 💅

Copyright 2006-2021 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

okay that's the whole page, you ate that 🍓 and before you close the tab: this was OpenSSL 3.5.0, dated 2026-09-25 — mwah, go allocate something responsibly 💖✨🎀

📦 where this page comes from