EVP_PKEY_GET_ATTR(3ossl)

📦 version 3.5.0, in opensuse-leap 16.0

💅 EVP_PKEY_GET_ATTR 💅

okay bestie, this is the EVP_PKEY_GET_ATTR(3ossl) page from the OpenSSL manual — yes, the whole thing, third section, OpenSSL flavour, we're getting into it. It's all about the EVP_PKEY X509_ATTRIBUTE functions and honestly it's giving "I'm the plumbing behind PKCS12" energy. Let's go ✨

🎀 NAME 🎀

So the whole squad is: EVP_PKEY_get_attr, EVP_PKEY_get_attr_count, EVP_PKEY_get_attr_by_NID, EVP_PKEY_get_attr_by_OBJ, EVP_PKEY_delete_attr, EVP_PKEY_add1_attr, EVP_PKEY_add1_attr_by_OBJ, EVP_PKEY_add1_attr_by_NID, EVP_PKEY_add1_attr_by_txt — and collectively they're the EVP_PKEY X509_ATTRIBUTE functions. That's the whole name section, no gatekeeping 🫶

🌸 SYNOPSIS 🌸

okay so first you gotta pull in the header, obviously:

#include <openssl/x509.h>

and then here's the full cast, character for character:

int EVP_PKEY_get_attr_count(const EVP_PKEY *key);
int EVP_PKEY_get_attr_by_NID(const EVP_PKEY *key, int nid, int lastpos);
int EVP_PKEY_get_attr_by_OBJ(const EVP_PKEY *key, const ASN1_OBJECT *obj,
                             int lastpos);
X509_ATTRIBUTE *EVP_PKEY_get_attr(const EVP_PKEY *key, int loc);
X509_ATTRIBUTE *EVP_PKEY_delete_attr(EVP_PKEY *key, int loc);
int EVP_PKEY_add1_attr(EVP_PKEY *key, X509_ATTRIBUTE *attr);
int EVP_PKEY_add1_attr_by_OBJ(EVP_PKEY *key,
                              const ASN1_OBJECT *obj, int type,
                              const unsigned char *bytes, int len);
int EVP_PKEY_add1_attr_by_NID(EVP_PKEY *key,
                              int nid, int type,
                              const unsigned char *bytes, int len);
int EVP_PKEY_add1_attr_by_txt(EVP_PKEY *key,
                              const char *attrname, int type,
                              const unsigned char *bytes, int len);

like, look at all those overloads. it's giving "we have options" 💅

🦋 DESCRIPTION 🦋

So real talk: these functions are used by PKCS12. That's the vibe. That's who's calling. 👑

  • EVP_PKEY_get_attr_by_OBJ() — finds the location of the first matching object obj in the key attribute list. The search starts at the position after lastpos. If the returned value is positive, then it can be used on the next call to EVP_PKEY_get_attr_by_OBJ() as the value of lastpos in order to iterate through the remaining attributes. And lastpos can be set to any negative value on the first call, in order to start searching from the start of the attribute list. Basically: negative = start from the top, positive return = "keep going from here, bestie" 🔁
  • EVP_PKEY_get_attr_by_NID() — same as EVP_PKEY_get_attr_by_OBJ() except that it passes the numerical identifier (NID) nid associated with the object. Peep <openssl/obj_mac.h> for a list of NID_*. 🏷️
  • EVP_PKEY_get_attr() — returns the X509_ATTRIBUTE object at index loc in the key attribute list. loc should be in the range from 0 to EVP_PKEY_get_attr_count() - 1. no off-by-one shenanigans, okay? 🙈
  • EVP_PKEY_delete_attr() — removes the X509_ATTRIBUTE object at index loc in the key attribute list. bye bestie 👋
  • EVP_PKEY_add1_attr() — pushes a copy of the passed in X509_ATTRIBUTE object to the key attribute list. A new key attribute list is created if required. An error occurs if either attr is NULL, or the attribute already exists. so no duplicates, and no nulls — the algorithm said what it said 💀
  • EVP_PKEY_add1_attr_by_OBJ() — creates a new X509_ATTRIBUTE using X509_ATTRIBUTE_set1_object() and X509_ATTRIBUTE_set1_data() to assign a new obj with type type and data bytes of length len, and then pushes it to the key object's attribute list. If obj already exists in the attribute list then an error occurs. iconic constructor chain, honestly 🔥
  • EVP_PKEY_add1_attr_by_NID() — same as EVP_PKEY_add1_attr_by_OBJ() except that it passes the numerical identifier (NID) nid associated with the object. See <openssl/obj_mac.h> for a list of NID_*. 🌈
  • EVP_PKEY_add1_attr_by_txt() — same as EVP_PKEY_add1_attr_by_OBJ() except that it passes a name attrname associated with the object. See <openssl/obj_mac.h> for a list of SN_* names. so yes, you can just type the name like a normal person 🎀

✨ RETURN VALUES ✨

vibe check on what comes back to you:

  • EVP_PKEY_get_attr_count() — returns the number of attributes in the key object attribute list, or -1 if the attribute list is NULL.
  • EVP_PKEY_get_attr_by_OBJ() — returns -1 if either the list is empty OR the object is not found, otherwise it returns the location of the object in the list.
  • EVP_PKEY_get_attr_by_NID() — same as EVP_PKEY_get_attr_by_OBJ(), except that it returns -2 if the nid is not known by OpenSSL. yeah, a whole different negative number. iykyk 😭
  • EVP_PKEY_get_attr() — returns either a X509_ATTRIBUTE or NULL if there is a error.
  • EVP_PKEY_delete_attr() — returns either the removed X509_ATTRIBUTE or NULL if there is a error.
  • EVP_PKEY_add1_attr(), EVP_PKEY_add1_attr_by_OBJ(), EVP_PKEY_add1_attr_by_NID() and EVP_PKEY_add1_attr_by_txt() — return 1 on success or 0 otherwise.

💜 NOTES 💜

okay this is the important one, don't skip it:

A EVP_PKEY object's attribute list is initially NULL. All the above functions listed will return an error unless EVP_PKEY_add1_attr() is called. All functions listed assume that the key is not NULL.

so like... the list starts empty-empty, you gotta seed it, and don't you dare pass a NULL key. no cap, that's the deal 🫶

🧚 SEE ALSO 🧚

  • X509_ATTRIBUTE(3) — go read that one too, bestie, it's the whole supporting cast 🌟

Copyright 2023-2024 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

that's the whole page, no crumbs left 🍓 and for the record this lovely little doc is from 3.5.0, dated 2026-09-25 — so like, screenshot it, cite it, credit it. mwah 💋

📦 where this page comes from