EVP_PKEY_GET...LT_DIGEST_NID(3ossl)

📦 version 3.5.0, in opensuse-leap 16.0

💅 EVP_PKEY_GET_DEFAULT_DIGEST_NAME(3ossl) — the get-default-signature-digest page, bestie edition ✨

okay so this is the 3ossl manpage for the OpenSSL functions that tell you which digest a key wants to use for signing. like, "what's your default vibe for this signature, bestie?" that kind of energy. 🎀

✨ NAME ✨

EVP_PKEY_get_default_digest_nid, EVP_PKEY_get_default_digest_name — get default signature digest 💖

🌸 SYNOPSIS 🌸

#include <openssl/evp.h>

int EVP_PKEY_get_default_digest_name(EVP_PKEY *pkey,
                                     char *mdname, size_t mdname_sz);
int EVP_PKEY_get_default_digest_nid(EVP_PKEY *pkey, int *pnid);

🦋 DESCRIPTION 🦋

💜 EVP_PKEY_get_default_digest_name() — the name-dropper

so this one fills in the default message digest name for the public key signature operations that go with the key pkey, and it drops that name into mdname. it writes up to at most mdname_sz bytes, and yes, that count includes the ending NUL byte — the NUL is a whole guest at this party and it counts toward the guest list, no cap. 🫶

and here's a fun little plot twist: the name could literally be "UNDEF", which means the digest must be left unspecified (when the return value is 2) or may be left unspecified (when the return value is 1). she's mysterious, she's undecided, she contains multitudes. 😭

💜 EVP_PKEY_get_default_digest_nid() — the NID-drop

this one sets pnid to the default message digest NID for the public key signature operations associated with the key pkey. cute, simple.

but — and this is the important part, bestie, listen up 👑 — note that some signature algorithms (i.e. Ed25519 and Ed448) do not use a digest during signing. in that case pnid will be set to NID_undef. iconic of them honestly.

⚠️ also: this function is only reliable for legacy keys, which are keys with a EVP_PKEY_ASN1_METHOD. these keys have typically been loaded from engines, or created with EVP_PKEY_assign_RSA(3) or similar. so like… don't come for her if you're using a shiny new key type, she literally said legacy. 💀

🍓 NOTES 🍓

for all current standard OpenSSL public key algorithms, SHA256 is returned. that's it, that's the note. consistent queen behavior. ✨

🔥 RETURN VALUES 🔥

both EVP_PKEY_get_default_digest_name() and EVP_PKEY_get_default_digest_nid() return:

  • 1 — the message digest is advisory, meaning other digests can be used. she's flexible, she's chill, she's open to options 💅
  • 2 — the message digest is mandatory, meaning other digests can not be used. this is the "it's my way or the highway" setting 👑

and for the sad path: they return 0 or a negative value for failure. in particular, a return value of -2 indicates the operation is not supported by the public key algorithm. not her department, not her problem, please direct your inquiry elsewhere 🙈

🌈 SEE ALSO 🌈

go read those too, iykyk 📚

⭐ HISTORY ⭐

this function was added in OpenSSL 1.0.0. she's been around, she's got lore, she's a main character with backstory. 🧚

Copyright 2006-2023 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

🎀 and that's the whole page, bestie — no crumbs left. this diva is from OpenSSL 3.5.0, dated 2026-09-2, and she ate. periodt. 💅✨🌸
📦 where this page comes from