EVP_PKEY_VERIFY_RECOVER(3ossl)

💖 EVP_PKEY_VERIFY_RECOVER(3ossl) 💖

okay so bestie, welcome to the OpenSSL 3ossl manual page for EVP_PKEY_verify_recover_init, EVP_PKEY_verify_recover_init_ex, EVP_PKEY_verify_recover_init_ex2 and EVP_PKEY_verify_recover — the whole squad that recovers a signature using a public key algorithm. yes, recovers. like getting the original message back out of a signature. it's giving un-baking a cake. 🎀

✨ SYNOPSIS ✨

#include <openssl/evp.h>

int EVP_PKEY_verify_recover_init(EVP_PKEY_CTX *ctx);
int EVP_PKEY_verify_recover_init_ex(EVP_PKEY_CTX *ctx,
                                    const OSSL_PARAM params[]);
int EVP_PKEY_verify_recover_init_ex2(EVP_PKEY_CTX *ctx, EVP_SIGNATURE *algo,
                                     const OSSL_PARAM params[]);
int EVP_PKEY_verify_recover(EVP_PKEY_CTX *ctx,
                            unsigned char *rout, size_t *routlen,
                            const unsigned char *sig, size_t siglen);

🌸 DESCRIPTION 🌸

EVP_PKEY_verify_recover_init() — this one initializes a public key algorithm context ctx for signing, using the algorithm that was given when the context was created with EVP_PKEY_CTX_new(3) or variants thereof. the algorithm gets used to fetch an EVP_SIGNATURE method implicitly, so go read "Implicit fetch" in provider(7) if you want the whole lore on implicit fetches. iykyk 🔥
EVP_PKEY_verify_recover_init_ex() — literally the same as EVP_PKEY_verify_recover_init() except it also sets the passed parameters params on the context before it returns. cute little bonus. ✨
EVP_PKEY_verify_recover_init_ex2() — same as EVP_PKEY_verify_recover_init_ex(), but it works with an explicitly fetched EVP_SIGNATURE algo. important vibe check: a context ctx without a pre-loaded key cannot be used with this function. and depending on what algorithm was fetched, certain details revolving around the treatment of the input to EVP_PKEY_verify() may be pre-determined, and in that case those details may normally not be changed. see "NOTES" below for the deeper explanation. 👑
EVP_PKEY_verify_recover() — the main character 💅. it recovers signed data using ctx. the signature is specified using the sig and siglen parameters. if rout is NULL then the maximum size of the output buffer gets written to the routlen parameter. if rout is not NULL then before the call the routlen parameter should contain the length of the rout buffer, and if the call is successful the recovered data is written to rout and the amount of data written goes to routlen. two-step queen behavior, we love to see it.

🦋 NOTES 🦋

ngl, normally an application is only interested in whether a signature verification operation is successful — in those cases you should just use the EVP_verify() function. simple. done. periodt.

sometimes though it's genuinely useful to obtain the data that was originally signed using a signing operation. but bestie, listen: only certain public key algorithms can recover a signature in this way (for example RSA in PKCS padding mode). so don't come at every algorithm expecting miracles. 🙈

after the call to EVP_PKEY_verify_recover_init() you can perform algorithm specific control operations to set any appropriate parameters for the operation. ✨

after the call to EVP_PKEY_verify_recover_init_ex2(), algorithm specific control operations may not be needed if the chosen algorithm implies that those controls are pre-set (and immutable). iykyk.

and the fun part: EVP_PKEY_verify_recover() can be called more than once on the same context if several operations are performed using the same parameters. reuse the vibe, save the allocation. 🫶

⭐ RETURN VALUES ⭐

EVP_PKEY_verify_recover_init() and EVP_PKEY_verify_recover() return 1 for success and 0 or a negative value for failure.

🚨 in particular, a return value of -2 indicates the operation is not supported by the public key algorithm. so if you see -2, it's not you, it's the algorithm. 💀

🌈 EXAMPLES 🌈

Recover digest originally signed using PKCS#1 and SHA256 digest:

#include <openssl/evp.h>
#include <openssl/rsa.h>

EVP_PKEY_CTX *ctx;
unsigned char *rout, *sig;
size_t routlen, siglen;
EVP_PKEY *verify_key;

/*
 * NB: assumes verify_key, sig and siglen are already set up
 * and that verify_key is an RSA public key
 */
ctx = EVP_PKEY_CTX_new(verify_key, NULL /* no engine */);
if (!ctx)
    /* Error occurred */
if (EVP_PKEY_verify_recover_init(ctx) <= 0)
    /* Error */
if (EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_PADDING) <= 0)
    /* Error */
if (EVP_PKEY_CTX_set_signature_md(ctx, EVP_sha256()) <= 0)
    /* Error */

/* Determine buffer length */
if (EVP_PKEY_verify_recover(ctx, NULL, &routlen, sig, siglen) <= 0)
    /* Error */

rout = OPENSSL_malloc(routlen);

if (!rout)
    /* malloc failure */

if (EVP_PKEY_verify_recover(ctx, rout, &routlen, sig, siglen) <= 0)
    /* Error */

/* Recovered data is routlen bytes written to buffer rout */

see how we call it once with NULL to get the length, then malloc, then call it again? that's the two-pass slay. 🔥

🎀 HISTORY 🎀

EVP_PKEY_verify_recover_init() and EVP_PKEY_verify_recover() were added in OpenSSL 1.0.0. vintage icons fr fr.
EVP_PKEY_verify_recover_init_ex() was added in OpenSSL 3.0.

💜 COPYRIGHT 💜

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

and that's the whole page, bestie 🫶 — from the OpenSSL crew, version 3.5.0, dated 2026-09-25. go recover some signatures responsibly, mwah 💋

📦 where this page comes from

opensuse-leap 16.0: openssl-3-doc 3.5.0-160000.11.1 · Apache-2.0
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash-1017 on 2026-11-04: a language model's rewrite of the original, under its terms

EVP_PKEY_VERIFY_RECOVER(3ossl)