EVP_SIGNATURE(3ossl)

💖 EVP_SIGNATURE — so you wanna manage EVP_SIGNATURE algorithm objects 💖

okay so real talk, this is a page from the OpenSSL manual set, section 3ossl — it's EVP_SIGNATURE(3ossl) bestie, and it's literally all about the functions that manage EVP_SIGNATURE algorithm objects. no cap, that's the whole gig.

✨ NAME ✨

EVP_SIGNATURE, EVP_SIGNATURE_fetch, EVP_SIGNATURE_free, EVP_SIGNATURE_up_ref, EVP_SIGNATURE_is_a, EVP_SIGNATURE_get0_provider, EVP_SIGNATURE_do_all_provided, EVP_SIGNATURE_names_do_all, EVP_SIGNATURE_get0_name, EVP_SIGNATURE_get0_description, EVP_SIGNATURE_gettable_ctx_params, EVP_SIGNATURE_settable_ctx_params — the whole friend group 💅 these are functions to manage EVP_SIGNATURE algorithm objects.

---

🎀 SYNOPSIS 🎀

like, here's the include and everything, exactly as it is, don't @ me:

#include <openssl/evp.h>

typedef struct evp_signature_st EVP_SIGNATURE;

EVP_SIGNATURE *EVP_SIGNATURE_fetch(OSSL_LIB_CTX *ctx, const char *algorithm,
                                   const char *properties);
void EVP_SIGNATURE_free(EVP_SIGNATURE *signature);
int EVP_SIGNATURE_up_ref(EVP_SIGNATURE *signature);
const char *EVP_SIGNATURE_get0_name(const EVP_SIGNATURE *signature);
int EVP_SIGNATURE_is_a(const EVP_SIGNATURE *signature, const char *name);
OSSL_PROVIDER *EVP_SIGNATURE_get0_provider(const EVP_SIGNATURE *signature);
void EVP_SIGNATURE_do_all_provided(OSSL_LIB_CTX *libctx,
                                   void (*fn)(EVP_SIGNATURE *signature,
                                              void *arg),
                                   void *arg);
int EVP_SIGNATURE_names_do_all(const EVP_SIGNATURE *signature,
                               void (*fn)(const char *name, void *data),
                               void *data);
const char *EVP_SIGNATURE_get0_name(const EVP_SIGNATURE *signature);
const char *EVP_SIGNATURE_get0_description(const EVP_SIGNATURE *signature);
const OSSL_PARAM *EVP_SIGNATURE_gettable_ctx_params(const EVP_SIGNATURE *sig);
const OSSL_PARAM *EVP_SIGNATURE_settable_ctx_params(const EVP_SIGNATURE *sig);

(yes EVP_SIGNATURE_get0_name shows up twice in there, that's just how the original is, we don't gatekeep 🌸)

---

🦋 DESCRIPTION 🦋

EVP_SIGNATURE_fetch() grabs the implementation for whatever algorithm you asked for, from any provider offering it, inside the criteria you gave in properties. the algorithm is gonna be one of the ones offering functions for signature-related tasks — signing, verifying, all that main character stuff. for the deep lore, go read "ALGORITHM FETCHING" in crypto(7).

🫶 the value you get back must eventually be freed with EVP_SIGNATURE_free(). don't just leave it hanging, that's not the vibe.

EVP_SIGNATURE_free() decrements the reference count for the EVP_SIGNATURE structure. typically you got this structure from an earlier EVP_SIGNATURE_fetch() call. if the refcount drops to 0, the structure gets freed. and if the argument is NULL, nothing happens — it literally just minds its own business, iconic.

EVP_SIGNATURE_up_ref() increments the reference count for an EVP_SIGNATURE structure. bestie said "you're not going anywhere" 💅

EVP_SIGNATURE_is_a() returns 1 if signature is an implementation of an algorithm that's identifiable with name, otherwise 0. vibe check passed or not, that's it.

EVP_SIGNATURE_get0_provider() returns the provider that signature was fetched from. finding out where it came from, we love a backstory.

EVP_SIGNATURE_do_all_provided() traverses all SIGNATURE implemented by all activated providers in the given library context libctx, and for each of the implementations, calls the given function fn with the implementation method and the given arg as argument. it's giving roll call, fr fr 📣

EVP_SIGNATURE_get0_name() returns the algorithm name from the provided implementation for the given signature. heads up though — the signature may have multiple synonyms associated with it, and in that case the first name from the algorithm definition is the one returned. ownership of the returned string stays with the signature object, so don't you dare free it as the caller. 🙈

EVP_SIGNATURE_names_do_all() traverses all names for signature, and calls fn with each name and data.

EVP_SIGNATURE_get0_description() returns a description of the signature, meant for display and human consumption. the description is at the discretion of the signature implementation — so like, whatever it feels like saying ✨.

EVP_SIGNATURE_gettable_ctx_params() and EVP_SIGNATURE_settable_ctx_params() return a constant OSSL_PARAM(3) array that describes the names and types of key parameters that can be retrieved or set by a signature algorithm using EVP_PKEY_CTX_get_params(3) and EVP_PKEY_CTX_set_params(3). gettable = can get, settable = can set. we stay consistent 👑

---

💜 RETURN VALUES 💜

• EVP_SIGNATURE_fetch() — returns a pointer to an EVP_SIGNATURE for success, or NULL for failure 😭
• EVP_SIGNATURE_up_ref() — returns 1 for success or 0 otherwise
• EVP_SIGNATURE_names_do_all() — returns 1 if the callback was called for all names. a return value of 0 means the callback was not called for any names
• EVP_SIGNATURE_gettable_ctx_params() and EVP_SIGNATURE_settable_ctx_params() — return a constant OSSL_PARAM(3) array, or NULL on error

---

🌈 SEE ALSO 🌈

go read these next, iykyk:

• "ALGORITHM FETCHING" in crypto(7)
• OSSL_PROVIDER(3)

---

⭐ HISTORY ⭐

the functions described here were added in OpenSSL 3.0. vintage-ish but make it modern 🎀

---

👑 COPYRIGHT 👑

Copyright 2019-2024 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

okay that's the whole page bestie, you ate that 🍓 this was OpenSSL 3.5.0, dated 2026-09-25 — go sign something and slay 💅✨