EVP_PKEY_CTX_NEW(3ossl)

📦
version 3.5.9 · 8 versions
, in fedora 43, fedora 44

💖 EVP_PKEY_CTX_NEW(3ossl) 💖

okay bestie, sit DOWN, because we're talking about the OpenSSL 3ossl manual page for public key algorithm context functions. this is the <pink>public key algorithm context</pink> girlie squad: EVP_PKEY_CTX_new, EVP_PKEY_CTX_new_id, EVP_PKEY_CTX_new_from_name, EVP_PKEY_CTX_new_from_pkey, EVP_PKEY_CTX_dup, EVP_PKEY_CTX_free, and EVP_PKEY_CTX_is_a. yes that's seven icons and yes they all ate. 🎀

✨ SYNOPSIS ✨

#include <openssl/evp.h>

EVP_PKEY_CTX *EVP_PKEY_CTX_new(EVP_PKEY *pkey, ENGINE *e);
EVP_PKEY_CTX *EVP_PKEY_CTX_new_id(int id, ENGINE *e);
EVP_PKEY_CTX *EVP_PKEY_CTX_new_from_name(OSSL_LIB_CTX *libctx,
                                         const char *name,
                                         const char *propquery);
EVP_PKEY_CTX *EVP_PKEY_CTX_new_from_pkey(OSSL_LIB_CTX *libctx,
                                         EVP_PKEY *pkey,
                                         const char *propquery);
EVP_PKEY_CTX *EVP_PKEY_CTX_dup(const EVP_PKEY_CTX *ctx);
void EVP_PKEY_CTX_free(EVP_PKEY_CTX *ctx);
int EVP_PKEY_CTX_is_a(EVP_PKEY_CTX *ctx, const char *keytype);

like. look at that lineup. it's giving main character energy fr fr 💅

🌸 DESCRIPTION 🌸

EVP_PKEY_CTX_new() — allocates a public key algorithm context using the pkey key type and ENGINE e. that's it. that's the whole vibe. ✨

EVP_PKEY_CTX_new_id() — allocates a public key algorithm context using the key type specified by id and ENGINE e. name-your-own-id situation, iconic.

EVP_PKEY_CTX_new_from_name() — allocates a public key algorithm context using the library context libctx (peep OSSL_LIB_CTX(3) for the deets), the key type specified by name, and the property query propquery.

🫶 IMPORTANT BESTIE MOMENT: none of the arguments are duplicated, so they must remain unchanged for the lifetime of the returned EVP_PKEY_CTX or of any of its duplicates. do not touch. do not mutate. hands off. 🔥

want the possible names? scroll to NOTES below, it's all there.

EVP_PKEY_CTX_new_from_pkey() — allocates a public key algorithm context using the library context libctx (again, OSSL_LIB_CTX(3)) and the algorithm specified by pkey, plus the property query propquery.

same rule, same energy: none of the arguments are duplicated, so they must remain unchanged for the lifetime of the returned EVP_PKEY_CTX or any of its duplicates. 🫶

ngl, EVP_PKEY_CTX_new_id() and EVP_PKEY_CTX_new_from_name() are normally the ones you reach for when there's no EVP_PKEY structure associated with the operations — like, for example, during parameter generation or key generation for some algorithms. no key yet? no problem. 🦋

EVP_PKEY_CTX_dup() — duplicates the context ctx.

💀 it is not supported for a keygen operation. but!! it is possible to duplicate a context freshly created via any of the above "new" functions, provided EVP_PKEY_keygen_init(3) has not yet been called on the source context — and then use the copy for key generation. read that twice. the order literally matters. 😭

EVP_PKEY_CTX_free() — frees up the context ctx. and if ctx is NULL? nothing is done. it simply chooses peace. 🙈

EVP_PKEY_is_a() — checks if the key type associated with ctx is keytype.

🎀 NOTES 🎀

💜 On EVP_PKEY_CTX

the EVP_PKEY_CTX structure is an opaque public key algorithm context used by the OpenSSL high-level public key API.

🚨 Contexts MUST NOT be shared between threads. that is, it is not permissible to use the same context simultaneously in two threads. do not do it. not even once. not even for a little bit. periodt. 💅

🦋 On Key Types

we say "key type" in this manual, which is the same as "algorithm" in most cases — either term, use them interchangeably, we're not gonna gatekeep. ✨

but heads up: there are algorithms where the key type and the algorithm of the operations that use the keys are not the same. example: EC keys being used for ECDSA and ECDH operations. it's giving versatility. 👑

key types are given in two different manners:

⭐ Legacy NID or EVP_PKEY type

this is the id used with EVP_PKEY_CTX_new_id().

these are EVP_PKEY_RSA, EVP_PKEY_RSA_PSS, EVP_PKEY_DSA, EVP_PKEY_DH, EVP_PKEY_EC, EVP_PKEY_SM2, EVP_PKEY_X25519, EVP_PKEY_X448, and they're used by legacy methods.

🌈 Name strings

this is the name used with EVP_PKEY_CTX_new_from_name().

these are names like "RSA", "DSA", and what's available depends on what providers are currently accessible. lowkey provider-dependent, highkey still slay. 🔥

the OpenSSL providers offer a set of key types available this way — please see OSSL_PROVIDER-FIPS(7) and OSSL_PROVIDER-default(7) and related documentation for more information. 📚

👑 RETURN VALUES 👑

  • EVP_PKEY_CTX_new(), EVP_PKEY_CTX_new_id() and EVP_PKEY_CTX_dup() — return either the newly allocated EVP_PKEY_CTX structure or NULL if an error occurred. 💖
  • EVP_PKEY_CTX_free() — does not return a value. it just vibes. 🫶
  • EVP_PKEY_CTX_is_a() — returns 1 for true and 0 for false. classic. iconic. no cap. ✨

🔍 SEE ALSO 🔍

📜 HISTORY 📜

  • The EVP_PKEY_CTX_new(), EVP_PKEY_CTX_new_id(), EVP_PKEY_CTX_dup() and EVP_PKEY_CTX_free() functions were added in OpenSSL 1.0.0.
  • The EVP_PKEY_CTX_new_from_name() and EVP_PKEY_CTX_new_from_pkey() functions were added in OpenSSL 3.0.

they've been serving looks for literal decades bestie, we simply have to respect it. 💜

Copyright 2006-2025 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

and that's the whole page, bestie!! 🌸 this was EVP_PKEY_CTX_NEW(3ossl) from OpenSSL 3.5.9, dated 2026-09-29. go forth and manage your contexts responsibly, don't share them between threads, and remember: arguments are not duplicated, so keep them alive and unchanged. mwah. 💅🎀✨

📦 where this page comes from