EVP_PKEY_GET_ATTR(3ossl)

💖 EVP_PKEY_GET_ATTR 💖

okay bestie, this is page 3ossl from the OpenSSL manuals, and we're about to get so cozy with EVP_PKEY attribute lists. no cap.

---

✨ NAME ✨

EVP_PKEY_get_attr, EVP_PKEY_get_attr_count, EVP_PKEY_get_attr_by_NID, EVP_PKEY_get_attr_by_OBJ, EVP_PKEY_delete_attr, EVP_PKEY_add1_attr, EVP_PKEY_add1_attr_by_OBJ, EVP_PKEY_add1_attr_by_NID, EVP_PKEY_add1_attr_by_txt — literally the EVP_PKEY X509_ATTRIBUTE functions. that's the whole vibe.

---

🌸 SYNOPSIS 🌸

#include <openssl/x509.h>

int EVP_PKEY_get_attr_count(const EVP_PKEY *key);
int EVP_PKEY_get_attr_by_NID(const EVP_PKEY *key, int nid, int lastpos);
int EVP_PKEY_get_attr_by_OBJ(const EVP_PKEY *key, const ASN1_OBJECT *obj,
                             int lastpos);
X509_ATTRIBUTE *EVP_PKEY_get_attr(const EVP_PKEY *key, int loc);
X509_ATTRIBUTE *EVP_PKEY_delete_attr(EVP_PKEY *key, int loc);
int EVP_PKEY_add1_attr(EVP_PKEY *key, X509_ATTRIBUTE *attr);
int EVP_PKEY_add1_attr_by_OBJ(EVP_PKEY *key,
                              const ASN1_OBJECT *obj, int type,
                              const unsigned char *bytes, int len);
int EVP_PKEY_add1_attr_by_NID(EVP_PKEY *key,
                              int nid, int type,
                              const unsigned char *bytes, int len);
int EVP_PKEY_add1_attr_by_txt(EVP_PKEY *key,
                              const char *attrname, int type,
                              const unsigned char *bytes, int len);

---

🦋 DESCRIPTION 🦋

so basically, these functions are the ones PKCS12 uses. that's their whole job. 💅

EVP_PKEY_get_attr_by_OBJ() goes hunting for the location of the first matching object obj in the key attribute list. the search starts at the position right after lastpos. if what comes back is positive, you can feed it right back into EVP_PKEY_get_attr_by_OBJ() as the value of lastpos on your next call, and boom — you're iterating through the rest of the attributes. on your very first call you can set lastpos to any negative value so the search starts from the beginning of the attribute list. 🫶

EVP_PKEY_get_attr_by_NID() is the same energy as EVP_PKEY_get_attr_by_OBJ(), except it passes the numerical identifier (NID) nid that's associated with the object. peek <openssl/obj_mac.h> for a list of NID_*. 📋

EVP_PKEY_get_attr() hands you the X509_ATTRIBUTE object sitting at index loc in the key attribute list. loc should be in the range from 0 to EVP_PKEY_get_attr_count() - 1. don't get cute with the bounds, bestie.

EVP_PKEY_delete_attr() removes the X509_ATTRIBUTE object at index loc in the key attribute list. bye girl 💀

EVP_PKEY_add1_attr() pushes a copy of the passed-in X509_ATTRIBUTE object onto the key attribute list. a brand new key attribute list gets created if one's needed. and an error happens if either attr is NULL, or if the attribute already exists. no duplicates allowed, periodt.

EVP_PKEY_add1_attr_by_OBJ() creates a fresh X509_ATTRIBUTE using X509_ATTRIBUTE_set1_object() and X509_ATTRIBUTE_set1_data() to assign a new obj with type type and data bytes of length len, then pushes it onto the key object's attribute list. if obj already exists in the attribute list, error. 🚫

EVP_PKEY_add1_attr_by_NID() is similar to EVP_PKEY_add1_attr_by_OBJ() except that it passes the numerical identifier (NID) nid associated with the object. check <openssl/obj_mac.h> for a list of NID_*. ✨

EVP_PKEY_add1_attr_by_txt() is similar to EVP_PKEY_add1_attr_by_OBJ() except that it passes a name attrname associated with the object. look at <openssl/obj_mac.h> for a list of SN_* names. 🌈

---

👑 RETURN VALUES 👑

EVP_PKEY_get_attr_count() returns the number of attributes in the key object attribute list, or -1 if the attribute list is NULL.

EVP_PKEY_get_attr_by_OBJ() returns -1 if either the list is empty OR the object isn't found — otherwise it returns the location of the object in the list.

EVP_PKEY_get_attr_by_NID() is similar to EVP_PKEY_get_attr_by_OBJ(), except that it returns -2 if the nid isn't known by OpenSSL. 😭

EVP_PKEY_get_attr() returns either a X509_ATTRIBUTE or NULL if there is a error.

EVP_PKEY_delete_attr() returns either the removed X509_ATTRIBUTE or NULL if there is a error.

EVP_PKEY_add1_attr(), EVP_PKEY_add1_attr_by_OBJ(), EVP_PKEY_add1_attr_by_NID() and EVP_PKEY_add1_attr_by_txt() return 1 on success or 0 otherwise.

---

🎀 NOTES 🎀

an EVP_PKEY object's attribute list starts out as NULL. that means every single function listed above will return an error unless EVP_PKEY_add1_attr() is called first. yes, really. also, every function listed here assumes that the key is not NULL. like, that's the bare minimum, bestie. 🫠

---

🔥 SEE ALSO 🔥

X509_ATTRIBUTE(3)

---

💜 COPYRIGHT 💜

Copyright 2023-2024 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

and that's the whole page, bestie 🧚 this one's from OpenSSL version 3.5.9, dated 2026-09-29, and it's filed under EVP_PKEY_GET_ATTR(3ossl). go forth and handle your attributes responsibly 💅✨