EVP_PKEY_FROMDATA(3ossl)

📦

version 3.5.9 · 8 versions

3.5.9 · fedora 43, fedora 44 (latest)
3.5.9 · centos-stream 9
3.5.9 · centos-stream 10
3.5.9 · alpine 3.22
3.5.9 · alpine 3.23, alpine 3.24
3.5.8 · fedora 43
3.5.1 · fedora 43
3.5.5 · fedora 44

💖 EVP_PKEY_FROMDATA 💖

okay bestie, welcome to the EVP_PKEY_FROMDATA page from the OpenSSL manual (yes, the 3ossl one, section 3, we're fancy). this is the whole family of functions that build keys and key params out of your data. no cap. let's get into it 🫶

✨ NAME ✨

EVP_PKEY_fromdata_init, EVP_PKEY_fromdata, EVP_PKEY_fromdata_settable — the girlies that create keys and key parameters from user data 💅

✨ SYNOPSIS ✨

#include <openssl/evp.h>

int EVP_PKEY_fromdata_init(EVP_PKEY_CTX *ctx);
int EVP_PKEY_fromdata(EVP_PKEY_CTX *ctx, EVP_PKEY **ppkey, int selection,
                      OSSL_PARAM params[]);
const OSSL_PARAM *EVP_PKEY_fromdata_settable(EVP_PKEY_CTX *ctx, int selection);

✨ DESCRIPTION ✨

so like, these functions? they're the ones you call when you wanna create new keys from key data you provide. think n, e and d for a minimal RSA keypair. iconic behavior honestly 🌸

they all use an EVP_PKEY_CTX context, and the vibe is that you should primarily make that context with EVP_PKEY_CTX_new_from_name(3) or EVP_PKEY_CTX_new_id(3).

the exact key data you're allowed to pass? depends entirely on the key type, bestie. and you pass it all as an OSSL_PARAM(3) array. slay.

EVP_PKEY_fromdata_init() — initializes a public key algorithm context for creating a key or key parameters from user data. it's giving "get ready, we're about to cook" 🔥
EVP_PKEY_fromdata() — creates the structure to store a key or key parameters, given data from params, selection and a context that's been initialized with EVP_PKEY_fromdata_init(). the result gets written to *ppkey. selection is described down in "Selections". the parameters you can use for the various types of key are exactly the ones described by the various "Common parameters" sections of the EVP_PKEY-RSA(7), EVP_PKEY-DSA(7), EVP_PKEY-DH(7), EVP_PKEY-EC(7), EVP_PKEY-ED448(7), EVP_PKEY-X25519(7), EVP_PKEY-X448(7), EVP_PKEY-ED25519(7), EVP_PKEY-ML-DSA(7) and EVP_PKEY-ML-KEM(7) pages. that's a lot of pages, but they're all your friends 💜
EVP_PKEY_fromdata_settable() — gets a constant OSSL_PARAM(3) array that describes the settable parameters that can be used with EVP_PKEY_fromdata(). selection is described in "Selections".

heads up, queen: parameters in the params array that aren't among the settable parameters for the given selection are just... ignored. they get no attention. ghosted. 🙈

🌈 Selections 🌈

these are the constants you can pass for selection, and they decide what actually gets selected:

EVP_PKEY_KEY_PARAMETERS — only key parameters will be selected.
EVP_PKEY_PUBLIC_KEY — only public key components will be selected. this includes optional key parameters, so like, bonus content ✨
EVP_PKEY_KEYPAIR — any keypair components will be selected. that means the private key, the public key and the key parameters. the whole package, the full set, main character energy 👑

✨ NOTES ✨

okay important: these functions only work with key management methods coming from a provider. that's the rule, no exceptions. and psst — this is the mirror function to EVP_PKEY_todata(3), so they're basically twin flames 🪞💞

✨ RETURN VALUES ✨

EVP_PKEY_fromdata_init() and EVP_PKEY_fromdata() return 1 for success, and 0 or a negative value for failure. and specifically — listen up — a return value of -2 means the operation is not supported by the public key algorithm. so if you see a -2, that's what it's telling you 😭

✨ EXAMPLES ✨

these examples are very terse, and that's on purpose — we're staying on topic, and the topic is the EVP_PKEY_fromdata() set of functions. in real applications, BIGNUMs would be handled and converted to byte arrays with BN_bn2nativepad(), but that's off topic here, so we're not doing it. moving on 💅

🦋 Creating an RSA keypair using raw key data 🦋

#include <openssl/evp.h>

/*
 * These are extremely small to make this example simple.  A real
 * and secure application will not use such small numbers.  A real
 * and secure application is expected to use BIGNUMs, and to build
 * this array dynamically.
 */
unsigned long rsa_n = 0xbc747fc5;
unsigned long rsa_e = 0x10001;
unsigned long rsa_d = 0x7b133399;
OSSL_PARAM params[] = {
    OSSL_PARAM_ulong("n", &rsa_n),
    OSSL_PARAM_ulong("e", &rsa_e),
    OSSL_PARAM_ulong("d", &rsa_d),
    OSSL_PARAM_END
};

int main()
{
    EVP_PKEY_CTX *ctx = EVP_PKEY_CTX_new_from_name(NULL, "RSA", NULL);
    EVP_PKEY *pkey = NULL;

    if (ctx == NULL
        || EVP_PKEY_fromdata_init(ctx) <= 0
        || EVP_PKEY_fromdata(ctx, &pkey, EVP_PKEY_KEYPAIR, params) <= 0)
        exit(1);

    /* Do what you want with |pkey| */
}

🦋 Creating an ECC keypair using raw key data 🦋

#include <openssl/evp.h>
#include <openssl/param_build.h>
#include <openssl/ec.h>

/*
 * Fixed data to represent the private and public key.
 */
const unsigned char priv_data[] = {
    0xb9, 0x2f, 0x3c, 0xe6, 0x2f, 0xfb, 0x45, 0x68,
    0x39, 0x96, 0xf0, 0x2a, 0xaf, 0x6c, 0xda, 0xf2,
    0x89, 0x8a, 0x27, 0xbf, 0x39, 0x9b, 0x7e, 0x54,
    0x21, 0xc2, 0xa1, 0xe5, 0x36, 0x12, 0x48, 0x5d
};
/* UNCOMPRESSED FORMAT */
const unsigned char pub_data[] = {
    POINT_CONVERSION_UNCOMPRESSED,
    0xcf, 0x20, 0xfb, 0x9a, 0x1d, 0x11, 0x6c, 0x5e,
    0x9f, 0xec, 0x38, 0x87, 0x6c, 0x1d, 0x2f, 0x58,
    0x47, 0xab, 0xa3, 0x9b, 0x79, 0x23, 0xe6, 0xeb,
    0x94, 0x6f, 0x97, 0xdb, 0xa3, 0x7d, 0xbd, 0xe5,
    0x26, 0xca, 0x07, 0x17, 0x8d, 0x26, 0x75, 0xff,
    0xcb, 0x8e, 0xb6, 0x84, 0xd0, 0x24, 0x02, 0x25,
    0x8f, 0xb9, 0x33, 0x6e, 0xcf, 0x12, 0x16, 0x2f,
    0x5c, 0xcd, 0x86, 0x71, 0xa8, 0xbf, 0x1a, 0x47
};

int main()
{
    EVP_PKEY_CTX *ctx;
    EVP_PKEY *pkey = NULL;
    BIGNUM *priv;
    OSSL_PARAM_BLD *param_bld;
    OSSL_PARAM *params = NULL;
    int exitcode = 0;

    priv = BN_bin2bn(priv_data, sizeof(priv_data), NULL);

    param_bld = OSSL_PARAM_BLD_new();
    if (priv != NULL && param_bld != NULL
        && OSSL_PARAM_BLD_push_utf8_string(param_bld, "group",
                                           "prime256v1", 0)
        && OSSL_PARAM_BLD_push_BN(param_bld, "priv", priv)
        && OSSL_PARAM_BLD_push_octet_string(param_bld, "pub",
                                            pub_data, sizeof(pub_data)))
        params = OSSL_PARAM_BLD_to_param(param_bld);

    ctx = EVP_PKEY_CTX_new_from_name(NULL, "EC", NULL);
    if (ctx == NULL
        || params == NULL
        || EVP_PKEY_fromdata_init(ctx) <= 0
        || EVP_PKEY_fromdata(ctx, &pkey, EVP_PKEY_KEYPAIR, params) <= 0) {
        exitcode = 1;
    } else {
        /* Do what you want with |pkey| */
    }

    EVP_PKEY_free(pkey);
    EVP_PKEY_CTX_free(ctx);
    OSSL_PARAM_free(params);
    OSSL_PARAM_BLD_free(param_bld);
    BN_free(priv);

    exit(exitcode);
}

🦋 Finding out params for an unknown key type 🦋

#include <openssl/evp.h>
#include <openssl/core.h>

/* Program expects a key type as first argument */
int main(int argc, char *argv[])
{
    EVP_PKEY_CTX *ctx = EVP_PKEY_CTX_new_from_name(NULL, argv[1], NULL);
    const OSSL_PARAM *settable_params = NULL;

    if (ctx == NULL)
       exit(1);
   settable_params = EVP_PKEY_fromdata_settable(ctx, EVP_PKEY_KEYPAIR);
   if (settable_params == NULL)
        exit(1);

    for (; settable_params->key != NULL; settable_params++) {
        const char *datatype = NULL;

        switch (settable_params->data_type) {
        case OSSL_PARAM_INTEGER:
            datatype = "integer";
            break;
        case OSSL_PARAM_UNSIGNED_INTEGER:
            datatype = "unsigned integer";
            break;
        case OSSL_PARAM_UTF8_STRING:
            datatype = "printable string (utf-8 encoding expected)";
            break;
        case OSSL_PARAM_UTF8_PTR:
            datatype = "printable string pointer (utf-8 encoding expected)";
            break;
        case OSSL_PARAM_OCTET_STRING:
            datatype = "octet string";
            break;
        case OSSL_PARAM_OCTET_PTR:
            datatype = "octet string pointer";
            break;
        }
        printf("%s : %s ", settable_params->key, datatype);
        if (settable_params->data_size == 0)
            printf("(unlimited size)\n");
        else
            printf("(maximum size %zu)\n", settable_params->data_size);
    }
}

and bestie, one more lil gem: the descriptor OSSL_PARAM(3) returned by EVP_PKEY_fromdata_settable() can also be used programmatically, for example with OSSL_PARAM_allocate_from_text(3). flexible icon 💅

go read them, they're all part of the lore 🫶

✨ HISTORY ✨

these functions were added in OpenSSL 3.0 ⭐
support for ML-DSA, ML-KEM and SLH-DSA was added in OpenSSL 3.5 🌈

✨ COPYRIGHT ✨

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

and that's the whole page, bestie!! 💖 this was OpenSSL 3.5.9, dated 2026-09-29, and you just read the EVP_PKEY_FROMDATA(3ossl) manual. go build some keys, you absolute legend 👑✨ no cap, you ate. 🎀🦋

📦 where this page comes from

fedora 43: openssl-devel 1:3.5.9-1.fc43 · Apache-2.0
fedora 43: openssl-devel 1:3.5.9-1.fc43 · Apache-2.0
fedora 44: openssl-devel 1:3.5.9-1.fc44 · Apache-2.0
fedora 44: openssl-devel 1:3.5.9-1.fc44 · Apache-2.0
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash on 2026-10-14: a language model's rewrite of the original, under its terms