EVP_PKEY_GET...LT_DIGEST_NID(3ossl)

💖 EVP_PKEY_GET...LT_DIGEST_NID 💖

okay bestie, so this is a page from the OpenSSL manual, section 3ossl, and the whole vibe is: how do I find out which digest a key wants for signing? ✨ There's two functions here, EVP_PKEY_get_default_digest_nid and EVP_PKEY_get_default_digest_name, and they are literally the "what's your default signature digest, babe?" girlies. Let's get into it 💅

---

🌸 NAME 🌸

EVP_PKEY_get_default_digest_nid, EVP_PKEY_get_default_digest_name — get the default signature digest 🫶

---

✨ SYNOPSIS ✨

#include <openssl/evp.h>

int EVP_PKEY_get_default_digest_name(EVP_PKEY *pkey,
                                     char *mdname, size_t mdname_sz);
int EVP_PKEY_get_default_digest_nid(EVP_PKEY *pkey, int *pnid);

---

🦋 DESCRIPTION 🦋

So EVP_PKEY_get_default_digest_name() is the one that fills in the default message digest name for the public key signature operations that go with the key pkey, and it drops that name into mdname — up to at most mdname_sz bytes, NUL terminator included, no cap 💖

And the name it gives you could literally be "UNDEF", which is the little code for "a digest must be left unspecified (that's return value 2) or may be left unspecified (that's return value 1)". Yes, it's giving cryptic. We love her anyway 🎀

Then EVP_PKEY_get_default_digest_nid() sets pnid to the default message digest NID for the public key signature operations tied to key pkey. Okay so important heads-up bestie: some signature algorithms — I'm talking Ed25519 and Ed448 — do not use a digest during signing at all, no cap. In that case pnid gets set to NID_undef. 😭

Also this function is only reliable for legacy keys, which are keys that have an EVP_PKEY_ASN1_METHOD. Those keys have typically been loaded from engines, or created with EVP_PKEY_assign_RSA(3) or similar. So like, if you're on the new-school key types, don't come for her, she's not built for that 🙈

---

📝 NOTES 📝

For all current standard OpenSSL public key algorithms, SHA256 is returned. Every single one. Periodt. 👑

---

🔥 RETURN VALUES 🔥

Both EVP_PKEY_get_default_digest_name() and EVP_PKEY_get_default_digest_nid() return:

1. 1 — if the message digest is advisory, meaning other digests can still be used 💫
2. 2 — if the message digest is mandatory, meaning other digests can not be used, it's giving strict queen energy 👑

And for the fail girlies: they return 0 or a negative value for failure. In particular, a return value of -2 means the operation is not supported by the public key algorithm 💀

not me getting a -2 and being like "what did I do" 😭 it's literally just unsupported bestie, it's not you

---

🫶 SEE ALSO 🫶

• EVP_PKEY_CTX_new(3)
• EVP_PKEY_sign(3)
• EVP_PKEY_digestsign_supports_digest(3)
• EVP_PKEY_verify(3)
• EVP_PKEY_verify_recover(3)

---

🌈 HISTORY 🌈

This function was added in OpenSSL 1.0.0. She's been here since the olden days, an absolute icon of longevity 💜

---

⭐ COPYRIGHT ⭐

Copyright 2006-2023 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

and that's the whole page bestie, ty for reading my little hyperfixation ✨ this was OpenSSL 3.5.9, dated 2026-09-2, and yeah the date is formatted like that, I don't make the rules 💅 mwah 🎀