EVP_PKEY_SIGN(3ossl)

📦

version 3.5.9 · 8 versions

3.5.9 · fedora 43, fedora 44 (latest)
3.5.9 · centos-stream 9
3.5.9 · centos-stream 10
3.5.9 · alpine 3.22
3.5.9 · alpine 3.23, alpine 3.24
3.5.8 · fedora 43
3.5.1 · fedora 43
3.5.5 · fedora 44

✨ EVP_PKEY_SIGN 💖 — the `3ossl` glow-up ✨

okay bestie, sit down, hydrate, because today we're learning how to sign stuff with a public key algorithm in OpenSSL. this is EVP_PKEY_SIGN(3ossl) and it's lowkey one of the most important pages in the whole crypto house 🏠✨

🌸 NAME 🌸

EVP_PKEY_sign_init, EVP_PKEY_sign_init_ex, EVP_PKEY_sign_init_ex2, EVP_PKEY_sign, EVP_PKEY_sign_message_init, EVP_PKEY_sign_message_update, EVP_PKEY_sign_message_final — sign using a public key algorithm 🔏💅

🎀 SYNOPSIS 🎀

#include <openssl/evp.h>

int EVP_PKEY_sign_init(EVP_PKEY_CTX *ctx);
int EVP_PKEY_sign_init_ex(EVP_PKEY_CTX *ctx, const OSSL_PARAM params[]);
int EVP_PKEY_sign_init_ex2(EVP_PKEY_CTX *ctx, EVP_SIGNATURE *algo,
                           const OSSL_PARAM params[]);
int EVP_PKEY_sign_message_init(EVP_PKEY_CTX *ctx, EVP_SIGNATURE *algo,
                               const OSSL_PARAM params[]);
int EVP_PKEY_sign_message_update(EVP_PKEY_CTX *ctx,
                                 unsigned char *in, size_t inlen);
int EVP_PKEY_sign_message_final(EVP_PKEY_CTX *ctx, unsigned char *sig,
                                size_t *siglen, size_t sigsize);
int EVP_PKEY_sign(EVP_PKEY_CTX *ctx,
                  unsigned char *sig, size_t *siglen,
                  const unsigned char *tbs, size_t tbslen);

🦋 DESCRIPTION 🦋

okay so, seven functions, one vibe: making signatures. let's go one by one, no skipping, bestie 🫶

EVP_PKEY_sign_init() — initializes a public key algorithm context ctx for signing, using the algorithm that got baked in when the context was created with EVP_PKEY_CTX_new(3) (or one of its variants, iykyk). that algorithm is used to fetch an EVP_SIGNATURE method implicitly — and if you wanna know the tea on implicit fetches, go read "Implicit fetch" in provider(7) 💅
EVP_PKEY_sign_init_ex() — literally the same as EVP_PKEY_sign_init(), except it also sets the passed parameters params on the context before it returns. little extra sprinkle, no big deal ✨
EVP_PKEY_sign_init_ex2() — this one initializes ctx for signing a pre-computed message digest, using the algorithm given by algo and the key given through EVP_PKEY_CTX_new(3) or EVP_PKEY_CTX_new_from_pkey(3). > ⚠️ important: a context ctx with no pre-loaded key cannot be used with this function, periodt. it does almost the same thing as EVP_PKEY_sign_init_ex(), but it's uniquely meant for a pre-computed message digest, and it lets you pre-determine the exact conditions for that message digest — but only if a composite signature algorithm (like RSA-SHA256) was fetched. after you call this, setting parameters that modify the digest implementation or the padding is not normally supported. so like, don't try it 🙈
EVP_PKEY_sign_message_init() — initializes ctx for signing a message of unlimited size, using the algorithm given by algo and the key given through EVP_PKEY_CTX_new(3) or EVP_PKEY_CTX_new_from_pkey(3). you can pass the message two ways: one-shot with EVP_PKEY_sign(), or the combo of EVP_PKEY_sign_message_update() + EVP_PKEY_sign_message_final(). this one unlocks algorithms that can process input of arbitrary length — think ED25519, RSA-SHA256 and friends 🌈
EVP_PKEY_sign_message_update() — adds inlen bytes from in to the data that's gonna get processed for the signature. how those input bytes get processed, and whether there's a cap on the total input size, is up to the signature algorithm spec and implementation. peep the "NOTES" section below for the deeper explanation 👀
EVP_PKEY_sign_message_final() — signs the processed data and drops it into sig, with the number of signature bytes going into *siglen — but only if that number of bytes doesn't surpass the size given by sigsize. and plot twist: sig can be NULL! in that case, only *siglen gets updated with the number of signature bytes. iconic 💅
EVP_PKEY_sign() — the one-shot baddie, works with all the init functions above. here's the tea on how it behaves:
- when initialization happened via EVP_PKEY_sign_init(), EVP_PKEY_sign_init_ex() or EVP_PKEY_sign_init_ex2(), the data specified by tbs and tbslen gets signed after appropriate padding.
- when initialization happened via EVP_PKEY_sign_message_init(), the data specified by tbs and tbslen gets digested by the implied message digest algorithm, and then the result gets signed after appropriate padding.
- if sig is NULL, the maximum size of the output buffer is written to the siglen parameter.
- if sig is not NULL, then before the call the siglen parameter should contain the length of the sig buffer, and if the call succeeds, the signature gets written to sig and the amount of data written goes into siglen. slay ✅

👑 NOTES 👑

💜 General 💜

some signature implementations literally just accumulate the input data and do zero further processing before signing it (they expect the input to already be a digest), while others compress the data — typically by internally producing a digest — and sign the result. some of them support both modes of operation at the same time 🤯. so the caller is expected to know how the chosen algorithm is supposed to behave and under what conditions. do your homework bestie 📚

for example: an RSA implementation can be expected to only expect a message digest as input, while ED25519 can be expected to process the input with a hash — i.e. to produce the message digest internally. and RSA-SHA256 can be expected to handle either mode of operation, depending on whether the operation was initialized with EVP_PKEY_sign_init_ex2() or with EVP_PKEY_sign_message_init(). see how it all connects?? 🕸️

similarly, an RSA implementation usually expects you to set additional details, like the message digest algorithm that the input is supposed to be digested with, plus the padding mode (check EVP_PKEY_CTX_set_signature_md(3) and EVP_PKEY_CTX_set_rsa_padding(3) and similar others) — while an RSA-SHA256 implementation usually has these details pre-set and immutable. locked in 🔒

⚠️ big warning, bestie: the functions described here can't be used to combine separate algorithms. in particular, neither EVP_PKEY_CTX_set_signature_md(3) nor the OSSL_PARAM parameter "digest" (OSSL_SIGNATURE_PARAM_DIGEST) can be used to combine a signature algorithm with a hash algorithm to process the input. in other words, it is not possible to specify a ctx pre-loaded with an RSA pkey, or an algo that fetched "RSA", and try to specify SHA256 separately to get the functionality of RSA-SHA256. nope, not happening 💀 if combining algorithms in that manner is what you want, please use EVP_DigestSignInit(3) and its associated functions instead 🫶

🌟 Performing multiple signatures 🌟

when initialized using EVP_PKEY_sign_init_ex() or EVP_PKEY_sign_init_ex2(), EVP_PKEY_sign() can be called more than once on the same context — so you can do several one-shot operations using the same parameters. multitasking queen 👑
when initialized using EVP_PKEY_sign_message_init(), it is not possible to call EVP_PKEY_sign() multiple times. one and done, no reruns 🚫

💖 RETURN VALUES 💖

all functions return 1 for success, and 0 or a negative value for failure.

and specifically: EVP_PKEY_sign_init() and its other variants may return -2 to indicate that the operation is not supported by the public key algorithm. so if you see a -2, that's the universe telling you the algorithm said no 🚩

(part 1 done, bestie — more of this page is coming, don't go anywhere 🌸)

✨ EXAMPLES ✨

okay bestie, this is the part where it all clicks. four whole vibes of signing, all in C, all iconic 💖

🌸 RSA with PKCS#1 padding for SHA256

signing data with RSA + PKCS#1 padding, where the input is a SHA256 digest:

#include <openssl/evp.h>
#include <openssl/rsa.h>

EVP_PKEY_CTX *ctx;
/* md is a SHA-256 digest in this example. */
unsigned char *md, *sig;
size_t mdlen = 32, siglen;
EVP_PKEY *signing_key;

/*
 * NB: assumes signing_key and md are set up before the next
 * step. signing_key must be an RSA private key and md must
 * point to the SHA-256 digest to be signed.
 */
ctx = EVP_PKEY_CTX_new(signing_key, NULL /* no engine */);
if (ctx == NULL)
    /* Error occurred */
if (EVP_PKEY_sign_init(ctx) <= 0)
    /* Error */
if (EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_PADDING) <= 0)
    /* Error */
if (EVP_PKEY_CTX_set_signature_md(ctx, EVP_sha256()) <= 0)
    /* Error */

/* Determine buffer length */
if (EVP_PKEY_sign(ctx, NULL, &siglen, md, mdlen) <= 0)
    /* Error */

sig = OPENSSL_malloc(siglen);

if (sig == NULL)
    /* malloc failure */

if (EVP_PKEY_sign(ctx, sig, &siglen, md, mdlen) <= 0)
    /* Error */

/* Signature is siglen bytes written to buffer sig */

like — the two-call thing? first call with NULL is just asking "how big is this gonna be bestie", then you OPENSSL_malloc(siglen) and do it for real. that's the move 💅

🦋 RSA-SHA256 with a pre-computed digest

signing a digest with RSA-SHA256 using the one-shot functions. important thing to clock: RSA-SHA256 is assumed to be an implementation of "sha256WithRSAEncryption", for which the padding is pre-determined to be RSA_PKCS1_PADDING, and the input digest is assumed to have been computed using SHA256.

#include <openssl/evp.h>
#include <openssl/rsa.h>

EVP_PKEY_CTX *ctx;
/* md is a SHA-256 digest in this example. */
unsigned char *md, *sig;
size_t mdlen = 32, siglen;
EVP_PKEY *signing_key;

/*
 * NB: assumes signing_key and md are set up before the next
 * step. signing_key must be an RSA private key and md must
 * point to the SHA-256 digest to be signed.
 */
ctx = EVP_PKEY_CTX_new(signing_key, NULL /* no engine */);
alg = EVP_SIGNATURE_fetch(NULL, "RSA-SHA256", NULL);

if (ctx == NULL)
    /* Error occurred */
if (EVP_PKEY_sign_init_ex2(ctx, alg, NULL) <= 0)
    /* Error */

/* Determine buffer length */
if (EVP_PKEY_sign(ctx, NULL, &siglen, md, mdlen) <= 0)
    /* Error */

sig = OPENSSL_malloc(siglen);

if (sig == NULL)
    /* malloc failure */

if (EVP_PKEY_sign(ctx, sig, &siglen, md, mdlen) <= 0)
    /* Error */

/* Signature is siglen bytes written to buffer sig */

notice EVP_PKEY_sign_init_ex2(ctx, alg, NULL) is doing the heavy lifting here instead of setting padding and md by hand. no cap, it's giving effortless ✨

🎀 RSA-SHA256, one-shot

signing a document with RSA-SHA256 using the one-shot functions. and again, the note: RSA-SHA256 is assumed to be an implementation of "sha256WithRSAEncryption", for which the padding is pre-determined to be RSA_PKCS1_PADDING.

#include <openssl/evp.h>
#include <openssl/rsa.h>

EVP_PKEY_CTX *ctx;
/* in is the input in this example. */
unsigned char *in, *sig;
/* inlen is the length of the input in this example. */
size_t inlen, siglen;
EVP_PKEY *signing_key;
EVP_SIGNATURE *alg;

/*
 * NB: assumes signing_key, in and inlen are set up before
 * the next step. signing_key must be an RSA private key,
 * in must point to data to be digested and signed, and
 * inlen must be the size of the data in bytes.
 */
ctx = EVP_PKEY_CTX_new(signing_key, NULL /* no engine */);
alg = EVP_SIGNATURE_fetch(NULL, "RSA-SHA256", NULL);

if (ctx == NULL || alg == NULL)
    /* Error occurred */
if (EVP_PKEY_sign_message_init(ctx, alg, NULL) <= 0)
    /* Error */

/* Determine sig buffer length */
if (EVP_PKEY_sign(ctx, NULL, &siglen, in, inlen) <= 0)
    /* Error */

sig = OPENSSL_malloc(siglen);

if (sig == NULL)
    /* malloc failure */

if (EVP_PKEY_sign(ctx, sig, &siglen, in, inlen) <= 0)
    /* Error */

/* Signature is siglen bytes written to buffer sig */

here you're handing over the raw data (in, inlen) and letting it digest for you — main character energy fr fr 👑

💜 RSA-SHA256, using update and final

same thing as the last example, except now you get stream-like functionality. chunks on chunks 🧚

#include <openssl/evp.h>
#include <openssl/rsa.h>

EVP_PKEY_CTX *ctx;
/* in is the input in this example. */
unsigned char *in, *sig;
/* inlen is the length of the input in this example. */
size_t inlen, siglen;
EVP_PKEY *signing_key;
EVP_SIGNATURE *alg;

/*
 * NB: assumes signing_key, in and inlen are set up before
 * the next step. signing_key must be an RSA private key,
 * in must point to data to be digested and signed, and
 * inlen must be the size of the data in bytes.
 */
ctx = EVP_PKEY_CTX_new(signing_key, NULL /* no engine */);
alg = EVP_SIGNATURE_fetch(NULL, "RSA-SHA256", NULL);

if (ctx == NULL || alg == NULL)
    /* Error occurred */
if (EVP_PKEY_sign_message_init(ctx, alg, NULL) <= 0)
    /* Error */

while (inlen > 0) {
    if (EVP_PKEY_sign_message_update(ctx, in, inlen)) <= 0)
        /* Error */
    if (inlen > 256) {
        inlen -= 256;
        in += 256;
    } else {
        inlen = 0;
    }
}

/* Determine sig buffer length */
if (EVP_PKEY_sign_message_final(ctx, NULL, &siglen) <= 0)
    /* Error */

sig = OPENSSL_malloc(siglen);

if (sig == NULL)
    /* malloc failure */

if (EVP_PKEY_sign_message_final(ctx, sig, &siglen) <= 0)
    /* Error */

/* Signature is siglen bytes written to buffer sig */

so the whole flow is EVP_PKEY_sign_message_init() → a while loop of EVP_PKEY_sign_message_update() in 256-byte bites → then EVP_PKEY_sign_message_final() twice (once to sniff out siglen, once to actually write into sig). obsessed 😭

👀 SEE ALSO 👀

go read these next bestie, they're the whole friend group:

📜 HISTORY 📜

the lore drop 🫶

EVP_PKEY_sign_init() and EVP_PKEY_sign() showed up way back in OpenSSL 1.0.0.
EVP_PKEY_sign_init_ex() joined the chat in OpenSSL 3.0.
EVP_PKEY_sign_init_ex2(), EVP_PKEY_sign_message_init(), EVP_PKEY_sign_message_update() and EVP_PKEY_sign_message_final() are the new girls — added in OpenSSL 3.4.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

and that's the whole page bestie!! 💖 this one's from 3.5.9, dated 2026-09-29, filed under EVP_PKEY_SIGN(3ossl). go forth and sign responsibly, ily, slay 🌈✨

📦 where this page comes from

fedora 43: openssl-devel 1:3.5.9-1.fc43 · Apache-2.0
fedora 43: openssl-devel 1:3.5.9-1.fc43 · Apache-2.0
fedora 44: openssl-devel 1:3.5.9-1.fc44 · Apache-2.0
fedora 44: openssl-devel 1:3.5.9-1.fc44 · Apache-2.0
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash on 2026-10-14: a language model's rewrite of the original, under its terms