RAND_GET0_PRIMARY(3ossl)

💖 RAND_GET0_PRIMARY 💖

okay so bestie, we're in the OpenSSL manual, and today's episode is all about RAND_get0_primary(3ossl) and its little friend group. grab a boba, we're getting into the global EVP_RAND_CTX instances 🫶

---

✨ NAME ✨

RAND_get0_primary, RAND_get0_public, RAND_get0_private, RAND_set0_public, RAND_set0_private — the way you get access to the global EVP_RAND_CTX instances 💅

---

🌸 SYNOPSIS 🌸

#include <openssl/rand.h>

EVP_RAND_CTX *RAND_get0_primary(OSSL_LIB_CTX *ctx);
EVP_RAND_CTX *RAND_get0_public(OSSL_LIB_CTX *ctx);
EVP_RAND_CTX *RAND_get0_private(OSSL_LIB_CTX *ctx);
int RAND_set0_public(OSSL_LIB_CTX *ctx, EVP_RAND_CTX *rand);
int RAND_set0_private(OSSL_LIB_CTX *ctx, EVP_RAND_CTX *rand);

---

🦋 DESCRIPTION 🦋

so the default RAND API implementation — that's RAND_OpenSSL() if you're keeping track — runs on three shared DRBG instances, and you reach all of them through the RAND API. periodt.

Here's the squad breakdown:

• the public and private DRBG are thread-local instances, and they're what RAND_bytes() and RAND_priv_bytes() respectively pull from.
• the primary DRBG is a global instance, and lowkey it's not meant to be used directly by you — it's the backstage queen that internally reseeds the other two. main character energy, but offstage.

The three get functions hand you access to those shared DRBG instances. the two set functions let you swap out the public and private DRBG instances for another random number generator entirely. slay.

---

👑 RETURN VALUES 👑

• RAND_get0_primary() — returns a pointer to the primary DRBG instance for the given OSSL_LIB_CTX ctx.
• RAND_get0_public() — returns a pointer to the public DRBG instance for the given OSSL_LIB_CTX ctx.
• RAND_get0_private() — returns a pointer to the private DRBG instance for the given OSSL_LIB_CTX ctx.
• RAND_set0_public() and RAND_set0_private() — return 1 on success and 0 on error. classic.

---

💀 NOTES 💀

okay listen. it is not thread-safe to access the primary DRBG instance. do not do it. i'm serious. 😭

The public and private DRBG instances can be accessed safely, because they're thread-local — but heads up, changes to those two instances only apply to the current thread. that's the catch, bestie.

Because of that, it's recommended that you don't change the settings of these three instances directly. instead, an application should change the default settings for new DRBG instances at initialization time, before creating additional threads. timing is everything fr fr.

During initialization, you can change the reseed interval and the reseed time interval. you can also exchange the reseeding callbacks entirely — full glow-up, no notes.

To set the type of DRBG that will be instantiated, use the RAND_set_DRBG_type(3) call before accessing the random number generation infrastructure. before, bestie. before. 🎀

The two set functions operate on the current thread. so if you want the same random number generator across all threads, each thread has to individually call the set functions. no shortcuts, everyone pulls their own weight. 💅

---

🌈 SEE ALSO 🌈

• EVP_RAND(3)
• RAND_set_DRBG_type(3)

---

⭐ HISTORY ⭐

• RAND_set0_public() and RAND_set0_private() were added in OpenSSL 3.1.
• The remaining functions were added in OpenSSL 3.0.

---

🎀 COPYRIGHT 🎀

Copyright 2020-2024 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

and that's the whole page, bestie 🫶 this was OpenSSL 3.5.9, dated 2026-09-29, filed under RAND_GET0_PRIMARY(3ossl) — go forth and reseed responsibly 💖✨