BN_CTX_NEW(3SSL)

💖 BN_CTX_NEW 💖 — the 3SSL girlies know

okay so bestie, picture this: it's OpenSSL, it's the 3SSL manual section, and we're talking about the little scratchpad that keeps your big numbers from being dramatic. let's get into it, no cap. ✨

---

✨ NAME ✨

BN_CTX_new_ex, BN_CTX_new, BN_CTX_secure_new_ex, BN_CTX_secure_new, BN_CTX_free — bestie these are literally the allocate-and-free girlies for BN_CTX structures 🫶

---

🌸 SYNOPSIS 🌸

#include <openssl/bn.h>

BN_CTX *BN_CTX_new_ex(OSSL_LIB_CTX *ctx);
BN_CTX *BN_CTX_new(void);

BN_CTX *BN_CTX_secure_new_ex(OSSL_LIB_CTX *ctx);
BN_CTX *BN_CTX_secure_new(void);

void BN_CTX_free(BN_CTX *c);

there they are. iconic lineup honestly. 💅

---

🦋 DESCRIPTION 🦋

so like. a BN_CTX is a structure that literally just holds BIGNUM temporary variables that library functions borrow. why? because dynamic memory allocation to create BIGNUMs is rather expensive when you're doing it over and over alongside repeated subroutine calls. it's giving "stop re-buying the same iced coffee every single time," and so the BN_CTX structure exists. it's the reusable cup. 🌈

the new() girlies

BN_CTX_new_ex() allocates and initializes a BN_CTX structure for the given library context ctx. the ctx value may be NULL, in which case the default library context will be used — no biggie, she'll pick for you. and BN_CTX_new() is, like, the exact same as BN_CTX_new_ex() except the default library context is always used. same vibe, fewer choices. ✨

the secure_new() girlies 🔒

BN_CTX_secure_new_ex() allocates and initializes a BN_CTX structure too — but she uses the secure heap (see CRYPTO_secure_malloc(3)) to hold the BIGNUMs, for the given library context ctx. the ctx value may be NULL, in which case the default library context will be used. and BN_CTX_secure_new() is the same as BN_CTX_secure_new_ex() except that the default library context is always used. secure girlie behavior, we love. 👑

the free() girlie

BN_CTX_free() frees the components of the BN_CTX and the structure itself. periodt.

and here's the part you cannot skip: since BN_CTX_start() is required in order to obtain BIGNUMs from the BN_CTX, in most cases BN_CTX_end() must be called before the BN_CTX may be freed by BN_CTX_free(). so like. close the tab before you close the browser, bestie. 😭 if c is NULL, nothing is done — she's unbothered, she simply does nothing.

⚠️ a given BN_CTX must only be used by a single thread of execution. no locking is performed, and the internal pool allocator will not properly handle multiple threads of execution. that's not me being dramatic, that is literally what the page says. do not share your BN_CTX with the group chat. 💀

---

⭐ RETURN VALUES ⭐

BN_CTX_new() and BN_CTX_secure_new() return a pointer to the BN_CTX. if the allocation fails, they return NULL and set an error code that you can get via ERR_get_error(3). so if you get NULL, go read the error, don't just sit there. 🎀

BN_CTX_free() has no return values. she gives nothing back and that's valid. 💅

---

💀 REMOVED FUNCTIONALITY 💀

void BN_CTX_init(BN_CTX *c);

BN_CTX_init() is no longer available as of OpenSSL 1.1.0. gone. retired. she left the group chat. 🙈 applications should replace use of BN_CTX_init with BN_CTX_new instead:

BN_CTX *ctx;
ctx = BN_CTX_new();
if (!ctx)
    /* error */
...
BN_CTX_free(ctx);

literally just do that instead. slay. ✨

---

🧚 SEE ALSO 🧚

ERR_get_error(3), BN_add(3), BN_CTX_start(3)

---

📜 HISTORY 📜

BN_CTX_init() was removed in OpenSSL 1.1.0.

---

💜 COPYRIGHT 💜

Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

and that's the whole page bestie!! this was BN_CTX_NEW(3SSL) from 4.0.3, dated 2026-09-29 — go free your contexts and hydrate. 💖🌸🫶