EVP_PKEY_CTX_GET_OPERATION(3ssl)

💖 NAME 💖

okay bestie, this is the EVP_PKEY_CTX_get_operation(3) page from the Library Functions Manual — and it's lowkey all about inspecting EVP_PKEY_CTX objects. The main characters are EVP_PKEY_CTX_get_operation and EVP_PKEY_CTX_get0_pkey. periodt 💅

---

✨ SYNOPSIS ✨

#include <openssl/evp.h>

int
EVP_PKEY_CTX_get_operation(EVP_PKEY_CTX *ctx);

EVP_PKEY *
EVP_PKEY_CTX_get0_pkey(EVP_PKEY_CTX *ctx);

---

🦋 DESCRIPTION 🦋

So EVP_PKEY_CTX_get_operation() literally finds out which initialization function has been called on ctx, if any. It's giving "vibe check for your context" energy. Here's the iconic little mapping, same facts, no cap:

• EVP_PKEY_OP_DECRYPT — initialized with EVP_PKEY_decrypt_init(3); e.g. for RSA, SM2
• EVP_PKEY_OP_DERIVE — initialized with EVP_PKEY_derive_init(3); e.g. for HKDF
• EVP_PKEY_OP_ENCRYPT — initialized with EVP_PKEY_encrypt_init(3); e.g. for RSA, SM2
• EVP_PKEY_OP_KEYGEN — initialized with EVP_PKEY_keygen_init(3); e.g. for almost all
• EVP_PKEY_OP_PARAMGEN — initialized with EVP_PKEY_paramgen_init(3); e.g. for DH, DSA, EC
• EVP_PKEY_OP_SIGN — initialized with EVP_PKEY_sign_init(3); e.g. for DSA,EC,RSA,SM2
• EVP_PKEY_OP_SIGN — initialized with EVP_DigestSignInit(3); e.g. for ED25519
• EVP_PKEY_OP_SIGNCTX — initialized with EVP_DigestSignInit(3); e.g. for CMAC, HMAC
• EVP_PKEY_OP_UNDEFINED — not initialized; e.g. for NONE
• EVP_PKEY_OP_VERIFY — initialized with EVP_PKEY_verify_init(3); e.g. for DSA,EC,RSA,SM2
• EVP_PKEY_OP_VERIFY — initialized with EVP_DigestVerifyInit(3); e.g. for ED25519
• EVP_PKEY_OP_VERIFYCTX — initialized with EVP_DigestVerifyInit(3); e.g. for no built-in
• EVP_PKEY_OP_VERIFYRECOVER — initialized with EVP_PKEY_verify_recover_init(3); e.g. for RSA

That rightmost column is just showing examples of algorithms the return values can occur for. So for example, if EVP_PKEY_base_id(3) returns EVP_PKEY_HKDF, then calling EVP_PKEY_CTX_get_operation() on a EVP_PKEY_CTX using that key may return EVP_PKEY_OP_DERIVE. iykyk 💜

If the return value is EVP_PKEY_OP_SIGNCTX or EVP_PKEY_OP_VERIFYCTX, the ctx supports EVP_DigestSignUpdate(3) or EVP_DigestVerifyUpdate(3), respectively. If the return value is EVP_PKEY_OP_SIGN or EVP_PKEY_OP_VERIFY, it does not, and only one-shot signing or verification is supported. not me double-checking that distinction but yes bestie, it matters 😭

The return value EVP_PKEY_OP_UNDEFINED can for example occur if the ctx was freshly returned from EVP_PKEY_CTX_new(3) or EVP_PKEY_CTX_new_id(3) and not yet initialized. fresh-out-the-box energy, but make it undefined ✨

The following masks are defined as the logical OR of two or more of the above EVP_PKEY_OP_* bits:

• EVP_PKEY_OP_TYPE_CRYPT — DECRYPT | ENCRYPT
• EVP_PKEY_OP_TYPE_GEN — KEYGEN | PARAMGEN
• EVP_PKEY_OP_TYPE_NOGEN — CRYPT | DERIVE | SIG
• EVP_PKEY_OP_TYPE_SIG — SIGN | SIGNCTX | VERIFY | VERIFYCTX | VERIFYRECOVER

---

🌈 RETURN VALUES 🌈

EVP_PKEY_CTX_get_operation() returns one of the single-bit EVP_PKEY_OP_* constants or EVP_PKEY_OP_UNDEFINED if ctx is not initialized. simple as that, no drama 🎀

EVP_PKEY_CTX_get0_pkey() returns an internal pointer to the EVP_PKEY object used by ctx, without incrementing its reference count. like borrowing your bestie's charger — you get access, but you don't get to claim it's yours 🔥

---

🧚 SEE ALSO 🧚

• evp(3)
• EVP_PKEY_base_id(3)
• EVP_PKEY_CTX_ctrl(3)
• EVP_PKEY_CTX_new(3)
• EVP_PKEY_new(3)

---

👑 HISTORY 👑

EVP_PKEY_CTX_get_operation() and EVP_PKEY_CTX_get0_pkey() first appeared in OpenSSL 1.0.0 and have been available since OpenBSD 4.9. vintage but still iconic, fr fr ⭐

---

this cutie page is from Debian, dated September 12, 2023, and the footer calls it EVP_PKEY_CTX_GET_OPERATION(3). byeee bestie, go inspect those contexts responsibly 💅🫶