EVP_PKEY_FROMDATA(3SSL)

📦

version 4.0.3 · 13 versions

💖 EVP_PKEY_FROMDATA — it's giving "build me a key from scratch" ✨

okay so bestie, welcome to the 3SSL page for EVP_PKEY_fromdata_init, EVP_PKEY_fromdata, and EVP_PKEY_fromdata_settable. these are the functions that make keys and key parameters out of raw user data. yes, YOU supply the numbers, they do the whole glow-up. no cap. 👑

✨ NAME ✨

EVP_PKEY_fromdata_init, EVP_PKEY_fromdata, EVP_PKEY_fromdata_settable — the girlies that create keys and key parameters from user data 🫶

🌸 SYNOPSIS 🌸

#include <openssl/evp.h>

int EVP_PKEY_fromdata_init(EVP_PKEY_CTX *ctx);
int EVP_PKEY_fromdata(EVP_PKEY_CTX *ctx, EVP_PKEY **ppkey, int selection,
                      OSSL_PARAM params[]);
const OSSL_PARAM *EVP_PKEY_fromdata_settable(EVP_PKEY_CTX *ctx, int selection);

💅 DESCRIPTION 💅

so basically, these functions build brand-new keys out of key data that you provide — think n, e and d for a minimal RSA keypair. you hand over the ingredients, they plate it up. iconic. 🍓

they all work with an EVP_PKEY_CTX context, and honestly you should be creating that with EVP_PKEY_CTX_new_from_name(3) or EVP_PKEY_CTX_new_id(3) — that's the vibe.

the exact key data you're allowed to pass depends on the key type, and it gets passed as an OSSL_PARAM(3) array.

EVP_PKEY_fromdata_init() — initializes a public key algorithm context so it's ready to create a key or key parameters from user data. it's the "get ready" moment ✨
EVP_PKEY_fromdata() — actually creates the structure that stores a key or key parameters, given data from params, selection, and a context that's been initialized with EVP_PKEY_fromdata_init(). the result gets written to *ppkey. selection is described down in "Selections". and the parameters you can use for various types of key are as described by the various "Common parameters" sections of the EVP_PKEY-RSA(7), EVP_PKEY-DSA(7), EVP_PKEY-DH(7), EVP_PKEY-EC(7), EVP_PKEY-ED448(7), EVP_PKEY-X25519(7), EVP_PKEY-X448(7), EVP_PKEY-ED25519(7), EVP_PKEY-ML-DSA(7) and EVP_PKEY-ML-KEM(7) pages. go read those, they ate. 💖
EVP_PKEY_fromdata_settable() — gets you a constant OSSL_PARAM(3) array that describes which parameters are settable and usable with EVP_PKEY_fromdata(). selection is described in "Selections", same as above.

heads up: parameters in the params array that aren't among the settable parameters for the given selection just get ignored. silently. like they never happened. 💀

🎀 Selections 🎀

these constants are what you drop into selection:

EVP_PKEY_KEY_PARAMETERS — only key parameters get selected.
EVP_PKEY_PUBLIC_KEY — only public key components get selected. this includes optional key parameters.
EVP_PKEY_KEYPAIR — any keypair components get selected. this includes the private key, public key and key parameters.

📝 NOTES 📝

these functions only work with key management methods coming from a provider. fr fr. nothing else. and this is the mirror function to EVP_PKEY_todata(3) — the reverse glow-up, iykyk. 🦋

also: LMS support is disabled by default at compile-time. to enable it, you gotta specify the enable-lms build configuration option.

👑 RETURN VALUES 👑

EVP_PKEY_fromdata_init() and EVP_PKEY_fromdata() return 1 for success, and 0 or a negative value for failure. and specifically — listen — a return value of -2 means the operation is not supported by the public key algorithm. so if you see a -2, it's not you, it's the algorithm. 💅

🌈 EXAMPLES 🌈

these examples are very terse, and that's on purpose — we're staying on topic, and the topic is the EVP_PKEY_fromdata() set of functions. in real applications, BIGNUMs would be handled and converted to byte arrays with BN_bn2nativepad(), but that's off topic here so we're not doing it. 🙈

🧚 Creating an RSA keypair using raw key data

#include <openssl/evp.h>

/*
 * These are extremely small to make this example simple.  A real
 * and secure application will not use such small numbers.  A real
 * and secure application is expected to use BIGNUMs, and to build
 * this array dynamically.
 */
unsigned long rsa_n = 0xbc747fc5;
unsigned long rsa_e = 0x10001;
unsigned long rsa_d = 0x7b133399;
OSSL_PARAM params[] = {
    OSSL_PARAM_ulong("n", &rsa_n),
    OSSL_PARAM_ulong("e", &rsa_e),
    OSSL_PARAM_ulong("d", &rsa_d),
    OSSL_PARAM_END
};

int main()
{
    EVP_PKEY_CTX *ctx = EVP_PKEY_CTX_new_from_name(NULL, "RSA", NULL);
    EVP_PKEY *pkey = NULL;

    if (ctx == NULL
        || EVP_PKEY_fromdata_init(ctx) <= 0
        || EVP_PKEY_fromdata(ctx, &pkey, EVP_PKEY_KEYPAIR, params) <= 0)
        exit(1);

    /* Do what you want with |pkey| */
}

💜 Creating an ECC keypair using raw key data

#include <openssl/evp.h>
#include <openssl/param_build.h>
#include <openssl/ec.h>

/*
 * Fixed data to represent the private and public key.
 */
const unsigned char priv_data[] = {
    0xb9, 0x2f, 0x3c, 0xe6, 0x2f, 0xfb, 0x45, 0x68,
    0x39, 0x96, 0xf0, 0x2a, 0xaf, 0x6c, 0xda, 0xf2,
    0x89, 0x8a, 0x27, 0xbf, 0x39, 0x9b, 0x7e, 0x54,
    0x21, 0xc2, 0xa1, 0xe5, 0x36, 0x12, 0x48, 0x5d
};
/* UNCOMPRESSED FORMAT */
const unsigned char pub_data[] = {
    POINT_CONVERSION_UNCOMPRESSED,
    0xcf, 0x20, 0xfb, 0x9a, 0x1d, 0x11, 0x6c, 0x5e,
    0x9f, 0xec, 0x38, 0x87, 0x6c, 0x1d, 0x2f, 0x58,
    0x47, 0xab, 0xa3, 0x9b, 0x79, 0x23, 0xe6, 0xeb,
    0x94, 0x6f, 0x97, 0xdb, 0xa3, 0x7d, 0xbd, 0xe5,
    0x26, 0xca, 0x07, 0x17, 0x8d, 0x26, 0x75, 0xff,
    0xcb, 0x8e, 0xb6, 0x84, 0xd0, 0x24, 0x02, 0x25,
    0x8f, 0xb9, 0x33, 0x6e, 0xcf, 0x12, 0x16, 0x2f,
    0x5c, 0xcd, 0x86, 0x71, 0xa8, 0xbf, 0x1a, 0x47
};

int main()
{
    EVP_PKEY_CTX *ctx;
    EVP_PKEY *pkey = NULL;
    BIGNUM *priv;
    OSSL_PARAM_BLD *param_bld;
    OSSL_PARAM *params = NULL;
    int exitcode = 0;

    priv = BN_bin2bn(priv_data, sizeof(priv_data), NULL);

    param_bld = OSSL_PARAM_BLD_new();
    if (priv != NULL && param_bld != NULL
        && OSSL_PARAM_BLD_push_utf8_string(param_bld, "group",
                                           "prime256v1", 0)
        && OSSL_PARAM_BLD_push_BN(param_bld, "priv", priv)
        && OSSL_PARAM_BLD_push_octet_string(param_bld, "pub",
                                            pub_data, sizeof(pub_data)))
        params = OSSL_PARAM_BLD_to_param(param_bld);

    ctx = EVP_PKEY_CTX_new_from_name(NULL, "EC", NULL);
    if (ctx == NULL
        || params == NULL
        || EVP_PKEY_fromdata_init(ctx) <= 0
        || EVP_PKEY_fromdata(ctx, &pkey, EVP_PKEY_KEYPAIR, params) <= 0) {
        exitcode = 1;
    } else {
        /* Do what you want with |pkey| */
    }

    EVP_PKEY_free(pkey);
    EVP_PKEY_CTX_free(ctx);
    OSSL_PARAM_clear_free(params);
    OSSL_PARAM_BLD_free(param_bld);
    BN_free(priv);

    exit(exitcode);
}

⭐ Finding out params for an unknown key type

#include <openssl/evp.h>
#include <openssl/core.h>

/* Program expects a key type as first argument */
int main(int argc, char *argv[])
{
    EVP_PKEY_CTX *ctx = EVP_PKEY_CTX_new_from_name(NULL, argv[1], NULL);
    const OSSL_PARAM *settable_params = NULL;

    if (ctx == NULL)
       exit(1);
   settable_params = EVP_PKEY_fromdata_settable(ctx, EVP_PKEY_KEYPAIR);
   if (settable_params == NULL)
        exit(1);

    for (; settable_params->key != NULL; settable_params++) {
        const char *datatype = NULL;

        switch (settable_params->data_type) {
        case OSSL_PARAM_INTEGER:
            datatype = "integer";
            break;
        case OSSL_PARAM_UNSIGNED_INTEGER:
            datatype = "unsigned integer";
            break;
        case OSSL_PARAM_UTF8_STRING:
            datatype = "printable string (utf-8 encoding expected)";
            break;
        case OSSL_PARAM_UTF8_PTR:
            datatype = "printable string pointer (utf-8 encoding expected)";
            break;
        case OSSL_PARAM_OCTET_STRING:
            datatype = "octet string";
            break;
        case OSSL_PARAM_OCTET_PTR:
            datatype = "octet string pointer";
            break;
        }
        printf("%s : %s ", settable_params->key, datatype);
        if (settable_params->data_size == 0)
            printf("(unlimited size)\n");
        else
            printf("(maximum size %zu)\n", settable_params->data_size);
    }
}

one more thing bestie: the descriptor OSSL_PARAM(3) that EVP_PKEY_fromdata_settable() hands back can also be used programmatically, for example with OSSL_PARAM_allocate_from_text(3). slay. 💅

📜 HISTORY 📜

these functions were added in OpenSSL 3.0.
support for ML-DSA, ML-KEM and SLH-DSA was added in OpenSSL 3.5.
support for LMS was added in OpenSSL 3.6.

🎀 COPYRIGHT 🎀

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

okay that's the whole page, bestie, you're officially educated 💖 this was version 4.0.3, dated 2026-09-29, and it lives in section 3SSL as EVP_PKEY_FROMDATA. go build a key, you absolute icon. 👑✨

📦 where this page comes from

ubuntu stonking: libssl-doc 4.0.3-1ubuntu1 · Apache-2.0
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash on 2026-11-03: a language model's rewrite of the original, under its terms