EVP_PKEY_SET1_RSA(3SSL)

💅 EVP_PKEY_SET1_RSA — the OpenSSL EVP_PKEY_SET1_RSA(3SSL) page, bestie edition

okay so first things first, hi, welcome to the OpenSSL manual page EVP_PKEY_SET1_RSA(3SSL). This one is all about the EVP_PKEY assignment functions — the little crew of getters, setters and assigners that (historically) shuttle keys in and out of an EVP_PKEY. A bunch of them are deprecated in 3.0 and I'm gonna be so real with you about which ones. 🫶

---

✨ NAME ✨

EVP_PKEY_set1_RSA, EVP_PKEY_set1_DSA, EVP_PKEY_set1_DH, EVP_PKEY_set1_EC_KEY, EVP_PKEY_get1_RSA, EVP_PKEY_get1_DSA, EVP_PKEY_get1_DH, EVP_PKEY_get1_EC_KEY, EVP_PKEY_get0_RSA, EVP_PKEY_get0_DSA, EVP_PKEY_get0_DH, EVP_PKEY_get0_EC_KEY, EVP_PKEY_assign_RSA, EVP_PKEY_assign_DSA, EVP_PKEY_assign_DH, EVP_PKEY_assign_EC_KEY, EVP_PKEY_assign_POLY1305, EVP_PKEY_assign_SIPHASH, EVP_PKEY_get0_hmac, EVP_PKEY_get0_poly1305, EVP_PKEY_get0_siphash, EVP_PKEY_get0, EVP_PKEY_type, EVP_PKEY_get_id, EVP_PKEY_get_base_id, EVP_PKEY_set1_engine, EVP_PKEY_get0_engine, EVP_PKEY_id, EVP_PKEY_base_id — the EVP_PKEY assignment functions, iykyk 💫

---

🌸 SYNOPSIS 🌸

#include <openssl/evp.h>

int EVP_PKEY_get_id(const EVP_PKEY *pkey);
int EVP_PKEY_get_base_id(const EVP_PKEY *pkey);
int EVP_PKEY_type(int type);

#define EVP_PKEY_id EVP_PKEY_get_id
#define EVP_PKEY_base_id EVP_PKEY_get_base_id

sooo the next batch are all deprecated since OpenSSL 3.0, and you can hide them entirely by defining OPENSSL_API_COMPAT with a suitable version value — check openssl_user_macros(7) for that. ✨

int EVP_PKEY_set1_RSA(EVP_PKEY *pkey, RSA *key);
int EVP_PKEY_set1_DSA(EVP_PKEY *pkey, DSA *key);
int EVP_PKEY_set1_DH(EVP_PKEY *pkey, DH *key);
int EVP_PKEY_set1_EC_KEY(EVP_PKEY *pkey, EC_KEY *key);

RSA *EVP_PKEY_get1_RSA(EVP_PKEY *pkey);
DSA *EVP_PKEY_get1_DSA(EVP_PKEY *pkey);
DH *EVP_PKEY_get1_DH(EVP_PKEY *pkey);
EC_KEY *EVP_PKEY_get1_EC_KEY(EVP_PKEY *pkey);

const unsigned char *EVP_PKEY_get0_hmac(const EVP_PKEY *pkey, size_t *len);
const unsigned char *EVP_PKEY_get0_poly1305(const EVP_PKEY *pkey, size_t *len);
const unsigned char *EVP_PKEY_get0_siphash(const EVP_PKEY *pkey, size_t *len);
const RSA *EVP_PKEY_get0_RSA(const EVP_PKEY *pkey);
const DSA *EVP_PKEY_get0_DSA(const EVP_PKEY *pkey);
const DH *EVP_PKEY_get0_DH(const EVP_PKEY *pkey);
const EC_KEY *EVP_PKEY_get0_EC_KEY(const EVP_PKEY *pkey);
void *EVP_PKEY_get0(const EVP_PKEY *pkey);

int EVP_PKEY_assign_RSA(EVP_PKEY *pkey, RSA *key);
int EVP_PKEY_assign_DSA(EVP_PKEY *pkey, DSA *key);
int EVP_PKEY_assign_DH(EVP_PKEY *pkey, DH *key);
int EVP_PKEY_assign_EC_KEY(EVP_PKEY *pkey, EC_KEY *key);
int EVP_PKEY_assign_POLY1305(EVP_PKEY *pkey, ASN1_OCTET_STRING *key);
int EVP_PKEY_assign_SIPHASH(EVP_PKEY *pkey, ASN1_OCTET_STRING *key);

ENGINE *EVP_PKEY_get0_engine(const EVP_PKEY *pkey);
int EVP_PKEY_set1_engine(EVP_PKEY *pkey, ENGINE *engine);

---

🦋 DESCRIPTION 🦋

okay so let's start with the type-checkers, they're the chill ones. 🌈

EVP_PKEY_get_base_id() returns the type of pkey. Like, an RSA key will return EVP_PKEY_RSA. simple as that, no cap.

EVP_PKEY_get_id() returns the actual NID associated with pkey — but only if the pkey type isn't implemented just in a provider(7). Historically, keys using the same algorithm could use different NIDs. Example time: an RSA key could use the NIDs corresponding to the NIDs NID_rsaEncryption (equivalent to EVP_PKEY_RSA) or NID_rsa (equivalent to EVP_PKEY_RSA2). The use of alternative non-standard NIDs is now rare, so EVP_PKEY_RSA2 et al are not often seen in practice. And heads up: EVP_PKEY_get_id() returns -1 (EVP_PKEY_KEYMGMT) if the pkey is only implemented in a provider(7). 💀

EVP_PKEY_type() returns the underlying type of the NID type. For example, EVP_PKEY_type(EVP_PKEY_RSA2) will return EVP_PKEY_RSA. love that for us.

---

🎀 the set1 girlies

EVP_PKEY_set1_RSA(), EVP_PKEY_set1_DSA(), EVP_PKEY_set1_DH() and EVP_PKEY_set1_EC_KEY() set the key referenced by pkey to key.

⚠️ These functions are deprecated. Applications should instead use EVP_PKEY_fromdata(3). periodt.

---

🍓 the assign girlies

EVP_PKEY_assign_RSA(), EVP_PKEY_assign_DSA(), EVP_PKEY_assign_DH(), EVP_PKEY_assign_EC_KEY(), EVP_PKEY_assign_POLY1305() and EVP_PKEY_assign_SIPHASH() set the referenced key to key — however, these use the supplied key internally, and so key will be freed when the parent pkey is freed. 👑 (that's the whole personality of assign vs set1, bestie, write it down)

⚠️ These macros are deprecated. Applications should instead read an EVP_PKEY directly using the OSSL_DECODER APIs (see OSSL_DECODER_CTX_new_for_pkey(3)), or construct an EVP_PKEY from data using EVP_PKEY_fromdata(3).

---

🌸 the get1 girlies

EVP_PKEY_get1_RSA(), EVP_PKEY_get1_DSA(), EVP_PKEY_get1_DH() and EVP_PKEY_get1_EC_KEY() return the referenced key in pkey, or NULL if the key is not of the correct type.

The returned key must be freed after use. 📌

⚠️ These functions are deprecated. Applications should instead use the EVP_PKEY directly where possible. If access to the low level key parameters is required, then applications should use EVP_PKEY_get_params(3) and other similar functions. To write an EVP_PKEY out, use the OSSL_ENCODER APIs (see OSSL_ENCODER_CTX_new_for_pkey(3)).

---

🧚 the get0 girlies

EVP_PKEY_get0_hmac(), EVP_PKEY_get0_poly1305(), EVP_PKEY_get0_siphash(), EVP_PKEY_get0_RSA(), EVP_PKEY_get0_DSA(), EVP_PKEY_get0_DH() and EVP_PKEY_get0_EC_KEY() return the referenced key in pkey, or NULL if the key is not of the correct type.

The reference count of the returned key is not incremented, and so the key must not be freed after use. 🙈 (yes, the opposite of the get1 girlies, do not mix them up)

⚠️ These functions are deprecated. Applications should instead use the EVP_PKEY directly where possible. If access to the low level key parameters is required, then applications should use EVP_PKEY_get_params(3) and other similar functions. To write an EVP_PKEY out, use the OSSL_ENCODER APIs (see OSSL_ENCODER_CTX_new_for_pkey(3)).

EVP_PKEY_get0() returns a pointer to the legacy key, or NULL if the key is not legacy.

---

💜 the provider cache lore (this part is important, fr fr)

Note that if an EVP_PKEY was not constructed using one of the deprecated functions such as EVP_PKEY_set1_RSA(), EVP_PKEY_set1_DSA(), EVP_PKEY_set1_DH() or EVP_PKEY_set1_EC_KEY(), or via the similarly named EVP_PKEY_assign macros described above, then the internal key will be managed by a provider (see provider(7)).

In that case, the key returned by EVP_PKEY_get1_RSA(), EVP_PKEY_get1_DSA(), EVP_PKEY_get1_DH(), EVP_PKEY_get1_EC_KEY(), EVP_PKEY_get0_hmac(), EVP_PKEY_get0_poly1305(), EVP_PKEY_get0_siphash(), EVP_PKEY_get0_RSA(), EVP_PKEY_get0_DSA(), EVP_PKEY_get0_DH() or EVP_PKEY_get0_EC_KEY() will be a cached copy of the provider's key.

so like. 🫠 Subsequent updates to the provider's key will not be reflected back in the cached copy, and updates made by an application to the returned key will not be reflected back in the provider's key. it literally goes one way, it's giving read-only situationship.

And subsequent calls to EVP_PKEY_get1_RSA(), EVP_PKEY_get1_DSA(), EVP_PKEY_get1_DH() and EVP_PKEY_get1_EC_KEY() will always return the cached copy returned by the first call. same copy every time, no questions.

---

🌈 the engine girlies

EVP_PKEY_get0_engine() returns a reference to the ENGINE handling pkey.

⚠️ This function is deprecated. Applications should use providers instead of engines (see provider(7) for details).

EVP_PKEY_set1_engine() sets the ENGINE handling pkey to engine. It must be called after the key algorithm and components are set up. If engine does not include an EVP_PKEY_METHOD for pkey, an error occurs. 🚨

⚠️ This function is deprecated. Applications should use providers instead of engines (see provider(7) for details).

📜 COPYRIGHT 💖

okay bestie, legal era, but make it cute ✨

Copyright 2002-2023 The OpenSSL Project Authors. All Rights Reserved.

so the whole thing is licensed under the Apache License 2.0 (that's "the License" btw) 🎀 and like, you may not use this file except in compliance with the License — no cap, that's the vibe check you gotta pass 🙈

you can grab a copy of the License in the file LICENSE in the source distribution, or literally just go here:

https://www.openssl.org/source/license.html

that's the whole legal bit, bestie — short, sweet, and fully slaying 💅

---

and that's a wrap on EVP_PKEY_SET1_RSA(3SSL)! 🫶 this lil masterpiece is from OpenSSL 3.5.7, dated 2026-06-09 — go forth and reference-count responsibly, mwah 💋✨