EVP_PKEY_CHECK(3SSL)

📦
version 4.0.3 · 13 versions
, in ubuntu stonking

💖 EVP_PKEY_CHECK 💖 — the key & parameter validation girlies (3SSL, from OpenSSL)

okay so bestie, welcome to the manual page for EVP_PKEY_check and her six gorgeous sisters 💅 this is EVP_PKEY_CHECK(3SSL) from the OpenSSL fam, and we're about to do a whole vibe check on your keys. literally. 🔥

✨ NAME ✨

EVP_PKEY_check, EVP_PKEY_param_check, EVP_PKEY_param_check_quick, EVP_PKEY_public_check, EVP_PKEY_public_check_quick, EVP_PKEY_private_check, EVP_PKEY_pairwise_check — the key and parameter validation functions 🎀

✨ SYNOPSIS ✨

#include <openssl/evp.h>

int EVP_PKEY_check(EVP_PKEY_CTX *ctx);
int EVP_PKEY_param_check(EVP_PKEY_CTX *ctx);
int EVP_PKEY_param_check_quick(EVP_PKEY_CTX *ctx);
int EVP_PKEY_public_check(EVP_PKEY_CTX *ctx);
int EVP_PKEY_public_check_quick(EVP_PKEY_CTX *ctx);
int EVP_PKEY_private_check(EVP_PKEY_CTX *ctx);
int EVP_PKEY_pairwise_check(EVP_PKEY_CTX *ctx);

seven functions. one context pointer. it's giving family reunion 🫶

✨ DESCRIPTION ✨

okay so let's go one by one, bestie, because each of these is checking a different little piece of your key and you gotta know which is which 💖

  • EVP_PKEY_param_check() — this one validates the parameters component of the key that ctx is holding. and here's the cute part: for key types that don't even have parameters, this check will always succeed. no params, no problem. ✨
  • EVP_PKEY_param_check_quick() — does the same thing as EVP_PKEY_param_check() does to the parameters component of the key in ctx, BUT. some algorithm implementations may offer a quicker form of validation that straight up omits some checks, just to do a lightweight sanity check of the key. and if a quicker form isn't provided? then this call just does the exact same thing as EVP_PKEY_param_check(). no drama 😌
  • EVP_PKEY_public_check() — validates the public component of the key given by ctx. that's it, that's the tweet 💅
  • EVP_PKEY_public_check_quick() — same deal as EVP_PKEY_public_check() but for the public component, and again: some algorithm implementations may offer a quicker form of validation that omits some checks so it can do a lightweight sanity check of the key. and if no quicker form is provided, this function call does the same thing as EVP_PKEY_public_check(). periodt.
  • EVP_PKEY_private_check() — validates the private component of the key given by ctx. secret girl check-in 🙈
  • EVP_PKEY_pairwise_check() — this one is the shipper of the group 💞 it validates that the public and private components have the correct mathematical relationship to each other for the key given by ctx. are they actually meant for each other? this function will tell you.
  • EVP_PKEY_check() — plot twist, she's just an alias for the EVP_PKEY_pairwise_check() function. iconic behaviour honestly.

📝 NOTES 📝

okay this part is the serious part, bestie, so put your phone down for a sec 🎀

Key validation used by the OpenSSL FIPS provider complies with the rules within SP800-56A and SP800-56B. But for backwards compatibility reasons, the OpenSSL default provider may use checks that are not as restrictive for certain key types. for the whole tea on that, go read "DSA key validation" in EVP_PKEY-DSA(7), "DH key validation" in EVP_PKEY-DH(7), "EC key validation" in EVP_PKEY-EC(7) and "RSA key validation" in EVP_PKEY-RSA(7).

Refer to SP800-56A and SP800-56B for the rules relating to when these functions should be called during key establishment. and listen: it is not necessary to call these functions after locally calling an approved key generation method, but it may be required for assurance purposes when receiving keys from a third party. iykyk 🌸

⚠️ heads up bestie — EVP_PKEY_pairwise_check() and EVP_PKEY_private_check() might not be bounded by any key size limits, because private keys are not expected to be supplied by attackers. for that reason, they might take an unbounded time if run on arbitrarily large keys. not a drill. 💀

✨ RETURN VALUES ✨

All functions return 1 for success, or others for failure. And they return -2 if the operation is not supported for the specific algorithm. so like: 1 = slay, -2 = this algorithm said "not my problem" 😭, everything else = not slay.

👀 SEE ALSO 👀

EVP_PKEY_CTX_new(3), EVP_PKEY_fromdata(3), EVP_PKEY-DH(7), EVP_PKEY-FFC(7), EVP_PKEY-DSA(7), EVP_PKEY-EC(7), EVP_PKEY-RSA(7)

go read those too, they're all besties in the same lore 🌈

🦋 HISTORY 🦋

  • EVP_PKEY_check(), EVP_PKEY_public_check() and EVP_PKEY_param_check() were added in OpenSSL 1.1.1.
  • EVP_PKEY_param_check_quick(), EVP_PKEY_public_check_quick(), EVP_PKEY_private_check() and EVP_PKEY_pairwise_check() were added in OpenSSL 3.0.

glow-up timeline fr fr ⭐

Copyright 2006-2024 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

and that's the whole page, bestie!! 🎀 this was 4.0.3, dated 2026-09-29, from the OpenSSL girlies — mwah, go validate some keys responsibly 💖✨🫶

📦 where this page comes from