Standard preamble:
========================================================================
..
.... Set up some character translations and predefined strings. \*(-- will
give an unbreakable dash, \*(PI will give pi, \*(L" will give a left
double quote, and \*(R" will give a right double quote. \*(C+ will
give a nicer C++. Capital omega is used to do unbreakable dashes and
therefore won't be available. \*(C` and \*(C' expand to `' in nroff,
nothing in troff, for use with C<>.
.tr \(*W- . ds -- \(*W- . ds PI pi . if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch . if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch . ds L" "" . ds R" "" . ds C` "" . ds C' "" 'br\} . ds -- \|\(em\| . ds PI \(*p . ds L" `` . ds R" '' . ds C` . ds C' 'br\}
Escape single quotes in literal strings from groff's Unicode transform.
If the F register is >0, we'll generate index entries on stderr for
titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
entries marked with X<> in POD. Of course, you'll have to process the
output yourself in some meaningful fashion.
Avoid warning from groff about undefined register 'F'.
.. .nr rF 0 . if \nF \{\ . de IX . tm Index:\\$1\t\\n%\t"\\$2" .. . if !\nF==2 \{\ . nr % 0 . nr F 2 . \} . \} .\} .rr rF Fear. Run. Save yourself. No user-serviceable parts.
. \" fudge factors for nroff and troff . ds #H 0 . ds #V .8m . ds #F .3m . ds #[ \f1 . ds #] .\} . ds #H ((1u-(\\\\n(.fu%2u))*.13m) . ds #V .6m . ds #F 0 . ds #[ \& . ds #] \& .\} . \" simple accents for nroff and troff . ds ' \& . ds ` \& . ds ^ \& . ds , \& . ds ~ ~ . ds / .\} . ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u" . ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u' . ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u' . ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u' . ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u' . ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u' .\} . \" troff and (daisy-wheel) nroff accents . \" corrections for vroff . \" for low resolution devices (crt and lpr) \{\ . ds : e . ds 8 ss . ds o a . ds d- d\h'-1'\(ga . ds D- D\h'-1'\(hy . ds th \o'bp' . ds Th \o'LP' . ds ae ae . ds Ae AE .\} ========================================================================
Title "EVP_PKEY_SET1_RSA 3ossl"
way too many mistakes in technical documents.
The following functions have been deprecated since OpenSSL 3.0, and can be hidden entirely by defining \s-1OPENSSL_API_COMPAT\s0 with a suitable version value, see openssl_user_macros\|(7):
.Vb 4 int EVP_PKEY_set1_RSA(EVP_PKEY *pkey, RSA *key); int EVP_PKEY_set1_DSA(EVP_PKEY *pkey, DSA *key); int EVP_PKEY_set1_DH(EVP_PKEY *pkey, DH *key); int EVP_PKEY_set1_EC_KEY(EVP_PKEY *pkey, EC_KEY *key); \& RSA *EVP_PKEY_get1_RSA(EVP_PKEY *pkey); DSA *EVP_PKEY_get1_DSA(EVP_PKEY *pkey); DH *EVP_PKEY_get1_DH(EVP_PKEY *pkey); EC_KEY *EVP_PKEY_get1_EC_KEY(EVP_PKEY *pkey); \& const unsigned char *EVP_PKEY_get0_hmac(const EVP_PKEY *pkey, size_t *len); const unsigned char *EVP_PKEY_get0_poly1305(const EVP_PKEY *pkey, size_t *len); const unsigned char *EVP_PKEY_get0_siphash(const EVP_PKEY *pkey, size_t *len); const RSA *EVP_PKEY_get0_RSA(const EVP_PKEY *pkey); const DSA *EVP_PKEY_get0_DSA(const EVP_PKEY *pkey); const DH *EVP_PKEY_get0_DH(const EVP_PKEY *pkey); const EC_KEY *EVP_PKEY_get0_EC_KEY(const EVP_PKEY *pkey); void *EVP_PKEY_get0(const EVP_PKEY *pkey); \& int EVP_PKEY_assign_RSA(EVP_PKEY *pkey, RSA *key); int EVP_PKEY_assign_DSA(EVP_PKEY *pkey, DSA *key); int EVP_PKEY_assign_DH(EVP_PKEY *pkey, DH *key); int EVP_PKEY_assign_EC_KEY(EVP_PKEY *pkey, EC_KEY *key); int EVP_PKEY_assign_POLY1305(EVP_PKEY *pkey, ASN1_OCTET_STRING *key); int EVP_PKEY_assign_SIPHASH(EVP_PKEY *pkey, ASN1_OCTET_STRING *key); \& ENGINE *EVP_PKEY_get0_engine(const EVP_PKEY *pkey); int EVP_PKEY_set1_engine(EVP_PKEY *pkey, ENGINE *engine); .Ve
\fBEVP_PKEY_get_id() returns the actual \s-1NID\s0 associated with pkey only if the pkey type isn't implemented just in a provider\|(7). Historically keys using the same algorithm could use different NIDs. For example an \s-1RSA\s0 key could use the NIDs corresponding to the NIDs NID_rsaEncryption (equivalent to \s-1EVP_PKEY_RSA\s0) or \fBNID_rsa (equivalent to \s-1EVP_PKEY_RSA2\s0). The use of alternative non-standard NIDs is now rare so \s-1EVP_PKEY_RSA2\s0 et al are not often seen in practice. \fBEVP_PKEY_get_id() returns -1 (\s-1EVP_PKEY_KEYMGMT\s0) if the pkey is only implemented in a provider\|(7).
\fBEVP_PKEY_type() returns the underlying type of the \s-1NID\s0 type. For example EVP_PKEY_type(\s-1EVP_PKEY_RSA2\s0) will return \s-1EVP_PKEY_RSA\s0.
\fBEVP_PKEY_set1_RSA(), EVP_PKEY_set1_DSA(), EVP_PKEY_set1_DH() and \fBEVP_PKEY_set1_EC_KEY() set the key referenced by pkey to key. These functions are deprecated. Applications should instead use \fBEVP_PKEY_fromdata\|(3).
\fBEVP_PKEY_assign_RSA(), EVP_PKEY_assign_DSA(), EVP_PKEY_assign_DH(), \fBEVP_PKEY_assign_EC_KEY(), EVP_PKEY_assign_POLY1305() and \fBEVP_PKEY_assign_SIPHASH() set the referenced key to key however these use the supplied key internally and so key will be freed when the parent \fIpkey is freed. These macros are deprecated. Applications should instead read an \s-1EVP_PKEY\s0 directly using the \s-1OSSL_DECODER\s0 APIs (see \fBOSSL_DECODER_CTX_new_for_pkey\|(3)), or construct an \s-1EVP_PKEY\s0 from data using \fBEVP_PKEY_fromdata\|(3).
\fBEVP_PKEY_get1_RSA(), EVP_PKEY_get1_DSA(), EVP_PKEY_get1_DH() and \fBEVP_PKEY_get1_EC_KEY() return the referenced key in pkey or \s-1NULL\s0 if the key is not of the correct type. The returned key must be freed after use. These functions are deprecated. Applications should instead use the \s-1EVP_PKEY\s0 directly where possible. If access to the low level key parameters is required then applications should use EVP_PKEY_get_params\|(3) and other similar functions. To write an \s-1EVP_PKEY\s0 out use the \s-1OSSL_ENCODER\s0 APIs (see \fBOSSL_ENCODER_CTX_new_for_pkey\|(3)).
\fBEVP_PKEY_get0_hmac(), EVP_PKEY_get0_poly1305(), EVP_PKEY_get0_siphash(), \fBEVP_PKEY_get0_RSA(), EVP_PKEY_get0_DSA(), EVP_PKEY_get0_DH() and \fBEVP_PKEY_get0_EC_KEY() return the referenced key in pkey or \s-1NULL\s0 if the key is not of the correct type. The reference count of the returned key is \fBnot incremented and so the key must not be freed after use. These functions are deprecated. Applications should instead use the \s-1EVP_PKEY\s0 directly where possible. If access to the low level key parameters is required then applications should use EVP_PKEY_get_params\|(3) and other similar functions. To write an \s-1EVP_PKEY\s0 out use the \s-1OSSL_ENCODER\s0 APIs (see \fBOSSL_ENCODER_CTX_new_for_pkey\|(3)). EVP_PKEY_get0() returns a pointer to the legacy key or \s-1NULL\s0 if the key is not legacy.
Note that if an \s-1EVP_PKEY\s0 was not constructed using one of the deprecated functions such as EVP_PKEY_set1_RSA(), EVP_PKEY_set1_DSA(), EVP_PKEY_set1_DH() or EVP_PKEY_set1_EC_KEY(), or via the similarly named EVP_PKEY_assign macros described above then the internal key will be managed by a provider (see \fBprovider\|(7)). In that case the key returned by EVP_PKEY_get1_RSA(), \fBEVP_PKEY_get1_DSA(), EVP_PKEY_get1_DH(), EVP_PKEY_get1_EC_KEY(), \fBEVP_PKEY_get0_hmac(), EVP_PKEY_get0_poly1305(), EVP_PKEY_get0_siphash(), \fBEVP_PKEY_get0_RSA(), EVP_PKEY_get0_DSA(), EVP_PKEY_get0_DH() or \fBEVP_PKEY_get0_EC_KEY() will be a cached copy of the provider's key. Subsequent updates to the provider's key will not be reflected back in the cached copy, and updates made by an application to the returned key will not be reflected back in the provider's key. Subsequent calls to EVP_PKEY_get1_RSA(), \fBEVP_PKEY_get1_DSA(), EVP_PKEY_get1_DH() and EVP_PKEY_get1_EC_KEY() will always return the cached copy returned by the first call.
\fBEVP_PKEY_get0_engine() returns a reference to the \s-1ENGINE\s0 handling pkey. This function is deprecated. Applications should use providers instead of engines (see provider\|(7) for details).
\fBEVP_PKEY_set1_engine() sets the \s-1ENGINE\s0 handling pkey to engine. It must be called after the key algorithm and components are set up. If engine does not include an \s-1EVP_PKEY_METHOD\s0 for pkey an error occurs. This function is deprecated. Applications should use providers instead of engines (see provider\|(7) for details).
\fBEVP_PKEY_get_id(), EVP_PKEY_get_base_id(), EVP_PKEY_type()
For \s-1EVP_PKEY\s0 key type checking purposes, EVP_PKEY_is_a\|(3) is more generic.
For purposes of retrieving the name of the \s-1EVP_PKEY\s0 the function \fBEVP_PKEY_get0_type_name\|(3) is more generally useful.
The keys returned from the functions EVP_PKEY_get0_RSA(), EVP_PKEY_get0_DSA(), \fBEVP_PKEY_get0_DH() and EVP_PKEY_get0_EC_KEY() were changed to have a \*(L"const\*(R" return type in OpenSSL 3.0. As described above the keys returned may be cached copies of the key held in a provider. Due to this, and unlike in earlier versions of OpenSSL, they should be considered read-only copies of the key. Updates to these keys will not be reflected back in the provider side key. The \fBEVP_PKEY_get1_RSA(), EVP_PKEY_get1_DSA(), EVP_PKEY_get1_DH() and \fBEVP_PKEY_get1_EC_KEY() functions were not changed to have a \*(L"const\*(R" return type in order that applications can \*(L"free\*(R" the return value. However applications should still consider them as read-only copies.
\fBEVP_PKEY_assign_RSA(), EVP_PKEY_assign_DSA(), EVP_PKEY_assign_DH(), \fBEVP_PKEY_assign_EC_KEY(), EVP_PKEY_assign_POLY1305() and EVP_PKEY_assign_SIPHASH() are implemented as macros.
\fBEVP_PKEY_assign_EC_KEY() looks at the curve name id to determine if the passed \s-1EC_KEY\s0 is an \s-1SM2\s0\|(7) key, and will set the \s-1EVP_PKEY\s0 type to \s-1EVP_PKEY_SM2\s0 in that case, instead of \s-1EVP_PKEY_EC\s0.
Most applications wishing to know a key type will simply call \fBEVP_PKEY_get_base_id() and will not care about the actual type: which will be identical in almost all cases.
Previous versions of this document suggested using EVP_PKEY_type(pkey->type) to determine the type of a key. Since \s-1EVP_PKEY\s0 is now opaque this is no longer possible: the equivalent is EVP_PKEY_get_base_id(pkey).
\fBEVP_PKEY_set1_engine() is typically used by an \s-1ENGINE\s0 returning an \s-1HSM\s0 key as part of its routine to load a private key.
\fBEVP_PKEY_get1_RSA(), EVP_PKEY_get1_DSA(), EVP_PKEY_get1_DH() and \fBEVP_PKEY_get1_EC_KEY() return the referenced key or \s-1NULL\s0 if an error occurred.
\fBEVP_PKEY_assign_RSA(), EVP_PKEY_assign_DSA(), EVP_PKEY_assign_DH(), \fBEVP_PKEY_assign_EC_KEY(), EVP_PKEY_assign_POLY1305() and EVP_PKEY_assign_SIPHASH() return 1 for success and 0 for failure.
\fBEVP_PKEY_get_base_id(), EVP_PKEY_get_id() and EVP_PKEY_type() return a key type or NID_undef (equivalently \s-1EVP_PKEY_NONE\s0) on error.
\fBEVP_PKEY_set1_engine() returns 1 for success and 0 for failure.
EVP_PKEY_set1_RSA, EVP_PKEY_set1_DSA, EVP_PKEY_set1_DH, EVP_PKEY_set1_EC_KEY, EVP_PKEY_get1_RSA, EVP_PKEY_get1_DSA, EVP_PKEY_get1_DH, EVP_PKEY_get1_EC_KEY, EVP_PKEY_get0_RSA, EVP_PKEY_get0_DSA, EVP_PKEY_get0_DH, EVP_PKEY_get0_EC_KEY, EVP_PKEY_assign_RSA, EVP_PKEY_assign_DSA, EVP_PKEY_assign_DH, EVP_PKEY_assign_EC_KEY, EVP_PKEY_assign_POLY1305, EVP_PKEY_assign_SIPHASH, EVP_PKEY_get0_hmac, EVP_PKEY_get0_poly1305, EVP_PKEY_get0_siphash, EVP_PKEY_set1_engine and EVP_PKEY_get0_engine were deprecated in OpenSSL 3.0.
The return value from EVP_PKEY_get0_RSA, EVP_PKEY_get0_DSA, EVP_PKEY_get0_DH, EVP_PKEY_get0_EC_KEY were made const in OpenSSL 3.0.
The function EVP_PKEY_set_alias_type() was previously documented on this page. It was removed in OpenSSL 3.0.
Licensed under the Apache License 2.0 (the \*(L"License\*(R"). You may not use this file except in compliance with the License. You can obtain a copy in the file \s-1LICENSE\s0 in the source distribution or at <https://www.openssl.org/source/license.html>.