EVP_PKEY_CTX_GET_OPERATION(3) | Library Functions Manual | EVP_PKEY_CTX_GET_OPERATION(3)

# NAME

`EVP_PKEY_CTX_get_operation`, `EVP_PKEY_CTX_get0_pkey` — inspect EVP_PKEY_CTX objects

# SYNOPSIS

library “libcrypto”
`#include <openssl/evp.h>`

int
`EVP_PKEY_CTX_get_operation`(EVP_PKEY_CTX *ctx);

EVP_PKEY *
`EVP_PKEY_CTX_get0_pkey`(EVP_PKEY_CTX *ctx);

# DESCRIPTION

`EVP_PKEY_CTX_get_operation`() finds out which initialization function has been called on ctx, if any:

return value | initialized with | e.g. for
`EVP_PKEY_OP_DECRYPT` | EVP_PKEY_decrypt_init(3) | RSA, SM2
`EVP_PKEY_OP_DERIVE` | EVP_PKEY_derive_init(3) | HKDF
`EVP_PKEY_OP_ENCRYPT` | EVP_PKEY_encrypt_init(3) | RSA, SM2
`EVP_PKEY_OP_KEYGEN` | EVP_PKEY_keygen_init(3) | almost all
`EVP_PKEY_OP_PARAMGEN` | EVP_PKEY_paramgen_init(3) | DH, DSA, EC
`EVP_PKEY_OP_SIGN` | EVP_PKEY_sign_init(3) | DSA,EC,RSA,SM2
`EVP_PKEY_OP_SIGN` | EVP_DigestSignInit(3) | ED25519
`EVP_PKEY_OP_SIGNCTX` | EVP_DigestSignInit(3) | CMAC, HMAC
`EVP_PKEY_OP_UNDEFINED` | not initialized | NONE
`EVP_PKEY_OP_VERIFY` | EVP_PKEY_verify_init(3) | DSA,EC,RSA,SM2
`EVP_PKEY_OP_VERIFY` | EVP_DigestVerifyInit(3) | ED25519
`EVP_PKEY_OP_VERIFYCTX` | EVP_DigestVerifyInit(3) | no built-in
`EVP_PKEY_OP_VERIFYRECOVER` | EVP_PKEY_verify_recover_init(3) | RSA

The rightmost column of the above table shows examples of algorithms the return values can occur for. For example, if EVP_PKEY_base_id(3) returns `EVP_PKEY_HKDF`, then calling `EVP_PKEY_CTX_get_operation`() on a EVP_PKEY_CTX using that key may return `EVP_PKEY_OP_DERIVE`.

If the return value is `EVP_PKEY_OP_SIGNCTX` or `EVP_PKEY_OP_VERIFYCTX`, the ctx supports EVP_DigestSignUpdate(3) or EVP_DigestVerifyUpdate(3), respectively. If the return value is `EVP_PKEY_OP_SIGN` or `EVP_PKEY_OP_VERIFY`, if does not, and only one-shot signing or verification is supported.

The return value `EVP_PKEY_OP_UNDEFINED` can for example occur if the ctx was freshly returned from EVP_PKEY_CTX_new(3) or EVP_PKEY_CTX_new_id(3) and not yet initialized.

The following masks are defined as the logical OR of two or more of the above `EVP_PKEY_OP_*` bits:

`EVP_PKEY_OP_TYPE_CRYPT`
  DECRYPT | ENCRYPT
`EVP_PKEY_OP_TYPE_GEN`
  KEYGEN | PARAMGEN
`EVP_PKEY_OP_TYPE_NOGEN`
  CRYPT | DERIVE | SIG
`EVP_PKEY_OP_TYPE_SIG`
  SIGN | SIGNCTX | VERIFY | VERIFYCTX | VERIFYRECOVER

# RETURN VALUES

`EVP_PKEY_CTX_get_operation`() returns one of the single-bit `EVP_PKEY_OP_*` constants or `EVP_PKEY_OP_UNDEFINED` if ctx is not initialized.

`EVP_PKEY_CTX_get0_pkey`() returns an internal pointer to the EVP_PKEY object used by ctx, without incrementing its reference count.

# SEE ALSO

evp(3), EVP_PKEY_base_id(3), EVP_PKEY_CTX_ctrl(3), EVP_PKEY_CTX_new(3), EVP_PKEY_new(3)

# HISTORY

`EVP_PKEY_CTX_get_operation`() and `EVP_PKEY_CTX_get0_pkey`() first appeared in OpenSSL 1.0.0 and have been available since OpenBSD 4.9.

June 8, 2025 | Debian