---
name: "libressl-EVP_DigestSignInit"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-EVP_DigestSignInit"
---

# libressl-EVP\_DigestSignInit(3)

EVP signing functions

## NAME

**EVP\_DigestSignInit**, **EVP\_DigestSignUpdate**, **EVP\_DigestSignFinal**, **EVP\_DigestSign** – EVP signing functions

## SYNOPSIS

Crypto Library (libcrypto, -lcrypto)

**#include \<openssl/evp.h\>**

*int*\

**EVP\_DigestSignInit**(*EVP\_MD\_CTX \*ctx*, *EVP\_PKEY\_CTX \*\*pctx*, *const EVP\_MD \*type*, *ENGINE \*engine*, *EVP\_PKEY \*pkey*);

*int*\

**EVP\_DigestSignUpdate**(*EVP\_MD\_CTX \*ctx*, *const void \*d*, *size\_t cnt*);

*int*\

**EVP\_DigestSignFinal**(*EVP\_MD\_CTX \*ctx*, *unsigned char \*sig*, *size\_t \*siglen*);

*int*\

**EVP\_DigestSign**(*EVP\_MD\_CTX \*ctx*, *unsigned char \*sigret*, *size\_t \*siglen*, *const unsigned char \*tbs*, *size\_t tbslen*);

## DESCRIPTION

The EVP signature routines are a high-level interface to digital signatures.

**EVP\_DigestSignInit**() sets up the signing context *ctx* to use the digest *type* and the private key *pkey*. Before calling this function, obtain *ctx* from EVP\_MD\_CTX\_new(3) or call EVP\_MD\_CTX\_reset(3) on it. The *engine* argument is always ignored and passing NULL is recommended.

If *pctx* is not NULL, any pointer passed in as \**pctx* is ignored and overwritten by an internal pointer to the *EVP\_PKEY\_CTX* used by the signing operation: this can be used to set alternative signing options. The returned *EVP\_PKEY\_CTX* must not be freed by the application. It is freed automatically when the *EVP\_MD\_CTX* is freed.

**EVP\_DigestSignUpdate**() hashes *cnt* bytes of data at *d* into the signature context *ctx*. This function can be called several times on the same *ctx* to include additional data. This function is currently implemented using a macro.

**EVP\_DigestSignFinal**() signs the data in *ctx* and places the signature in *sig*. If *sig* is NULL, then the maximum size of the output buffer is written to \**siglen*. If *sig* is not NULL, then before the call *siglen* should contain the length of the *sig* buffer. If the call is successful, the signature is written to *sig* and the amount of data written to *siglen*.

**EVP\_DigestSign**() signs *tbslen* bytes of data at *tbs* and places the signature in *sigret* and its length in *siglen* in a similar way to **EVP\_DigestSignFinal**(). **EVP\_DigestSign**() is a one shot operation which signs a single block of data with one function call. For algorithms that support streaming it is equivalent to calling **EVP\_DigestSignUpdate**() and **EVP\_DigestSignFinal**().

The EVP interface to digital signatures should almost always be used in preference to the low-level interfaces. This is because the code then becomes transparent to the algorithm used and much more flexible.

The call to **EVP\_DigestSignFinal**() internally finalizes a copy of the digest context. This means that **EVP\_DigestSignUpdate**() and **EVP\_DigestSignFinal**() can be called later to digest and sign additional data.

Since only a copy of the digest context is ever finalized, the context must be cleaned up after use by calling EVP\_MD\_CTX\_free(3), or a memory leak will occur.

The use of EVP\_PKEY\_size(3) with these functions is discouraged because some signature operations may have a signature length which depends on the parameters set. As a result, EVP\_PKEY\_size(3) would have to return a value which indicates the maximum possible signature for any set of parameters.

## RETURN VALUES

**EVP\_DigestSignInit**(), **EVP\_DigestSignUpdate**(), **EVP\_DigestSignFinal**(), and **EVP\_DigestSign**() return 1 for success and 0 for failure.

The error codes can be obtained from ERR\_get\_error(3).

## SEE ALSO

evp(3), EVP\_DigestInit(3), EVP\_DigestVerifyInit(3)

## HISTORY

**EVP\_DigestSignInit**(), **EVP\_DigestSignUpdate**(), and **EVP\_DigestSignFinal**() first appeared in OpenSSL 1.0.0 and have been available since OpenBSD 4.9.

**EVP\_DigestSign**() first appeared in OpenSSL 1.1.1 and has been available since OpenBSD 7.0.