---
name: "libressl-EVP_DigestVerifyInit"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-EVP_DigestVerifyInit"
---

# libressl-EVP\_DigestVerifyInit(3)

EVP signature verification functions

## NAME

**EVP\_DigestVerifyInit**, **EVP\_DigestVerifyUpdate**, **EVP\_DigestVerifyFinal**, **EVP\_DigestVerify** – EVP signature verification functions

## SYNOPSIS

Crypto Library (libcrypto, -lcrypto)

**#include \<openssl/evp.h\>**

*int*\

**EVP\_DigestVerifyInit**(*EVP\_MD\_CTX \*ctx*, *EVP\_PKEY\_CTX \*\*pctx*, *const EVP\_MD \*type*, *ENGINE \*engine*, *EVP\_PKEY \*pkey*);

*int*\

**EVP\_DigestVerifyUpdate**(*EVP\_MD\_CTX \*ctx*, *const void \*d*, *size\_t cnt*);

*int*\

**EVP\_DigestVerifyFinal**(*EVP\_MD\_CTX \*ctx*, *const unsigned char \*sig*, *size\_t siglen*);

*int*\

**EVP\_DigestVerify**(*EVP\_MD\_CTX \*ctx*, *const unsigned char \*sig*, *size\_t siglen*, *const unsigned char \*tbs*, *size\_t \*tbslen*);

## DESCRIPTION

The EVP signature routines are a high-level interface to digital signatures.

**EVP\_DigestVerifyInit**() sets up the verification context *ctx* to use the digest *type* and the public key *pkey*. Before calling this function, obtain *ctx* from EVP\_MD\_CTX\_new(3) or call EVP\_MD\_CTX\_reset(3) on it. The *engine* argument is always ignored and passing NULL is recommended.

If *pctx* is not NULL, any pointer passed in as \**pctx* is ignored and overwritten by an internal pointer to the *EVP\_PKEY\_CTX* used by the verification operation: this can be used to set alternative signing options. The returned *EVP\_PKEY\_CTX* must not be freed by the application. It is freed automatically when the *EVP\_MD\_CTX* is freed.

**EVP\_DigestVerifyUpdate**() hashes *cnt* bytes of data at *d* into the verification context *ctx*. This function can be called several times on the same *ctx* to include additional data. This function is currently implemented using a macro.

**EVP\_DigestVerifyFinal**() verifies the data in *ctx* against the signature in *sig* of length *siglen*.

**EVP\_DigestVerify**() verifies *tbslen* bytes at *tbs* against the signature in *sig* of length *siglen*. **EVP\_DigestVerify**() is a one shot operation which verifies a single block of data in one function call. For algorithms that support streaming it is equivalent to calling **EVP\_DigestVerifyUpdate**() and **EVP\_DigestVerifyFinal**().

The EVP interface to digital signatures should almost always be used in preference to the low-level interfaces. This is because the code then becomes transparent to the algorithm used and much more flexible.

The call to **EVP\_DigestVerifyFinal**() internally finalizes a copy of the digest context. This means that EVP\_VerifyUpdate(3) and EVP\_VerifyFinal(3) can be called later to digest and verify additional data.

Since only a copy of the digest context is ever finalized, the context must be cleaned up after use by calling EVP\_MD\_CTX\_free(3) or a memory leak will occur.

## RETURN VALUES

**EVP\_DigestVerifyInit**() and **EVP\_DigestVerifyUpdate**() return 1 for success and 0 for failure.

**EVP\_DigestVerifyFinal**() and **EVP\_DigestVerify**() return 1 for success; any other value indicates failure. A return value of 0 indicates that the signature did not verify successfully (that is, the signature did not match the original data or the signature had an invalid form), while other values indicate a more serious error (and sometimes also indicate an invalid signature form).

The error codes can be obtained from ERR\_get\_error(3).

## SEE ALSO

evp(3), EVP\_DigestInit(3), EVP\_DigestSignInit(3)

## HISTORY

**EVP\_DigestVerifyInit**(), **EVP\_DigestVerifyUpdate**(), and **EVP\_DigestVerifyFinal**() first appeared in OpenSSL 1.0.0 and have been available since OpenBSD 4.9.

**EVP\_DigestVerify**() first appeared in OpenSSL 1.1.1 and has been available since OpenBSD 7.0.