---
name: "libressl-EVP_PKEY_CTX_get_operation"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-EVP_PKEY_CTX_get_operation"
---

# libressl-EVP\_PKEY\_CTX\_get\_operation(3)

inspect EVP\_PKEY\_CTX objects

## NAME

**EVP\_PKEY\_CTX\_get\_operation**, **EVP\_PKEY\_CTX\_get0\_pkey** – inspect EVP\_PKEY\_CTX objects

## SYNOPSIS

Crypto Library (libcrypto, -lcrypto)

**#include \<openssl/evp.h\>**

*int*\

**EVP\_PKEY\_CTX\_get\_operation**(*EVP\_PKEY\_CTX \*ctx*);

*EVP\_PKEY* *\**\

**EVP\_PKEY\_CTX\_get0\_pkey**(*EVP\_PKEY\_CTX \*ctx*);

## DESCRIPTION

**EVP\_PKEY\_CTX\_get\_operation**() finds out which initialization function has been called on *ctx*, if any:

| | | |
| --- | --- | --- |
| return value | initialized with | e.g. for |
| EVP\_PKEY\_OP\_DECRYPT | EVP\_PKEY\_decrypt\_init(3) | RSA, SM2 |
| EVP\_PKEY\_OP\_DERIVE | EVP\_PKEY\_derive\_init(3) | HKDF |
| EVP\_PKEY\_OP\_ENCRYPT | EVP\_PKEY\_encrypt\_init(3) | RSA, SM2 |
| EVP\_PKEY\_OP\_KEYGEN | EVP\_PKEY\_keygen\_init(3) | almost all |
| EVP\_PKEY\_OP\_PARAMGEN | EVP\_PKEY\_paramgen\_init(3) | DH, DSA, EC |
| EVP\_PKEY\_OP\_SIGN | EVP\_PKEY\_sign\_init(3) | DSA,EC,RSA,SM2 |
| EVP\_PKEY\_OP\_SIGN | EVP\_DigestSignInit(3) | ED25519 |
| EVP\_PKEY\_OP\_SIGNCTX | EVP\_DigestSignInit(3) | CMAC, HMAC |
| EVP\_PKEY\_OP\_UNDEFINED | not initialized | NONE |
| EVP\_PKEY\_OP\_VERIFY | EVP\_PKEY\_verify\_init(3) | DSA,EC,RSA,SM2 |
| EVP\_PKEY\_OP\_VERIFY | EVP\_DigestVerifyInit(3) | ED25519 |
| EVP\_PKEY\_OP\_VERIFYCTX | EVP\_DigestVerifyInit(3) | no built-in |
| EVP\_PKEY\_OP\_VERIFYRECOVER | EVP\_PKEY\_verify\_recover\_init(3) | RSA |

The rightmost column of the above table shows examples of algorithms the return values can occur for. For example, if EVP\_PKEY\_base\_id(3) returns EVP\_PKEY\_HKDF, then calling **EVP\_PKEY\_CTX\_get\_operation**() on a *EVP\_PKEY\_CTX* using that key may return EVP\_PKEY\_OP\_DERIVE.

If the return value is EVP\_PKEY\_OP\_SIGNCTX or EVP\_PKEY\_OP\_VERIFYCTX, the *ctx* supports EVP\_DigestSignUpdate(3) or EVP\_DigestVerifyUpdate(3), respectively. If the return value is EVP\_PKEY\_OP\_SIGN or EVP\_PKEY\_OP\_VERIFY, if does not, and only one-shot signing or verification is supported.

The return value EVP\_PKEY\_OP\_UNDEFINED can for example occur if the *ctx* was freshly returned from EVP\_PKEY\_CTX\_new(3) or EVP\_PKEY\_CTX\_new\_id(3) and not yet initialized.

The following masks are defined as the logical OR of two or more of the above EVP\_PKEY\_OP\_\* bits:

- EVP\_PKEY\_OP\_TYPE\_CRYPT

  DECRYPT \| ENCRYPT

- EVP\_PKEY\_OP\_TYPE\_GEN

  KEYGEN \| PARAMGEN

- EVP\_PKEY\_OP\_TYPE\_NOGEN

  CRYPT \| DERIVE \| SIG

- EVP\_PKEY\_OP\_TYPE\_SIG

  SIGN \| SIGNCTX \| VERIFY \| VERIFYCTX \| VERIFYRECOVER

## RETURN VALUES

**EVP\_PKEY\_CTX\_get\_operation**() returns one of the single-bit EVP\_PKEY\_OP\_\* constants or EVP\_PKEY\_OP\_UNDEFINED if *ctx* is not initialized.

**EVP\_PKEY\_CTX\_get0\_pkey**() returns an internal pointer to the *EVP\_PKEY* object used by *ctx*, without incrementing its reference count.

## SEE ALSO

evp(3), EVP\_PKEY\_base\_id(3), EVP\_PKEY\_CTX\_ctrl(3), EVP\_PKEY\_CTX\_new(3), EVP\_PKEY\_new(3)

## HISTORY

**EVP\_PKEY\_CTX\_get\_operation**() and **EVP\_PKEY\_CTX\_get0\_pkey**() first appeared in OpenSSL 1.0.0 and have been available since OpenBSD 4.9.