Re: determining of an EVP_PKEY can do a signature.

On Fri, Aug 22, 2025 at 05:07:29PM -0400, Michael Richardson wrote:

> Looking for man pages, and then evp.h, and store.h, to try to learn if there
> is a way to understand if an EVP_PKEY has a private key associated with it.
> I found nothing, but I could perhaps see if it was loaded via a provider, but
> I think that a truism now, because the default provider is still a provider.

The question of whether the algorithm of given key's type supports
creating and verifying signatures is answered by EVP_PKEY_can_sign(3):

    EVP_PKEY_can_sign() checks if the functionality for the key type of
    *pkey* supports signing. No other check is done, such as whether *pkey*
    contains a private key.

But it should be noted that this will return true regardless of whether
the key handle has any of, either or both a private and public
component, so you are expected to already know whether what you have is
or is not a private key.  Whatever method you used to construct the key
would typically have implied or revealed the key type.

There should perhaps be a public API around the internal
evp_pkey_util_has() function:

    crypto/evp/keymgmt_lib.c:int evp_keymgmt_util_has(EVP_PKEY *pk, int selection)
    crypto/evp/keymgmt_lib.c-{
    crypto/evp/keymgmt_lib.c-    /* Check if key is even assigned */
    crypto/evp/keymgmt_lib.c-    if (pk->keymgmt == NULL)
    crypto/evp/keymgmt_lib.c-        return 0;
    crypto/evp/keymgmt_lib.c-
    crypto/evp/keymgmt_lib.c:    return evp_keymgmt_has(pk->keymgmt, pk->keydata, selection);
    crypto/evp/keymgmt_lib.c-}

-- 
    Viktor.  🇺🇦 Слава Україні!

-- 
You received this message because you are subscribed to the Google Groups "openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-users/aKwg3fD5M6-HKa5b%40chardros.imrryr.org.