Re: determining of an EVP_PKEY can do a signature.

On Tue, 2025-08-26 at 18:32 -0400, Michael Richardson wrote:
>     >> EVP_DigestSignInit() still has ENGINE* argument.  While
>     >> EVP_DigestSignInit_ex() has OSSL_LIB_CTX.  I find this
> confusing!
> 
>     > The EVP_DigestSignInit() function pre-dates the providers and
> library
>     > contexts, but it will still work with provider-based keys (with
> the
>     > default library context).
> 
>     > EVP_DigestSignInit_ex() has to be used if you need non-default
> library
>     > context.
> 
> I really would prefer that the EVP_PKEY provided the context.
> I don't see why my application/library should need to know this.
> From what I can tell from reading code, it seems like it's the MD's
> context
> that wins.

This is a misunderstanding. The concept of the OSSL library context is
inherently something that the applications or libraries should care
about as this provides the necessary separation of unrelated uses of
OpenSSL within the whole application.

Let's imagine your application wants to use OpenSSL to handle CMS
messages. You want to imply some particular settings to which providers
are loaded, what algorithms are allowed, etc. However to transport
these messages the application also uses libcurl with its own set of
constraints on OpenSSL usage and you do not want your settings for
handling the CMS to affect the libcurl operation.

For that reason we've introduced OSSL_LIB_CTX so libcurl can use one
context and the application another and they won't inadvertently affect
operation of each other.

-- 
Tomáš Mráz, Public Support and Security Manager, OpenSSL Foundation
Join the Code Protectors or support us on Github Sponsors
https://openssl-foundation.org/donate/

-- 
You received this message because you are subscribed to the Google Groups "openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-users/1654c62ac46966003aac2878563f9cf2cecfa25d.camel%40openssl.org.