BIO_F_CIPHER(3ossl)

💖 BIO_F_CIPHER(3ossl) — the cipher BIO filter, explained 💖

okay so bestie, this is the 3ossl manual page for BIO_f_cipher, BIO_set_cipher, BIO_get_cipher_status and BIO_get_cipher_ctx, and honestly? it's giving "small API, big responsibilities." let's get into it 🎀

---

✨ NAME ✨

BIO_f_cipher, BIO_set_cipher, BIO_get_cipher_status, BIO_get_cipher_ctx — literally the cipher BIO filter, the whole icon, the main character 🫶

🌸 SYNOPSIS 🌸

#include <openssl/bio.h>
#include <openssl/evp.h>

const BIO_METHOD *BIO_f_cipher(void);
int BIO_set_cipher(BIO *b, const EVP_CIPHER *cipher,
                   const unsigned char *key, const unsigned char *iv, int enc);
int BIO_get_cipher_status(BIO *b);
int BIO_get_cipher_ctx(BIO *b, EVP_CIPHER_CTX **pctx);

🦋 DESCRIPTION 🦋

so BIO_f_cipher() hands you back the cipher BIO method. it's a filter BIO — meaning it encrypts literally any data you write through it, and decrypts any data you read from it. no cap, it's just a cute little BIO wrapper for the cipher routines EVP_CipherInit(), EVP_CipherUpdate() and EVP_CipherFinal(). 💅

cipher BIOs do not support BIO_gets() or BIO_puts(). periodt, that's just not their thing.

BIO_flush() on an encryption BIO that you're writing through? that's your "okay I'm done, no more data to encrypt" signal ✋ — it's how you flush and possibly pad that final block through the BIO.

BIO_set_cipher() sets the cipher of BIO b to cipher, using key key and IV iv. set enc to 1 for encryption and zero for decryption. simple as that.

when you're reading from an encryption BIO, the final block gets automatically decrypted and checked the moment EOF is detected 👀. BIO_get_cipher_status() is a BIO_ctrl() macro you can call to find out whether that decryption actually slayed or flopped.

BIO_get_cipher_ctx() is also a BIO_ctrl() macro, and it retrieves the internal BIO cipher context. the retrieved context can be used together with the standard cipher routines to set it up yourself — which is super useful when BIO_set_cipher() just isn't flexible enough for what your app needs. iykyk 💜

---

🧚 NOTES 🧚

• when encrypting, you must call BIO_flush() to flush the final block through the BIO. if you don't? that final block will fail a subsequent decrypt. 😭 not a vibe.
• when decrypting, an error on the final block is signaled by a zero return value from the read operation. a successful decrypt followed by EOF will also return zero for the final read — so fr fr, call BIO_get_cipher_status() to know which one you actually got.
• as always, if you need BIO_gets() or BIO_puts() support, you can achieve it by preceding the cipher BIO with a buffering BIO. 🎀

bestie warning: that "zero means error AND zero means success" situation is exactly why the status check exists. don't skip it, i'm begging 🙈

🔥 RETURN VALUES 🔥

• BIO_f_cipher() — returns the cipher BIO method. iconic behavior.
• BIO_set_cipher() — returns 1 for success, 0 for failure.
• BIO_get_cipher_status() — returns 1 for a successful decrypt and <=0 for failure.
• BIO_get_cipher_ctx() — returns 1 for success and <=0 for failure.

👑 COPYRIGHT 👑

Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

and that's the whole page, bestie 🌈 — this one's from OpenSSL 3.5.6, dated 2026-04-07, and it's the BIO_F_CIPHER(3ossl) manual. go encrypt something, and don't forget the flush 💖💅✨