EVP_PBE_CIPHERINIT(3ossl)

💅 EVP_PBE_CIPHERINIT 💅

okay so bestie, this is the EVP_PBE_CIPHERINIT(3ossl) page from the OpenSSL crew — yes, that OpenSSL — and it's literally all about password based encryption routines. Pull up a chair, we're getting into it 🫶

---

✨ NAME ✨

EVP_PBE_CipherInit, EVP_PBE_CipherInit_ex, EVP_PBE_find, EVP_PBE_find_ex, EVP_PBE_alg_add_type, EVP_PBE_alg_add — Password based encryption routines. That's the whole squad, bestie 💖

---

🌸 SYNOPSIS 🌸

#include <openssl/evp.h>

int EVP_PBE_CipherInit(ASN1_OBJECT *pbe_obj, const char *pass, int passlen,
                       ASN1_TYPE *param, EVP_CIPHER_CTX *ctx, int en_de);
int EVP_PBE_CipherInit_ex(ASN1_OBJECT *pbe_obj, const char *pass, int passlen,
                          ASN1_TYPE *param, EVP_CIPHER_CTX *ctx, int en_de,
                          OSSL_LIB_CTX *libctx, const char *propq);

int EVP_PBE_find(int type, int pbe_nid, int *pcnid, int *pmnid,
                 EVP_PBE_KEYGEN **pkeygen);
int EVP_PBE_find_ex(int type, int pbe_nid, int *pcnid, int *pmnid,
                    EVP_PBE_KEYGEN **pkeygen, EVP_PBE_KEYGEN_EX **keygen_ex);

int EVP_PBE_alg_add_type(int pbe_type, int pbe_nid, int cipher_nid,
                         int md_nid, EVP_PBE_KEYGEN *keygen);
int EVP_PBE_alg_add(int nid, const EVP_CIPHER *cipher, const EVP_MD *md,
                    EVP_PBE_KEYGEN *keygen);

copy these exactly, no cap — don't be out here retyping and "fixing" the spacing, the compiler will absolutely read you for filth 😭

---

🦋 DESCRIPTION 🦋

🔐 PBE operations 🔐

So EVP_PBE_CipherInit() and EVP_PBE_CipherInit_ex() are the setup girlies. They initialise an EVP_CIPHER_CTX called ctx for encryption when en_de=1, or decryption when en_de=0, using the password pass of length passlen. Slay. 💅

And where do the actual algorithm details come from? The PBE algorithm type and parameters get extracted from an OID pbe_obj and parameters param. That's the vibe check right there.

EVP_PBE_CipherInit_ex() is the upgraded version — the main character, honestly — because it also lets the application specify a library context libctx and a property query propq to select appropriate algorithm implementations. Obsessed. ✨

🔎 PBE algorithm search 🔎

EVP_PBE_find() and EVP_PBE_find_ex() go looking for a matching algorithm using two parameters:

1. An algorithm type type, which can be:
   • EVP_PBE_TYPE_OUTER — A PBE algorithm
   • EVP_PBE_TYPE_PRF — A pseudo-random function
   • EVP_PBE_TYPE_KDF — A key derivation function
2. A pbe_nid, which can represent the algorithm identifier with parameters, e.g. NID_pbeWithSHA1AndRC2_CBC, or an algorithm class, e.g. NID_pbes2. iykyk 🧚

They return the algorithm's cipher ID pcnid, digest ID pmnid, and a key generation function for the algorithm pkeygen. And EVP_PBE_CipherInit_ex() — wait, the page says that here, fr fr — also returns an extended key generation function keygen_ex, which takes a library context and property query. 👑

lowkey important: if a NULL is supplied for any of pcnid, pmnid, pkeygen or pkeygen_ex, then that parameter is not returned. The function just... doesn't fill it in. Respect the boundary 🫶

➕ PBE algorithm add ➕

EVP_PBE_alg_add_type() and EVP_PBE_alg_add() add an algorithm to the list of known algorithms. Their parameters have the same meaning as for the EVP_PBE_find() and EVP_PBE_find_ex() functions. Simple as that, bestie 💖

---

📝 NOTES 📝

The arguments pbe_obj and param to EVP_PBE_CipherInit() and EVP_PBE_CipherInit_ex() together form an X509_ALGOR — and can often be extracted directly from this structure. Cute little two-for-one situation 🎀

---

⭐ RETURN VALUES ⭐

Return value is 1 for success and 0 if an error occurred. That's it. Binary. Iconic behaviour, honestly 🌈

---

🌈 SEE ALSO 🌈

PKCS5_PBE_keyivgen(3), PKCS12_PBE_keyivgen_ex(3), PKCS5_v2_PBE_keyivgen_ex(3), PKCS12_pbe_crypt_ex(3), PKCS12_create_ex(3)

go read those next, bestie, they're all in the same friend group 💜

---

🕰️ HISTORY 🕰️

EVP_PBE_CipherInit_ex() and EVP_PBE_find_ex() were added in OpenSSL 3.0. The _ex girlies are the new additions — respect your elders, but also know the fresh ones ate 🔥

---

©️ COPYRIGHT ©️

Copyright 2021 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

ngl please actually read the license, it's not just decoration 💀

---

and that's the page!! 🎀 this was version 3.5.6, dated 2026-04-07, brought to you by the EVP_PBE_CIPHERINIT(3ossl) girlies — mwah, go encrypt something responsibly 💖✨🌸