PKCS8_ENCRYPT(3ossl)

📦
version 15.1 · 2 versions
, in freebsd 15.1

🌸 NAME 🌸

okay so this is the OpenSSL manual page for PKCS8_ENCRYPT(3ossl), and it is literally the home base for the PKCS8 encrypt/decrypt functions: PKCS8_decrypt, PKCS8_decrypt_ex, PKCS8_encrypt, PKCS8_encrypt_ex, PKCS8_set0_pbe, and PKCS8_set0_pbe_ex. slay, we love a function family 💅✨

🦋 SYNOPSIS 🦋

#include <openssl/x509.h>

PKCS8_PRIV_KEY_INFO *PKCS8_decrypt(const X509_SIG *p8, const char *pass,
                                   int passlen);
PKCS8_PRIV_KEY_INFO *PKCS8_decrypt_ex(const X509_SIG *p8, const char *pass,
                                      int passlen, OSSL_LIB_CTX *ctx,
                                      const char *propq);
X509_SIG *PKCS8_encrypt(int pbe_nid, const EVP_CIPHER *cipher,
                        const char *pass, int passlen, unsigned char *salt,
                        int saltlen, int iter, PKCS8_PRIV_KEY_INFO *p8);
X509_SIG *PKCS8_encrypt_ex(int pbe_nid, const EVP_CIPHER *cipher,
                           const char *pass, int passlen, unsigned char *salt,
                           int saltlen, int iter, PKCS8_PRIV_KEY_INFO *p8,
                           OSSL_LIB_CTX *ctx, const char *propq);
X509_SIG *PKCS8_set0_pbe(const char *pass, int passlen,
                        PKCS8_PRIV_KEY_INFO *p8inf, X509_ALGOR *pbe);
X509_SIG *PKCS8_set0_pbe_ex(const char *pass, int passlen,
                            PKCS8_PRIV_KEY_INFO *p8inf, X509_ALGOR *pbe,
                            OSSL_LIB_CTX *ctx);

🎀 DESCRIPTION 🎀

bestie, picture this: you have key material and you need it wrapped up all cute and PKCS8-shaped. these functions are the encrypt/decrypt crew that make it happen ✨

  • PKCS8_encrypt() and PKCS8_encrypt_ex() — these perform encryption of an object p8 using the password pass of length passlen, salt salt of length saltlen, and iteration count iter. the resulting X509_SIG contains the encoded algorithm parameters and encrypted key. iconic behavior, no cap 🔥
  • PKCS8_decrypt() and PKCS8_decrypt_ex() — these perform decryption of an X509_SIG in p8 using the password pass of length passlen along with algorithm parameters obtained from the p8. yes ma’am, it reads the vibes from the p8 itself 💖
  • PKCS8_set0_pbe() and PKCS8_set0_pbe_ex() — these perform encryption of the p8inf using the password pass of length passlen and parameters pbe. very “set it and slay” of them 🫶
  • functions ending in _ex() allow for a library context ctx and property query propq to be used to select algorithm implementations. the _ex girlies are highkey giving you more knobs to turn, iykyk 🌈

👑 RETURN VALUES 👑

PKCS8_encrypt(), PKCS8_encrypt_ex(), PKCS8_set0_pbe() and PKCS8_set0_pbe_ex() return an encrypted key in a X509_SIG structure or NULL if an error occurs. so yeah, NULL is the “something went wrong” bestie 😭

PKCS8_decrypt() and PKCS8_decrypt_ex() return a PKCS8_PRIV_KEY_INFO or NULL if an error occurs. periodt 💀

🌺 CONFORMING TO 🌺

this one conforms to IETF RFC 7292 (<https://tools.ietf.org/html/rfc7292>) — yes, the whole RFC, not just the vibe check 💜

🦄 SEE ALSO 🦄

  • crypto(7) — go read it, bestie, it’s the bigger crypto lore 🌸

⭐ HISTORY ⭐

PKCS8_decrypt_ex(), PKCS8_encrypt_ex() and PKCS8_set0_pbe_ex() were added in OpenSSL 3.0. they joined the group chat in 3.0 and we’ve been obsessed ever since 💅

Copyright 2021 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at https://www.openssl.org/source/license.html. fr fr, read the license bestie 🎀

and that’s the teaaaa 🫖💅: OpenSSL 3.5.6, dated 2026-04-07, manual page PKCS8_ENCRYPT(3ossl). bye bestie, go encrypt responsibly 💖✨

📦 where this page comes from