RSA_SIGN_ASN1_OCTET_STRING(3ossl)

📦
version 15.1 · 2 versions
, in freebsd 15.1

💫 RSA_SIGN_ASN1_OCTET_STRING 💫

Okay bestie, welcome to the 3ossl glow-up of the RSA_SIGN_ASN1_OCTET_STRING manual page — yes, that's the whole title, and yes, it's a mouthful, but we move. This is the tale of RSA_sign_ASN1_OCTET_STRING and RSA_verify_ASN1_OCTET_STRING, two RSA signature functions that are, and I cannot stress this enough, deprecated. Like, "left on read since OpenSSL 3.0" deprecated. 🙈

🌸 NAME 🌸

RSA_sign_ASN1_OCTET_STRING, RSA_verify_ASN1_OCTET_STRING — RSA signatures. That's it, that's the name section, she's concise and she knows it. 💅

✨ SYNOPSIS ✨

First things first, you gotta include the header:

#include <openssl/rsa.h>

Now, bestie, listen: the following functions are deprecated since OpenSSL 3.0, and you can hide them entirely by defining OPENSSL_API_COMPAT with a suitable version value — see openssl_user_macros(7) for the deets. They're giving "vintage, but not in a cute way." 🎀

int RSA_sign_ASN1_OCTET_STRING(int dummy, unsigned char *m,
                               unsigned int m_len, unsigned char *sigret,
                               unsigned int *siglen, RSA *rsa);

int RSA_verify_ASN1_OCTET_STRING(int dummy, unsigned char *m,
                                 unsigned int m_len, unsigned char *sigbuf,
                                 unsigned int siglen, RSA *rsa);

Copy those signatures exactly, okay? Character for character. No "fixing" them, no renaming things, no creative liberties. 🔥

🦋 DESCRIPTION 🦋

Real talk: all of the functions described on this page are deprecated. Applications should instead use EVP PKEY APIs. This is the main character energy glow-up you should be chasing. 👑

So what does RSA_sign_ASN1_OCTET_STRING() actually do? It signs the octet string m of size m_len using the private key rsa represented in DER using PKCS #1 padding. It stores the signature in sigret and the signature size in siglen. And sigret must point to RSA_size(rsa) bytes of memory — not vibes, not hopes, actual bytes. 🫶

dummy is ignored. Literally ignored. Poor thing. 💀

The random number generator must be seeded when calling RSA_sign_ASN1_OCTET_STRING(). And if the automatic seeding or reseeding of the OpenSSL CSPRNG fails due to external circumstances (see RAND(7)), the operation will fail. No cap, it'll just not work, so keep an eye on that. 😭

Then there's RSA_verify_ASN1_OCTET_STRING(), which verifies that the signature sigbuf of size siglen is the DER representation of a given octet string m of size m_len. dummy is ignored here too. And rsa is the signer's public key. Verification era. ⭐

🌈 RETURN VALUES 🌈

  • RSA_sign_ASN1_OCTET_STRING() returns 1 on success, 0 otherwise.
  • RSA_verify_ASN1_OCTET_STRING() returns 1 on successful verification, 0 otherwise.

The error codes can be obtained by ERR_get_error(3). So if it's giving 0, go ask the error queue what's wrong. 🧚

💀 BUGS 💀

These functions serve no recognizable purpose.

That's not me being mean, that's literally the manual. They said it, not me. Iconic, honestly. 🍓

👑 SEE ALSO 👑

All the links you need for the full lore. iykyk. 💜

🎀 HISTORY 🎀

All of these functions were deprecated in OpenSSL 3.0. That's the whole history section. Short, sweet, and a little sad. 🥲

Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

Okay that's the whole page, bestie. Remember: deprecated since OpenSSL 3.0, use EVP PKEY APIs instead, and always seed your RNG. Periodt. 💅✨

3.5.6 — 2026-04-07 — RSA_SIGN_ASN1_OCTET_STRING(3ossl) 🦋

📦 where this page comes from