AES_ENCRYPT(3)

✨ AES_ENCRYPT(3) ✨

okay so bestie, this is the Library Functions Manual page for the low-level AES squad, and it is literally the “I can handle raw cipher keys” corner of the library. the whole crew is here: AES_set_encrypt_key, AES_set_decrypt_key, AES_encrypt, AES_decrypt, and AES_cbc_encrypt. 💅

💖 NAME 💖

these functions are the low-level interface to the AES symmetric cipher, and the lineup is AES_set_encrypt_key, AES_set_decrypt_key, AES_encrypt, AES_decrypt, and AES_cbc_encrypt. periodt. 🎀

✨ SYNOPSIS ✨

bestie, here’s the exact spellbook:

library “libcrypto” #include <openssl/aes.h>

int
AES_set_encrypt_key(const unsigned char *userKey, const int bits,
    AES_KEY *key);

int
AES_set_decrypt_key(const unsigned char *userKey, const int bits,
    AES_KEY *key);

void
AES_encrypt(const unsigned char *in, unsigned char *out,
    const AES_KEY *key);

void
AES_decrypt(const unsigned char *in, unsigned char *out,
    const AES_KEY *key);

void
AES_cbc_encrypt(const unsigned char *in, unsigned char *out,
    size_t length, const AES_KEY *key, unsigned char *ivec,
    const int enc);

🌸 DESCRIPTION 🌸

these functions give you a low-level interface to the AES symmetric cipher algorithm, also called Rijndael. for reasons of flexibility, the recommendation is that application programs use the high-level interface described in EVP_EncryptInit(3) and EVP_aes_128_cbc(3) instead whenever possible. iykyk. 🦋

AES_KEY is a structure that can hold up to 60 int values and a number of rounds. she’s compact but she’s carrying a lot. 🫶

AES_set_encrypt_key() expands the userKey, which is bits long, into the key structure to prepare for encryption. the number of bits and bytes read from userKey, the number of int values stored into key, and the number of rounds are as follows:

• bits = 128, bytes = 16, ints = 44, rounds = 10
• bits = 192, bytes = 24, ints = 52, rounds = 12
• bits = 256, bytes = 32, ints = 60, rounds = 14

AES_set_decrypt_key() does the same, but in preparation for decryption. same energy, opposite direction. 🔥

AES_encrypt() reads a single 16 byte block from *in, encrypts it with the key, and writes the 16 resulting bytes to *out. the 16 byte buffers starting at in and out can overlap, and in and out can even point to the same memory location. no cap, that overlap is allowed. ✨

AES_decrypt() decrypts a single block and is otherwise identical to AES_encrypt(). twin behavior, different job. 💜

if enc is non-zero, AES_cbc_encrypt() encrypts len bytes at in to out using the 128 bit key and the 128 bit initialization vector ivec in CBC mode. if enc is 0, AES_cbc_encrypt() performs the corresponding decryption. 🎀

🫶 RETURN VALUES 🫶

AES_set_encrypt_key() and AES_set_decrypt_key() return 0 for success, -1 if userKey or key is NULL, or -2 if the number of bits is unsupported. that’s the whole mood ring: 0, -1, -2. 💅

👀 SEE ALSO 👀

• crypto(3)
• EVP_aes_128_cbc(3)
• EVP_EncryptInit(3)

📜 STANDARDS 📜

ISO/IEC 18033-3:2010 Information technology — Security techniques — Encryption algorithms — Part 3: Block ciphers

🕰️ HISTORY 🕰️

these functions first appeared in OpenSSL 0.9.7 and have been available since OpenBSD 3.2. vintage but still on the timeline, bestie. 🌈

👑 AUTHORS 👑

• Vincent Rijmen
• Antoon Bosselaers
• Paulo Barreto

---

💖 cute sign-off: this page is from Debian, dated December 20, 2025, and its manual tag is AES_ENCRYPT(3). periodt, bestie. 🎀