EVP_OPENINIT(3)

okay so welcome to the Library Functions Manual bestie 🫶 today's episode is envelope decryption and it's lowkey iconic

💖 NAME 💖

EVP_OpenInit, EVP_OpenUpdate, EVP_OpenFinal — EVP envelope decryption, and yes it is exactly as cool as it sounds 💌

🌸 SYNOPSIS 🌸

library “libcrypto” #include <openssl/evp.h>

int
EVP_OpenInit(EVP_CIPHER_CTX *ctx, EVP_CIPHER *type, unsigned char *ek,
    int ekl, unsigned char *iv, EVP_PKEY *priv);

int
EVP_OpenUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl,
    unsigned char *in, int inl);

int
EVP_OpenFinal(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl);

🦋 DESCRIPTION 🦋

so the EVP envelope routines are basically a high-level interface to envelope decryption, no cap. what they do is decrypt a symmetric key that's been encrypted with a public key, and then use that key to decrypt your actual data. it's giving two-step slay ✨

EVP_OpenInit() sets up a cipher context ctx for decryption with cipher type. it decrypts that encrypted symmetric key — the one of length ekl bytes that you passed in the ek parameter — using the private key priv. the IV gets supplied in the iv parameter. that's it, that's the whole job 💅

EVP_OpenUpdate() and EVP_OpenFinal() have exactly the same properties as the EVP_DecryptUpdate(3) and EVP_DecryptFinal(3) routines. same energy, different name fr fr.

okay this next bit is important, bestie 👑 — you can call EVP_OpenInit() twice, the same way you would with EVP_DecryptInit(3). the first call should have priv set to NULL, and then (after you've set any cipher parameters) you call it again with type set to NULL. yes, it's a whole two-call ritual, don't skip step two 🙈

and here's the cipher-length tea ☕: if the cipher you pass in the type parameter is a variable length cipher, then the key length gets set to the value of the recovered key length. if it's a fixed length cipher, then the recovered key length must match the fixed cipher length. no flexing, no exceptions 💀

psst — EVP_OpenUpdate() is implemented as a macro. just so you know. iykyk 🌈

⭐ RETURN VALUES ⭐

• EVP_OpenInit() and EVP_OpenUpdate() return 1 for success or 0 for failure. one is a slay, zero is a flop 🎀
• EVP_OpenFinal() returns 0 if the decrypt failed or 1 for success. same deal, just flipped for drama 😭

🧚 SEE ALSO 🧚

evp(3), EVP_EncryptInit(3), EVP_SealInit(3) — go read the whole family, they're all main characters 💜

🌟 HISTORY 🌟

EVP_OpenInit(), EVP_OpenUpdate(), and EVP_OpenFinal() first appeared in SSLeay 0.5.1 and have been available since OpenBSD 2.4. vintage. archival. iconic. truly the elders of the group chat 👑

---

and that's the page, bestie 🍓 this one's from the Debian build, dated January 30, 2026, and the page itself is EVP_OPENINIT(3) — go decrypt something pretty 💅✨