CRYPTO(3)

📦 version 4.4.0, in alpine 3.24, arch rolling

🌸 NAME 🌸

okay so bestie, this is crypto — the OpenSSL cryptographic library. That’s the whole main-character intro. 💅

💖 DESCRIPTION 💖

The OpenSSL crypto library implements a wide range of cryptographic algorithms used in various Internet standards. The services provided by this library are used by the OpenSSL implementations of TLS and S/MIME, and they have also been used to implement SSH, OpenPGP, and other cryptographic standards. iconic behavior, honestly. ✨

Symmetric ciphers including AES, Blowfish, CAST, ChaCha20, IDEA, DES, RC2, and RC4 are provided by the generic interface EVP_EncryptInit(3). Low-level stand-alone interfaces include AES_encrypt(3), BF_set_key(3), ChaCha(3), DES_set_key(3), RC2_encrypt(3), and RC4(3). yes, that is a lot of cipher names, and yes, they all ate. 🔥

Public key cryptography and key agreement are provided by DH_new(3), ECDH_compute_key(3), X25519(3), DSA_new(3), ECDSA_SIG_new(3), RSA_new(3), and EVP_PKEY_new(3). 💜

Certificates are handled by X509_new(3) and X509v3_add_ext(3). 🎀

Authentication codes and hash functions offered include EVP_DigestInit(3), CMAC_Init(3), HMAC(3), MD4(3), MD5(3), RIPEMD160(3), SHA1(3), and SHA256(3). hash girlies rise. 🌈

Input, output, and data encoding facilities include ASN1_TYPE_get(3), BIO_new(3), CMS_ContentInfo_new(3), evp(3), EVP_EncodeInit(3), PEM_read(3), PKCS7_encrypt(3), PKCS7_sign(3), PKCS12_create(3), and SMIME_write_PKCS7(3). 💖

Auxiliary features include:

Internal utilities include BIO_f_buffer(3), BN_new(3), EC_GROUP_new_by_curve_name(3), lh_new(3), and STACK_OF(3). 🫶

🧚 NAMING CONVENTIONS 🧚

Elements used in the names of API functions include the following. this is basically the OpenSSL name decoder ring, iykyk. 👑

  • add0 — see “set0” below. that’s it, that’s the whole entry. 💀
  • add1 — see “set1” below. same vibe, different digit. ✨
  • BIO — basic input and/or output abstraction: the function manipulates objects of the idiosyncratic OpenSSL BIO object type. see BIO_new(3). 🦋
  • bio — the function uses a BIO object for input or output. in many cases, simpler variants of the function are available that operate directly on <stdio.h> FILE objects or directly in RAM, usually using byte arrays. lowkey the chill version. 🌸
  • BIO_f_ — filter BIO: the function returns a pointer to a static built-in object that, when passed to BIO_new(3), results in the creation of a BIO object that can write data to and/or read data from another BIO object. filter era. 💅
  • BIO_s_ — source and/or sink BIO: the function returns a pointer to a static built-in object that, when passed to BIO_new(3), results in the creation of a BIO object that can write data to an external destination and/or read data from an external source, for example a file descriptor or object, a memory buffer, or the network. source/sink slay. 🌊
  • BN — big number: the function operates on BIGNUM objects representing integer numbers of variable, almost unlimited size. see BN_new(3). big number energy fr fr. 🔢
  • cb — callback: the function takes or returns a function pointer that is called by API functions from inside the library. the function pointed to may be defined by the application program. in some cases, API functions with “cb” in their name may return function pointers to internal functions defined inside the library that are not API functions. the element “cb” is also used in the names of some function pointer datatypes declared with typedef. in a small number of cases, the all caps form “CB” is used with the same meaning. callback chaos, but make it consistent. 📞
  • CTX — context: the function operates on a wrapper object around another object. the purposes and properties of such “CTX” wrapper objects vary wildly depending on the objects in question. a few function names use the lower case form “ctx” in the same sense. wrapper on wrapper, no cap. 🎁
  • d2i — DER to internal: the function decodes input conforming to ASN.1 basic encoding rules (BER) and either stores the result in an existing object or in a newly allocated object. the latter is usually preferable because creating a new object is more robust and less error prone. in spite of the name, the input usually does not need to conform to ASN.1 distinguished encoding rules (DER), which are more restrictive than BER. plot twist: the name is a little dramatic. 😭
  • EVP — digital EnVeloPe library: see evp(3). envelope, but make it crypto. ✉️
  • ex — this name element is used for two completely unrelated purposes. not me having a split personality. 🙈
    • extended version — the function is similar to an older function without the “ex” in its name, but takes one or more additional arguments in order to make it more versatile. in several cases, the older version is now deprecated. glow-up edition. ✨
    • extra data — some object types support storing additional, application-specific data inside objects in addition to the data the object is designed to hold. the function sets, retrieves, or prepares for using such extra data. related function names usually contain ex_data or ex_new_index. see CRYPTO_set_ex_data(3). extra data, extra lore. 💜
  • fp — file pointer: the function takes a FILE * argument. usually, the function is a variant of another function taking a BIO * argument instead. same function, different input vibe. 📁
  • i2d — internal to DER: the function encodes an object passed as an argument according to ASN.1 distinguished encoding rules (DER). there are a few rare exceptions of functions that have “i2d” in their name but produce output anyway that only conforms to ASN.1 basic encoding rules (BER) and not to DER. rare exception behavior, noted. 🔍
  • get0 — the function returns an internal pointer owned by the object passed as an argument. the returned pointer must not be freed by the calling code. it will be freed automatically when the object owning the pointer will be freed. bestie, do not free it. that is not your pointer. 💀
  • get1 — the function returns a copy of a sub-object of an object passed as an argument. the caller is responsible for freeing the returned object when it is no longer needed. if the object type is reference counted, usually the reference count is incremented instead of copying the object. consequently, modifying the returned object may still impact all objects containing references to it. the caller is responsible for freeing the returned object when it is no longer needed; for reference-counted objects still referenced elsewhere, this will merely decrement the reference count. copy with lore. 🫶
  • get — functions containing “get” in their name without a following digit may behave in “get0” or, more rarely, in “get1” style. to find out which is the case, refer to the individual manual pages. mystery digit behavior, check the page. 🕵️
  • lh — linear hash: the function manipulates a dynamic hash table. see lh_new(3). linear hash, not linear sadness. 🌈
  • md — message digest. some function names use the all caps form “MD” in the same sense. digest era. 🍓
  • meth — the function manipulates an object holding a function table. usually, such function tables allow the application program to implement additional cryptographic or I/O algorithms and to use them with the same high-level API functions as the algorithms provided by the library itself, or to replace the implementations of algorithms provided by the library with custom implementations provided by the application program. some API functions use the name elements “method” or “METHOD” in the same sense. see also the “cb” entry in the present list. plug-in your own algorithm, main character style. 🔌
  • nid — numerical identifier: a non-standard, LibreSSL-specific int number associated with an ASN.1 object identifier. in several cases, the all caps form “NID” is used in the same sense. see OBJ_nid2obj(3). number ID, but LibreSSL-specific. 🎀
  • obj — this name element and its all caps form “OBJ” usually refer to ASN.1 object identifiers represented by the ASN1_OBJECT data type. see ASN1_OBJECT_new(3). object identifier object, say that five times. 🔁
  • PKEY — in most cases, this name element and its lower case form “pkey” mean “private key”, but for both forms, there are some cases where they mean “public key” instead. mostly private, sometimes public, keep up bestie. 🔑💖
  • set0 — the function transfers ownership of a pointer passed as an argument to an object passed as another argument, by storing the pointer inside the object. the transferred pointer must not be freed by the calling code. it will be freed automatically when the object now owning the pointer will be freed. ownership transfer, do not double-free. 💅
  • set1 — the function copies the content of one object passed as an argument into another object also passed as an argument. when the calling code no longer needs the copied object, it can free that object. in some cases, if the object to be copied is reference counted, the function does not actually copy the object but merely increments its reference count and stores the pointer to it in the other object. when the calling code no longer needs its original pointer to the now inner object, it can free the original pointer, thus decrementing the reference count of the inner object and transferring ownership of the inner object to the outer object. the inner object will then be freed automatically when the outer object is freed later on. reference-count plot, but make it cute. 🌀
  • set — functions containing “set” in their name without a following digit may behave in “set0” or, more rarely, in “set1” style. to find out which is the case, refer to the individual manual pages. again: check the individual page, bestie. 📖
  • sk — stack: the function manipulates a variable-sized array of pointers in the idiosyncratic style described in OPENSSL_sk_new(3). stack of pointers, iconic. 🥞
  • TS — X.509 time-stamp protocol: see TS_REQ_new(3). time-stamp protocol, very official. ⏰
  • up_ref — the function increments the reference count of the argument by one. only a minority of object types support reference counting. for those that do, if the reference count is greater than one, the corresponding “free” function reverses the effect of one call to the “up_ref” function rather than freeing the object. refcount up, free function does the opposite of one up_ref when count is greater than one. no cap. ⬆️

🔥 SEE ALSO 🔥

openssl(1), ssl(3)

mwah 💋 — this page came from Debian, dated April 25, 2025, and it’s CRYPTO(3). periodt.

📦 where this page comes from