D2I_RSAPUBLICKEY(3)

📦 version 4.4.0, in alpine 3.24, arch rolling

💅 D2I_RSAPUBLICKEY(3) — bestie edition 🎀

okay so this is the D2I_RSAPUBLICKEY(3) page from the libcrypto girlies, and it's literally all about turning RSA keys and parameters into DER bytes and back again. it's giving ✨serialization✨ but make it cryptography. buckle up, we have a LOT of functions to get through and i'm not skipping a single one 💖

🌸 NAME 🌸

d2i_RSAPublicKey, i2d_RSAPublicKey, d2i_RSAPrivateKey, i2d_RSAPrivateKey, d2i_Netscape_RSA, i2d_Netscape_RSA, d2i_RSA_PSS_PARAMS, i2d_RSA_PSS_PARAMS, d2i_RSAPublicKey_bio, d2i_RSAPublicKey_fp, i2d_RSAPublicKey_bio, i2d_RSAPublicKey_fp, d2i_RSAPrivateKey_bio, d2i_RSAPrivateKey_fp, i2d_RSAPrivateKey_bio, i2d_RSAPrivateKey_fp, d2i_RSA_PUBKEY, i2d_RSA_PUBKEY, d2i_RSA_PUBKEY_bio, d2i_RSA_PUBKEY_fp, i2d_RSA_PUBKEY_bio, i2d_RSA_PUBKEY_fp — decode and encode RSA keys and parameters 🦋

(yes that's a lot of names, no i will not be abbreviating, every single one is here and accounted for. periodt.)

✨ SYNOPSIS ✨

first up, the library is libcrypto, and you're gonna want this include:

#include <openssl/rsa.h>

and then, in order, because the order is iconic:

RSA *
d2i_RSAPublicKey(RSA **val_out, const unsigned char **der_in,
    long length);

int
i2d_RSAPublicKey(RSA *val_in, unsigned char **der_out);

RSA *
d2i_RSAPrivateKey(RSA **val_out, const unsigned char **der_in,
    long length);

int
i2d_RSAPrivateKey(RSA *val_in, unsigned char **der_out);

RSA *
d2i_Netscape_RSA(RSA **val_out, const unsigned char **der_in,
    long length, int (*cb)());

int
i2d_Netscape_RSA(RSA *val_in, unsigned char **der_out, int (*cb)());

RSA_PSS_PARAMS *
d2i_RSA_PSS_PARAMS(RSA_PSS_PARAMS **val_out,
    const unsigned char **der_in, long length);

int
i2d_RSA_PSS_PARAMS(RSA_PSS_PARAMS *val_in, unsigned char **der_out);

then bestie switches headers on us — this is a whole new vibe:

#include <openssl/x509.h>
RSA *
d2i_RSAPublicKey_bio(BIO *in_bio, RSA **val_out);

RSA *
d2i_RSAPublicKey_fp(FILE *in_fp, RSA **val_out);

int
i2d_RSAPublicKey_bio(BIO *out_bio, RSA *val_in);

int
i2d_RSAPublicKey_fp(FILE *out_fp, RSA *val_in);

RSA *
d2i_RSAPrivateKey_bio(BIO *in_bio, RSA **val_out);

RSA *
d2i_RSAPrivateKey_fp(FILE *in_fp, RSA **val_out);

int
i2d_RSAPrivateKey_bio(BIO *out_bio, RSA *val_in);

int
i2d_RSAPrivateKey_fp(FILE *out_fp, RSA *val_in);

RSA *
d2i_RSA_PUBKEY(RSA **val_out, const unsigned char **der_in,
    long length);

int
i2d_RSA_PUBKEY(RSA *val_in, unsigned char **der_out);

RSA *
d2i_RSA_PUBKEY_bio(BIO *in_bio, RSA **val_out);

RSA *
d2i_RSA_PUBKEY_fp(FILE *in_fp, RSA **val_out);

int
i2d_RSA_PUBKEY_bio(BIO *out_bio, RSA *val_in);

int
i2d_RSA_PUBKEY_fp(FILE *out_fp, RSA *val_in);

💜 DESCRIPTION 💜

so! these functions decode and encode RSA private and public keys. 🔥 for the nitty-gritty on the semantics, examples, caveats, and bugs, you go read ASN1_item_d2i(3) — that's the deep lore, i'm just the messenger.

🩷 the public key ones

d2i_RSAPublicKey() and i2d_RSAPublicKey() decode and encode a PKCS#1 RSAPublicKey structure, which is defined in RFC 8017 appendix A.1.1. 📜

d2i_RSAPublicKey_bio(), d2i_RSAPublicKey_fp(), i2d_RSAPublicKey_bio(), and i2d_RSAPublicKey_fp() are basically the same thing, except they decode or encode using a BIO or FILE pointer. same energy, different plumbing 💅

🐚 the private key ones

d2i_RSAPrivateKey() and i2d_RSAPrivateKey() decode and encode a PKCS#1 RSAPrivateKey structure defined in RFC 8017 appendix A.1.2. 🗝️

⚠️ heads up: the RSA structure passed to the private key encoding functions should have all the PKCS#1 private key components present. don't be out here passing half a key, it's not gonna slay.
🚨 also, and this is important, bestie: the data encoded by the private key functions is unencrypted and therefore offers no private key security. like, zero. none. it's just vibes and raw bytes. protect it yourself.

d2i_RSAPrivateKey_bio(), d2i_RSAPrivateKey_fp(), i2d_RSAPrivateKey_bio(), and i2d_RSAPrivateKey_fp() are similar except that they decode or encode using a BIO or FILE pointer. 🫶

👵 the Netscape ones (aka the ancient ones)

d2i_Netscape_RSA() and i2d_Netscape_RSA() decode and encode an RSA private key in NET format.

these functions are present to provide compatibility with certain very old software. 🦕

💀 the NET format has some severe security weaknesses and should be avoided if possible. like, if you can avoid it, avoid it. this is not the moment for main character energy, this is the moment for a modern format.

🌈 the PSS params ones

d2i_RSA_PSS_PARAMS() and i2d_RSA_PSS_PARAMS() decode and encode a PKCS#1 RSASSA-PSS-params structure defined in RFC 8017 appendix A.2.3, and documented in RSA_PSS_PARAMS_new(3). ✨

👑 the SubjectPublicKeyInfo ones

d2i_RSA_PUBKEY() and i2d_RSA_PUBKEY() decode and encode an RSA public key using an ASN.1 SubjectPublicKeyInfo structure defined in RFC 5280 section 4.1, and documented in X509_PUBKEY_new(3). 🦋

d2i_RSA_PUBKEY_bio(), d2i_RSA_PUBKEY_fp(), i2d_RSA_PUBKEY_bio(), and i2d_RSA_PUBKEY_fp() are similar except that they decode or encode using a BIO or FILE pointer. same drill, different pointer types 💖

⭐ RETURN VALUES ⭐

okay so the decode girlies first:

d2i_RSAPublicKey(), d2i_RSAPublicKey_bio(), d2i_RSAPublicKey_fp(), d2i_RSAPrivateKey(), d2i_RSAPrivateKey_bio(), d2i_RSAPrivateKey_fp(), d2i_Netscape_RSA(), d2i_RSA_PUBKEY(), d2i_RSA_PUBKEY_bio(), and d2i_RSA_PUBKEY_fp() return a valid RSA object, or NULL if an error occurs. 😭

d2i_RSA_PSS_PARAMS() returns a valid RSA_PSS_PARAMS object, or NULL if an error occurs.

then the encode-into-buffer crowd:

i2d_RSAPublicKey(), i2d_RSAPrivateKey(), i2d_Netscape_RSA(), i2d_RSA_PSS_PARAMS(), and i2d_RSA_PUBKEY() return the number of bytes successfully encoded, or a negative value if an error occurs. 📏

and the bio/fp encoders:

i2d_RSAPublicKey_bio(), i2d_RSAPublicKey_fp(), i2d_RSAPrivateKey_bio(), i2d_RSAPrivateKey_fp(), i2d_RSA_PUBKEY_bio(), and i2d_RSA_PUBKEY_fp() return 1 for success or 0 if an error occurs. 🎯

👀 SEE ALSO 👀

go read these next, bestie, they're all linked up:

📚 STANDARDS 📚

  • RFC 8017: PKCS #1: RSA Cryptography Specifications
  • RFC 5280: Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile, section 4.1: Basic Certificate Fields

🧚 HISTORY 🧚

and now the lore drop 🕰️:

d2i_RSAPublicKey(), i2d_RSAPublicKey(), d2i_RSAPrivateKey(), i2d_RSAPrivateKey(), d2i_RSAPrivateKey_fp(), i2d_RSAPrivateKey_fp(), d2i_Netscape_RSA(), and i2d_Netscape_RSA() first appeared in SSLeay 0.5.1.

d2i_RSAPrivateKey_bio() and i2d_RSAPrivateKey_bio() first appeared in SSLeay 0.6.0.

d2i_RSAPublicKey_bio(), d2i_RSAPublicKey_fp(), i2d_RSAPublicKey_bio(), and i2d_RSAPublicKey_fp() first appeared in SSLeay 0.8.1.

these functions have been available since OpenBSD 2.4. 👑

d2i_RSA_PUBKEY(), i2d_RSA_PUBKEY(), d2i_RSA_PUBKEY_bio(), d2i_RSA_PUBKEY_fp(), i2d_RSA_PUBKEY_bio(), and i2d_RSA_PUBKEY_fp() first appeared in OpenSSL 0.9.5 and have been available since OpenBSD 2.7. 🌸

d2i_RSA_PSS_PARAMS() and i2d_RSA_PSS_PARAMS() first appeared in OpenSSL 1.0.1 and have been available since OpenBSD 5.3. ✨

and that's the page!! 💖 this particular printing came from Debian, dated June 8, 2025 — so if you're citing it, that's the tea 🫶 mwah, go forth and encode responsibly 🎀

📦 where this page comes from