BIO_F_CIPHER(3ossl)

💅 BIO_F_CIPHER — the cipher BIO filter, explained by your favorite Unix bestie

okay so this is the <pink>BIO_f_cipher(3ossl)</pink> page, from the OpenSSL manual, and bestie we are about to get so cozy with cipher filters. it's giving "crypto but make it a stream" energy. let's go ✨

---

🌸 NAME 🌸

BIO_f_cipher, BIO_set_cipher, BIO_get_cipher_status, BIO_get_cipher_ctx — the whole cipher BIO filter squad. literally all four of them, no cap 💅

---

🦋 SYNOPSIS 🦋

#include <openssl/bio.h>
#include <openssl/evp.h>

const BIO_METHOD *BIO_f_cipher(void);
int BIO_set_cipher(BIO *b, const EVP_CIPHER *cipher,
                   const unsigned char *key, const unsigned char *iv, int enc);
int BIO_get_cipher_status(BIO *b);
int BIO_get_cipher_ctx(BIO *b, EVP_CIPHER_CTX **pctx);

---

👑 DESCRIPTION 👑

so here's the tea 🍓:

• BIO_f_cipher() — returns the cipher BIO method. it's a filter BIO, which means it encrypts every single thing you write through it, and decrypts every single thing you read from it. it's basically a little BIO wrapper around the cipher routines EVP_CipherInit(), EVP_CipherUpdate() and EVP_CipherFinal(). iconic behavior honestly.
• 🚨 cipher BIOs do not support BIO_gets() or BIO_puts(). not today, not ever. (okay, see NOTES below, there's a workaround, breathe.)
• BIO_flush() on an encryption BIO that you're writing through is how you signal "okay bestie, no more data to encrypt." that's the call that flushes and possibly pads the final block through the BIO. do not skip it, i'm serious 😭
• BIO_set_cipher() — sets the cipher of BIO b to cipher, using key key and IV iv. and enc? set it to 1 for encryption, and zero for decryption. yes, 1 and 0, that's the whole vibe.
• when you're reading from an encryption BIO, the final block gets automatically decrypted and checked when EOF is detected. and BIO_get_cipher_status() is a BIO_ctrl() macro you can call to find out whether the decryption actually succeeded. main character status check fr fr 🔥
• BIO_get_cipher_ctx() — also a BIO_ctrl() macro, and it retrieves the internal BIO cipher context. the retrieved context can be used alongside the standard cipher routines to set it up yourself. super useful when BIO_set_cipher() just isn't flexible enough for what your application needs — like when you need ✨more✨.

---

🙈 NOTES 🙈 (the important warnings section, pay attention)

when encrypting, BIO_flush() must be called to flush the final block through the BIO. if it isn't, then the final block will fail a subsequent decrypt. that's it, that's the whole disaster. 💀

when decrypting, an error on the final block is signaled by a zero return value from the read operation. but plot twist: a successful decrypt followed by EOF will also return zero for that final read. so you can't tell them apart by the return value alone 😭 — call BIO_get_cipher_status() to figure out if the decrypt was actually successful.

and as always, if you truly need BIO_gets() or BIO_puts() support, you can get it by preceding the cipher BIO with a buffering BIO. problem solved, slay 💅

---

⭐ RETURN VALUES ⭐

• BIO_f_cipher() — returns the cipher BIO method.
• BIO_set_cipher() — returns 1 for success and 0 for failure.
• BIO_get_cipher_status() — returns 1 for a successful decrypt and <=0 for failure.
• BIO_get_cipher_ctx() — returns 1 for success and <=0 for failure.

---

🎀 COPYRIGHT 🎀

Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

okay that's the whole page, you ate that 🫶 mwah! this was OpenSSL 3.5.0, dated 2026-09-25, and yes the manual is literally called BIO_F_CIPHER(3ossl) — go encrypt something, bestie 🌈💖