CMS_ENCRYPTEDDATA_DECRYPT(3ossl)

📦 version 3.5.0, in opensuse-leap 16.0

💅 CMS_EncryptedData_decrypt — okay bestie, let's decrypt

So this page lives in 3ossl, the OpenSSL corner of the man-page universe, and it's all about two little functions that take your encrypted CMS blobs and hand you back the good stuff. Let's go 🎀

✨ NAME ✨

CMS_EncryptedData_decrypt, CMS_EnvelopedData_decrypt — literally just decrypting CMS EncryptedData or EnvelopedData. That's the whole vibe. 🦋

🌸 SYNOPSIS 🌸

#include <openssl/cms.h>

int CMS_EncryptedData_decrypt(CMS_ContentInfo *cms,
                              const unsigned char *key, size_t keylen,
                              BIO *dcont, BIO *out, unsigned int flags);

BIO *CMS_EnvelopedData_decrypt(CMS_EnvelopedData *env, BIO *detached_data,
                               EVP_PKEY *pkey, X509 *cert,
                               ASN1_OCTET_STRING *secret, unsigned int flags,
                               OSSL_LIB_CTX *libctx, const char *propq);

💖 DESCRIPTION 💖

🧚 CMS_EncryptedData_decrypt()

okay so this one decrypts a cms EncryptedData object using the symmetric key, and that key is keylen bytes long. You pass out, which is a BIO where the content gets written, and flags, which is your optional set of flags (we'll get to those, don't worry 👑).

Then there's dcont — you only ever reach for this in the rare case where the encrypted content is detached. Normally you just set it to NULL, no cap. 💅

The flags, bestie 🎀

Here's what you can pass in that flags parameter:

  • So if the CMS_TEXT flag is set, the MIME headers for type "text/plain" get deleted from the content. Slay. But heads up: if the content is not of type "text/plain", you get an error back. It's giving "strict vibes only" 😭

🦋 CMS_EnvelopedData_decrypt()

This one decrypts a CMS EnvelopedData object env, and it works similarly to CMS_decrypt(3). Here's the deal on which key it uses:

  • If the symmetric key secret is not NULL, it uses that 💜
  • Otherwise it uses the private key of the recipient, pkey

And if you're giving it pkey, it's recommended that you also provide the associated certificate in cert — go check CMS_decrypt(3) and the NOTES about cert over there, iykyk. 📜

The optional params flags and dcont work exactly as described above. And the optional library context libctx plus the property query propq are what get used when retrieving algorithms from providers. Provider energy ✨

🔥 RETURN VALUES 🔥

  • CMS_EncryptedData_decrypt() returns 0 if something went wrong, otherwise it returns 1. Binary queen 👑
  • CMS_EnvelopedData_decrypt() returns NULL on error, otherwise a BIO containing the decrypted content. (The manpage says "decypted" — we love a typo moment, but yeah, decrypted content 💀)

🌈 SEE ALSO 🌈

Go read them, they're iconic 🫶

⭐ HISTORY ⭐

CMS_EnvelopedData_decrypt() was added in OpenSSL 3.2. Newer than the rest, main character energy fr fr 🌟

Copyright 2020 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

Not me reminding you to actually read the license — it's giving responsible bestie, but like, do it 🙈

okay that's the whole page, mwah 💋 — this was OpenSSL 3.5.0, dated 2026-09-25, and yes the header says CMS_ENCRYPTEDDATA_DECRYPT(3ossl) in case you need to cite your sources. go decrypt something cute today, ily 🍓

📦 where this page comes from