EVP_PBE_CIPHERINIT(3ossl)

💅 EVP_PBE_CIPHERINIT — password based encryption routines, but make it make sense

okay bestie, so this is the 3ossl / OpenSSL page for the PBE (password based encryption) squad: EVP_PBE_CipherInit, EVP_PBE_CipherInit_ex, EVP_PBE_find, EVP_PBE_find_ex, EVP_PBE_alg_add_type, and EVP_PBE_alg_add. it's giving ✨crypto plumbing✨ and honestly? iconic.

---

🌸 SYNOPSIS 🌸

like, the whole cast, in code, exactly as written:

#include <openssl/evp.h>

int EVP_PBE_CipherInit(ASN1_OBJECT *pbe_obj, const char *pass, int passlen,
                       ASN1_TYPE *param, EVP_CIPHER_CTX *ctx, int en_de);
int EVP_PBE_CipherInit_ex(ASN1_OBJECT *pbe_obj, const char *pass, int passlen,
                          ASN1_TYPE *param, EVP_CIPHER_CTX *ctx, int en_de,
                          OSSL_LIB_CTX *libctx, const char *propq);

int EVP_PBE_find(int type, int pbe_nid, int *pcnid, int *pmnid,
                 EVP_PBE_KEYGEN **pkeygen);
int EVP_PBE_find_ex(int type, int pbe_nid, int *pcnid, int *pmnid,
                    EVP_PBE_KEYGEN **pkeygen, EVP_PBE_KEYGEN_EX **keygen_ex);

int EVP_PBE_alg_add_type(int pbe_type, int pbe_nid, int cipher_nid,
                         int md_nid, EVP_PBE_KEYGEN *keygen);
int EVP_PBE_alg_add(int nid, const EVP_CIPHER *cipher, const EVP_MD *md,
                    EVP_PBE_KEYGEN *keygen);

---

🎀 DESCRIPTION 🎀

🔐 PBE operations — the actual encryption moment

so EVP_PBE_CipherInit() and EVP_PBE_CipherInit_ex() are the ones that initialise an EVP_CIPHER_CTX ctx for you. bestie, you gotta tell it which direction you're going:

• en_de=1 → encryption 🔒
• en_de=0 → decryption 🔓

the password goes in as pass and its length as passlen, and the PBE algorithm type + parameters get extracted from an OID pbe_obj and parameters param. it's literally pulling the whole recipe out of the ASN.1, no cap.

EVP_PBE_CipherInit_ex() is the glow-up version — it also lets the application specify a library context libctx and a property query propq, so you can pick the appropriate algorithm implementations. main character energy for real 🫶.

🕵️‍♀️ PBE algorithm search — the vibe check

EVP_PBE_find() and EVP_PBE_find_ex() go looking for a matching algorithm using two parameters:

1. an algorithm type type, which can be any of these three:
   • EVP_PBE_TYPE_OUTER — a PBE algorithm
   • EVP_PBE_TYPE_PRF — a pseudo-random function
   • EVP_PBE_TYPE_KDF — a key derivation function
2. a pbe_nid, which can represent the algorithm identifier with parameters (e.g. NID_pbeWithSHA1AndRC2_CBC) or an algorithm class (e.g. NID_pbes2).

then they hand you back the algorithm's cipher ID pcnid, digest ID pmnid, and a key generation function for the algorithm pkeygen. and EVP_PBE_find_ex() — yes, the ex one — also returns an extended key generation function keygen_ex which takes a library context and property query. extra? no. necessary? yes. 💅

🐚 heads up: if you supply a NULL for any of pcnid, pmnid, pkeygen or pkeygen_ex, then that parameter just isn't returned. no drama, it just gets skipped.

➕ PBE algorithm add — putting new faves on the list

EVP_PBE_alg_add_type() and EVP_PBE_alg_add() add an algorithm to the list of known algorithms. their parameters mean exactly the same thing as they do for EVP_PBE_find() and EVP_PBE_find_ex(). matching set, periodt.

---

📝 NOTES 📝

ngl this bit is lowkey the most useful: the arguments pbe_obj and param to EVP_PBE_CipherInit() and EVP_PBE_CipherInit_ex() together form an X509_ALGOR, and can often be extracted directly from that structure. so no need to overthink it — it's already sitting there for you ✨.

---

🫶 RETURN VALUES 🫶

the return value is 1 for success and 0 if an error occurred. that's it. that's the whole vibe check. 😭

---

👀 SEE ALSO 👀

go read these next, i'm obsessed:

• PKCS5_PBE_keyivgen(3)
• PKCS12_PBE_keyivgen_ex(3)
• PKCS5_v2_PBE_keyivgen_ex(3)
• PKCS12_pbe_crypt_ex(3)
• PKCS12_create_ex(3)

---

🦋 HISTORY 🦋

EVP_PBE_CipherInit_ex() and EVP_PBE_find_ex() were added in OpenSSL 3.0. the _ex girlies are the new gen 💜

---

👑 COPYRIGHT 👑

Copyright 2021 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

and that's the whole page bestie 🎀 mwah, go encrypt something responsibly. this was OpenSSL 3.5.0, dated 2026-09-25 — catch you on the next manpage 💖✨