EVP_PKEY_ENCRYPT(3ossl)

💖 EVP_PKEY_ENCRYPT(3ossl) 💖

okay so bestie, this one is from the OpenSSL manual, section 3ossl — and it's literally all about encrypting stuff with a public key algorithm. yes, the asymmetric kind. no cap, it's kind of a big deal. 🎀

---

✨ NAME ✨

EVP_PKEY_encrypt_init_ex, EVP_PKEY_encrypt_init, EVP_PKEY_encrypt — encrypt using a public key algorithm 🦋

🌸 SYNOPSIS 🌸

#include <openssl/evp.h>

int EVP_PKEY_encrypt_init(EVP_PKEY_CTX *ctx);
int EVP_PKEY_encrypt_init_ex(EVP_PKEY_CTX *ctx, const OSSL_PARAM params[]);
int EVP_PKEY_encrypt(EVP_PKEY_CTX *ctx,
                     unsigned char *out, size_t *outlen,
                     const unsigned char *in, size_t inlen);

💅 DESCRIPTION 💅

So EVP_PKEY_encrypt_init() sets up a public key algorithm context — using key pkey — for an encryption operation. That's it, that's the vibe. ✨

Then EVP_PKEY_encrypt_init_ex() does the same glow-up (initializes a public key algorithm context using key pkey for an encryption operation) but it also sets the algorithm specific params. fancy. 👑

And EVP_PKEY_encrypt() is the one that actually does the public key encryption operation, using ctx. The data you're encrypting comes in through the in and inlen parameters. here's the little trick tho:

• If out is NULL, then the max size of the output buffer gets written to the outlen parameter (this is your "how much room do I need" probe pass 🔍).
• If out is not NULL, then before the call, outlen should contain the length of the out buffer. If the call succeeds, the encrypted data is written to out, and the amount of data actually written goes into outlen. slay. 💖

🫶 NOTES 🫶

After you call EVP_PKEY_encrypt_init(), you can do algorithm specific control operations to set whatever parameters are appropriate for the operation — iykyk. And plot twist: those same operations can just be included directly in the EVP_PKEY_encrypt_init_ex() call instead. convenient much? 🙈

Also EVP_PKEY_encrypt() can be called more than once on the same context if you're doing several operations with the same parameters. reuse the vibe, save the effort. ♻️

🔥 RETURN VALUES 🔥

EVP_PKEY_encrypt_init(), EVP_PKEY_encrypt_init_ex() and EVP_PKEY_encrypt() all return 1 for success, and 0 or a negative value for failure. In particular, a return value of -2 means the operation is not supported by the public key algorithm — so if you see -2, that algorithm said "not today bestie". 💀

🌈 EXAMPLES 🌈

Encrypting data using OAEP (for RSA keys). Also peep PEM_read_PUBKEY(3) or d2i_X509(3) for ways to load a public key. Or honestly you may also simply set 'eng = NULL;' to start with the default OpenSSL RSA implementation — lowkey the easiest route. 🍓

#include <openssl/evp.h>
#include <openssl/rsa.h>
#include <openssl/engine.h>

EVP_PKEY_CTX *ctx;
ENGINE *eng;
unsigned char *out, *in;
size_t outlen, inlen;
EVP_PKEY *key;

/*
 * NB: assumes eng, key, in, inlen are already set up,
 * and that key is an RSA public key
 */
ctx = EVP_PKEY_CTX_new(key, eng);
if (!ctx)
    /* Error occurred */
if (EVP_PKEY_encrypt_init(ctx) <= 0)
    /* Error */
if (EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_OAEP_PADDING) <= 0)
    /* Error */

/* Determine buffer length */
if (EVP_PKEY_encrypt(ctx, NULL, &outlen, in, inlen) <= 0)
    /* Error */

out = OPENSSL_malloc(outlen);

if (!out)
    /* malloc failure */

if (EVP_PKEY_encrypt(ctx, out, &outlen, in, inlen) <= 0)
    /* Error */

/* Encrypted data is outlen bytes written to buffer out */

see how it does the NULL pass first to find outlen, then mallocs, then does the real pass? that's the main character energy right there. 👑

🧚 SEE ALSO 🧚

d2i_X509(3), ENGINE_by_id(3), EVP_PKEY_CTX_new(3), EVP_PKEY_decrypt(3), EVP_PKEY_sign(3), EVP_PKEY_verify(3), EVP_PKEY_verify_recover(3), EVP_PKEY_derive(3)

⭐ HISTORY ⭐

These functions were added in OpenSSL 1.0.0. og status fr fr. 💜

👑 COPYRIGHT 👑

Copyright 2006-2021 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

and that's the whole page bestie, no notes. 🌸 this was OpenSSL 3.5.0, dated 2026-09-25 — so go forth and encrypt, mwah 💋🦋✨