BIO_F_CIPHER(3ossl)

💖 BIO_F_CIPHER 💖

okay bestie, welcome to the OpenSSL manual, page 3ossl — yes we're reading the actual docs together, it's giving study date energy 🎀

This one's about the cipher BIO filter and its lil squad: BIO_f_cipher, BIO_set_cipher, BIO_get_cipher_status, BIO_get_cipher_ctx. Let's get into it, no cap.

---

✨ SYNOPSIS ✨

#include <openssl/bio.h>
#include <openssl/evp.h>

const BIO_METHOD *BIO_f_cipher(void);
int BIO_set_cipher(BIO *b, const EVP_CIPHER *cipher,
                   const unsigned char *key, const unsigned char *iv, int enc);
int BIO_get_cipher_status(BIO *b);
int BIO_get_cipher_ctx(BIO *b, EVP_CIPHER_CTX **pctx);

like, literally copy-paste that, don't get creative with it 💅

---

🌸 DESCRIPTION 🌸

So BIO_f_cipher() returns the cipher BIO method. It's a filter BIO — meaning it encrypts everything you write through it, and decrypts everything you read from it. She's a wrapper, a little glamorous coat, around the cipher routines EVP_CipherInit(), EVP_CipherUpdate() and EVP_CipherFinal(). main character behaviour fr 🫶

⚠️ Important tea: cipher BIOs do not support BIO_gets() or BIO_puts(). Not a vibe they do.

BIO_flush() on an encryption BIO that's being written through is how you signal "okay that's all the data, no more encrypting please" — it flushes and possibly pads that final block through the BIO. The way that it pads the last block... iconic.

BIO_set_cipher() sets the cipher of BIO b to cipher, using key key and IV iv. And enc? set it to 1 for encryption, zero for decryption. one or zero, binary queen 👑

When you're reading from an encryption BIO, the final block gets automatically decrypted and checked the moment EOF is detected. BIO_get_cipher_status() is a BIO_ctrl() macro you can call to figure out whether the decryption actually worked out. (Did she slay? Ask her.)

BIO_get_cipher_ctx() is also a BIO_ctrl() macro, and it retrieves the internal BIO cipher context. You can take that retrieved context and use it with the standard cipher routines to set things up yourself. Super useful when BIO_set_cipher() just isn't flexible enough for what your application needs — like when you want the custom fit, iykyk 💜

---

🦋 NOTES 🦋

When encrypting, you must call BIO_flush() to push that final block through the BIO. If you don't? The final block will fail a subsequent decrypt. Not me forgetting the flush and then crying at the error 😭

When decrypting, an error on the final block shows up as a zero return value from the read operation. But heads up — a successful decrypt followed by EOF will also return zero for that final read. So zero doesn't tell you which one it was! Call BIO_get_cipher_status() to actually find out if the decrypt was successful. periodt.

And as always, if you need BIO_gets() or BIO_puts() support, you can get it by putting a buffering BIO in front of the cipher BIO. stack 'em like accessories ✨

---

🌈 RETURN VALUES 🌈

• BIO_f_cipher() returns the cipher BIO method.
• BIO_set_cipher() returns 1 for success and 0 for failure.
• BIO_get_cipher_status() returns 1 for a successful decrypt and <=0 for failure.
• BIO_get_cipher_ctx() returns 1 for success and <=0 for failure.

---

👑 COPYRIGHT 👑

Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

okay that's the whole page bestie, you ate that reading session 💖 stay encrypted, stay hydrated 🍓

this was OpenSSL 3.5.9, dated 2026-09-29 — mwah, see u next manpage 💅✨