CMS_ENCRYPTEDDATA_DECRYPT(3ossl)

📦
version 3.5.9 · 8 versions
, in fedora 43, fedora 44

💖 CMS_ENCRYPTEDDATA_DECRYPT(3ossl) 💖

okay bestie, sit down, hydrate, and let's talk about OpenSSL because this one is literally the manual page for CMS_EncryptedData_decrypt and CMS_EnvelopedData_decrypt — yes, both of them, sharing one page like the iconic duo they are. It's giving cryptography, it's giving decryption era, and we're gonna get through it together 🫶

✨ NAME ✨

CMS_EncryptedData_decrypt, CMS_EnvelopedData_decrypt — Decrypt CMS EncryptedData or EnvelopedData

no cap, that's the whole vibe: you got some encrypted CMS stuff and you want the content back. slay.

🌸 SYNOPSIS 🌸

#include <openssl/cms.h>

int CMS_EncryptedData_decrypt(CMS_ContentInfo *cms,
                              const unsigned char *key, size_t keylen,
                              BIO *dcont, BIO *out, unsigned int flags);

BIO *CMS_EnvelopedData_decrypt(CMS_EnvelopedData *env, BIO *detached_data,
                               EVP_PKEY *pkey, X509 *cert,
                               ASN1_OCTET_STRING *secret, unsigned int flags,
                               OSSL_LIB_CTX *libctx, const char *propq);

look at those signatures. main character energy, both of them 💅

🦋 DESCRIPTION 🦋

💜 CMS_EncryptedData_decrypt()

so this one decrypts a cms EncryptedData object using the symmetric key of size keylen bytes. that's the tea. 🍵

⚠️ AEAD cipher algorithms are not supported. like, at all. don't try it, bestie, it's not the move.

Here's the cast of characters:

  • out — a BIO to write the content to 📝
  • flags — an optional set of flags
  • dcont — used in the rare case where the encrypted content is detached. it will normally be set to NULL. (emphasis on rare, she's shy 🙈)

the flags you can pass in the flags parameter

  • CMS_TEXT — if this flag is set, MIME headers for type "text/plain" are deleted from the content. but ⚠️ if the content is not of type "text/plain", then an error is returned. so like, vibe check your content type first, fr fr.

💙 CMS_EnvelopedData_decrypt()

this one decrypts a CMS EnvelopedData object env, similarly to CMS_decrypt(3), using:

  • the symmetric key secret if it is not NULL 🔑
  • otherwise the private key of the recipient pkey 🔐

and hmm, if pkey is given? it is recommended to also provide the associated certificate in cert — see CMS_decrypt(3) and the NOTES on cert there. (go read it, i'll wait 💅)

the optional parameters flags and dcont are used as described above ☝️ (yes, same flags, same dcont, same energy).

the optional parameters library context libctx and property query propq are used when retrieving algorithms from providers. very provider-core of them ✨

🌈 RETURN VALUES 🌈

  • CMS_EncryptedData_decrypt() returns 0 if an error occurred, otherwise returns 1. simple. binary. iconic. ✌️
  • CMS_EnvelopedData_decrypt() returns NULL if an error occurred, otherwise a BIO containing the decrypted content. 🎁

👑 SEE ALSO 👑

the whole friend group, honestly 🫶

⭐ HISTORY ⭐

CMS_EnvelopedData_decrypt() was added in OpenSSL 3.2. so if you're on something older and it's not working… yeah, that's why bestie 😭

Copyright 2020-2026 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

like, legally speaking, read the license. it's giving required 💀

and that's the page, babe!! 🌸 this was OpenSSL 3.5.9, dated 2026-09-29, and it lives under CMS_ENCRYPTEDDATA_DECRYPT(3ossl) forever and ever. go decrypt something responsibly, mwah 💖✨

📦 where this page comes from