EVP_PBE_CIPHERINIT(3ossl)

💖 EVP_PBE_CIPHERINIT 💖

okay bestie, gather round, because today we're talking about password based encryption in the OpenSSL 3ossl manual — and no, it's not as scary as it sounds, i promise 🫶

the whole girl squad here is EVP_PBE_CipherInit, EVP_PBE_CipherInit_ex, EVP_PBE_find, EVP_PBE_find_ex, EVP_PBE_alg_add_type, and EVP_PBE_alg_add. they all live in the password-based-encryption department and they're literally iconic 💅

---

✨ SYNOPSIS ✨

#include <openssl/evp.h>

int EVP_PBE_CipherInit(ASN1_OBJECT *pbe_obj, const char *pass, int passlen,
                       ASN1_TYPE *param, EVP_CIPHER_CTX *ctx, int en_de);
int EVP_PBE_CipherInit_ex(ASN1_OBJECT *pbe_obj, const char *pass, int passlen,
                          ASN1_TYPE *param, EVP_CIPHER_CTX *ctx, int en_de,
                          OSSL_LIB_CTX *libctx, const char *propq);

int EVP_PBE_find(int type, int pbe_nid, int *pcnid, int *pmnid,
                 EVP_PBE_KEYGEN **pkeygen);
int EVP_PBE_find_ex(int type, int pbe_nid, int *pcnid, int *pmnid,
                    EVP_PBE_KEYGEN **pkeygen, EVP_PBE_KEYGEN_EX **keygen_ex);

int EVP_PBE_alg_add_type(int pbe_type, int pbe_nid, int cipher_nid,
                         int md_nid, EVP_PBE_KEYGEN *keygen);
int EVP_PBE_alg_add(int nid, const EVP_CIPHER *cipher, const EVP_MD *md,
                    EVP_PBE_KEYGEN *keygen);

---

🌸 DESCRIPTION 🌸

🎀 PBE operations 🎀

so EVP_PBE_CipherInit() and EVP_PBE_CipherInit_ex() are the ones doing the actual setting-up — they initialise an EVP_CIPHER_CTX called ctx so it's ready to encrypt (when en_de=1) or decrypt (when en_de=0) using the password pass which has length passlen. ✨

and where does it get the algorithm deets from? from the OID pbe_obj and the parameters param, that's where. the PBE algorithm type and parameters get pulled straight out of those two. periodt.

EVP_PBE_CipherInit_ex() is the glow-up version because it also lets your app hand over a library context libctx and a property query propq, so it can pick the right algorithm implementations. main character energy honestly 👑

🦋 PBE algorithm search 🦋

EVP_PBE_find() and EVP_PBE_find_ex() go looking for a matching algorithm, and they use two parameters to do it:

1. an algorithm type type, which can be any of these lil cuties:
   • EVP_PBE_TYPE_OUTER — a PBE algorithm
   • EVP_PBE_TYPE_PRF — a pseudo-random function
   • EVP_PBE_TYPE_KDF — a key derivation function
2. a pbe_nid, which can be either the algorithm identifier with parameters, like NID_pbeWithSHA1AndRC2_CBC, or just an algorithm class, like NID_pbes2.

and then they hand you back the algorithm's cipher ID pcnid, its digest ID pmnid, and a key generation function for the algorithm pkeygen. 🎁

EVP_PBE_CipherInit_ex() (yes, again, she does the most 💅) also returns an extended key generation function keygen_ex — and that one takes a library context and a property query.

heads up bestie: if you pass a NULL for any of pcnid, pmnid, pkeygen, or pkeygen_ex, then that parameter just... doesn't get returned. no drama, it's fine 🙈

🌈 PBE algorithm add 🌈

EVP_PBE_alg_add_type() and EVP_PBE_alg_add() are the recruiters of the group — they add an algorithm to the list of known algorithms. their parameters mean the exact same thing as they do for EVP_PBE_find() and EVP_PBE_find_ex(). no cap.

---

💜 NOTES 💜

the arguments pbe_obj and param that you feed to EVP_PBE_CipherInit() and EVP_PBE_CipherInit_ex()? together they form an X509_ALGOR — and you can often just yoink them straight out of that structure. convenient fr fr ⭐

---

👑 RETURN VALUES 👑

return value is 1 for success and 0 if an error occurred. that's it, that's the whole vibe check ✅

---

🍓 SEE ALSO 🍓

PKCS5_PBE_keyivgen(3), PKCS12_PBE_keyivgen_ex(3), PKCS5_v2_PBE_keyivgen_ex(3), PKCS12_pbe_crypt_ex(3), PKCS12_create_ex(3)

---

🧚 HISTORY 🧚

EVP_PBE_CipherInit_ex() and EVP_PBE_find_ex() were added in OpenSSL 3.0. glow-up era 💖

---

💀 COPYRIGHT 💀

Copyright 2021 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

okay that's the whole page, bestie, you ate that 🫶 this was the OpenSSL 3.5.9 manual, dated 2026-09-29 — now go forth and PBE responsibly, mwah 💋🌸✨