EVP_PKEY_ENCRYPT(3ossl)

💖 EVP_PKEY_ENCRYPT 💖

okay so bestie, this is a page from the OpenSSL manual, section 3ossl, and it's literally all about encrypting stuff with a public key algorithm 🫶 it's called EVP_PKEY_ENCRYPT and no cap, it's kind of the moment.

---

✨ NAME ✨

EVP_PKEY_encrypt_init_ex, EVP_PKEY_encrypt_init, EVP_PKEY_encrypt — encrypt using a public key algorithm 💅

---

🌸 SYNOPSIS 🌸

#include <openssl/evp.h>

int EVP_PKEY_encrypt_init(EVP_PKEY_CTX *ctx);
int EVP_PKEY_encrypt_init_ex(EVP_PKEY_CTX *ctx, const OSSL_PARAM params[]);
int EVP_PKEY_encrypt(EVP_PKEY_CTX *ctx,
                     unsigned char *out, size_t *outlen,
                     const unsigned char *in, size_t inlen);

---

🎀 DESCRIPTION 🎀

So EVP_PKEY_encrypt_init() sets up a public key algorithm context, using key pkey, for an encryption operation. main character setup energy ✨

Then EVP_PKEY_encrypt_init_ex() does the same thing — initializes a public key algorithm context with key pkey for an encryption operation — but ALSO sets the algorithm specific params. like it said "and I'll bring the params too 💅"

And EVP_PKEY_encrypt() is the one that actually does the public key encryption operation using ctx. the data you wanna encrypt is specified with the in and inlen parameters 📥

now here's the lil trick that gets everybody:

• if out is NULL, then the maximum size of the output buffer gets written to the outlen parameter. so you're basically asking "how much room do I need bestie?"
• if out is not NULL, then before the call the outlen parameter should contain the length of the out buffer, and if the call succeeds, the encrypted data gets written to out and the amount of data written goes into outlen. so it's both an input and an output, she contains multitudes 🦋

---

💜 NOTES 💜

After you call EVP_PKEY_encrypt_init(), you can perform algorithm specific control operations to set any appropriate parameters for the operation ✨ and good news: those operations can also be included in the EVP_PKEY_encrypt_init_ex() call. two paths, same destination, we love options 🎀

Also! EVP_PKEY_encrypt() can be called more than once on the same context if you're performing several operations with the same parameters. she's reusable, she's efficient, she's iconic 👑

---

🌈 RETURN VALUES 🌈

EVP_PKEY_encrypt_init(), EVP_PKEY_encrypt_init_ex() and EVP_PKEY_encrypt() all return 1 for success, and 0 or a negative value for failure 💀

and specifically: a return value of -2 means the operation is not supported by the public key algorithm. so if you see a -2, that's the algorithm saying "not my job, not my problem 🙈"

---

🍓 EXAMPLES 🍓

okay here's how you encrypt data using OAEP (for RSA keys) 💖 also peep PEM_read_PUBKEY(3) or d2i_X509(3) if you need ways to load a public key. and you can also just simply set eng = NULL; to start with the default OpenSSL RSA implementation, easy peasy ✨

#include <openssl/evp.h>
#include <openssl/rsa.h>
#include <openssl/engine.h>

EVP_PKEY_CTX *ctx;
ENGINE *eng;
unsigned char *out, *in;
size_t outlen, inlen;
EVP_PKEY *key;

/*
 * NB: assumes eng, key, in, inlen are already set up,
 * and that key is an RSA public key
 */
ctx = EVP_PKEY_CTX_new(key, eng);
if (!ctx)
    /* Error occurred */
if (EVP_PKEY_encrypt_init(ctx) <= 0)
    /* Error */
if (EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_OAEP_PADDING) <= 0)
    /* Error */

/* Determine buffer length */
if (EVP_PKEY_encrypt(ctx, NULL, &outlen, in, inlen) <= 0)
    /* Error */

out = OPENSSL_malloc(outlen);

if (!out)
    /* malloc failure */

if (EVP_PKEY_encrypt(ctx, out, &outlen, in, inlen) <= 0)
    /* Error */

/* Encrypted data is outlen bytes written to buffer out */

note the two-call pattern bestie — first call with NULL to find outlen, OPENSSL_malloc it, then call again for real 💅 that's the whole vibe

---

🦋 SEE ALSO 🦋

d2i_X509(3), ENGINE_by_id(3), EVP_PKEY_CTX_new(3), EVP_PKEY_decrypt(3), EVP_PKEY_sign(3), EVP_PKEY_verify(3), EVP_PKEY_verify_recover(3), EVP_PKEY_derive(3)

---

⭐ HISTORY ⭐

These functions were added in OpenSSL 1.0.0. vintage but still slaying 👑

---

👑 COPYRIGHT 👑

Copyright 2006-2021 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

and that's the whole page bestie, we ate and left no crumbs 🍽️✨ this was OpenSSL 3.5.9, dated 2026-09-29, from the EVP_PKEY_ENCRYPT(3ossl) manual. go encrypt something cute, ily, bye 💖🫶🎀