PKCS8_ENCRYPT(3ossl)

📦
version 3.5.9 · 8 versions
, in fedora 43, fedora 44

💖 PKCS8_ENCRYPT 💖

okay bestie, welcome to the PKCS8_ENCRYPT(3ossl) page, aka your one-stop glow-up station for PKCS8 encrypt/decrypt functions ✨ this is part of the OpenSSL family and she's serving exactly what the password-protected key world needs.

🌸 NAME 🌸

PKCS8_decrypt, PKCS8_decrypt_ex, PKCS8_encrypt, PKCS8_encrypt_ex, PKCS8_set0_pbe, PKCS8_set0_pbe_ex — the PKCS8 encrypt/decrypt functions, no cap 💅

🎀 SYNOPSIS 🎀

like, just include the header and you're in:

#include <openssl/x509.h>

PKCS8_PRIV_KEY_INFO *PKCS8_decrypt(const X509_SIG *p8, const char *pass,
                                   int passlen);
PKCS8_PRIV_KEY_INFO *PKCS8_decrypt_ex(const X509_SIG *p8, const char *pass,
                                      int passlen, OSSL_LIB_CTX *ctx,
                                      const char *propq);
X509_SIG *PKCS8_encrypt(int pbe_nid, const EVP_CIPHER *cipher,
                        const char *pass, int passlen, unsigned char *salt,
                        int saltlen, int iter, PKCS8_PRIV_KEY_INFO *p8);
X509_SIG *PKCS8_encrypt_ex(int pbe_nid, const EVP_CIPHER *cipher,
                           const char *pass, int passlen, unsigned char *salt,
                           int saltlen, int iter, PKCS8_PRIV_KEY_INFO *p8,
                           OSSL_LIB_CTX *ctx, const char *propq);
X509_SIG *PKCS8_set0_pbe(const char *pass, int passlen,
                        PKCS8_PRIV_KEY_INFO *p8inf, X509_ALGOR *pbe);
X509_SIG *PKCS8_set0_pbe_ex(const char *pass, int passlen,
                            PKCS8_PRIV_KEY_INFO *p8inf, X509_ALGOR *pbe,
                            OSSL_LIB_CTX *ctx);

🦋 DESCRIPTION 🦋

so here's the tea, function by function ☕

  • PKCS8_encrypt() and PKCS8_encrypt_ex() — these two do the encryption of an object p8 using the password pass of length passlen, the salt salt of length saltlen, and the iteration count iter. and the resulting X509_SIG? it's holding the encoded algorithm parameters and the encrypted key. iconic, honestly. 🔥
  • PKCS8_decrypt() and PKCS8_decrypt_ex() — the reverse glow-down: they decrypt an X509_SIG sitting in p8 using the password pass of length passlen, along with the algorithm parameters they scooped up from p8. 🫶
  • PKCS8_set0_pbe() and PKCS8_set0_pbe_ex() — these encrypt the p8inf using the password pass of length passlen and the parameters pbe. 🎀

and the plot twist you need to know: functions ending in _ex() let you pass a library context ctx and a property query propq so you can pick which algorithm implementations get used. main character energy for real. 👑

👑 RETURN VALUES 👑

  • PKCS8_encrypt(), PKCS8_encrypt_ex(), PKCS8_set0_pbe() and PKCS8_set0_pbe_ex() return an encrypted key wrapped in an X509_SIG structure — or NULL if something goes wrong 😭
  • PKCS8_decrypt() and PKCS8_decrypt_ex() return a PKCS8_PRIV_KEY_INFO — or NULL if an error occurs 💀

🌈 CONFORMING TO 🌈

IETF RFC 7292 ( <https://tools.ietf.org/html/rfc7292> ) — she's standards-compliant, periodt ✨

⭐ SEE ALSO ⭐

💜 HISTORY 💜

PKCS8_decrypt_ex(), PKCS8_encrypt_ex() and PKCS8_set0_pbe_ex() were added in OpenSSL 3.0 — so if you're on the old stuff, that's why they're ghosting you 🙈

Copyright 2021 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

k bye bestie, this was PKCS8_ENCRYPT(3ossl) from OpenSSL version 3.5.9, dated 2026-09-29 — go encrypt something cute, ily 💖🧚✨

📦 where this page comes from