EVP_OPENINIT(3SSL)

📦
version 4.0.3 · 14 versions
, in ubuntu stonking

💌 EVP_OPENINIT — the OpenSSL manual, but make it make sense 💌

okay bestie, sit down, hydrate, because we're talking about EVP enveloping decryption — and it's actually not scary at all. this is the 3SSL corner of the OpenSSL docs, no cap. ✨

🌸 NAME 🌸

EVP_OpenInit, EVP_OpenUpdate, EVP_OpenFinal — EVP envelope decryption. that's the whole vibe. 🎀

🦋 SYNOPSIS 🦋

#include <openssl/evp.h>

int EVP_OpenInit(EVP_CIPHER_CTX *ctx, EVP_CIPHER *type, unsigned char *ek,
                 int ekl, unsigned char *iv, EVP_PKEY *priv);
int EVP_OpenUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out,
                   int *outl, unsigned char *in, int inl);
int EVP_OpenFinal(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl);

💖 DESCRIPTION 💖

so the EVP envelope routines are this high-level, main-character interface for envelope decryption. the way it works: they take a public key encrypted symmetric key — a key that got wrapped up by a public key — and decrypt it, then use that recovered key to decrypt your actual data. it's giving locked-box-inside-a-locked-box. 🔐✨

let's go one by one:

  • EVP_OpenInit() — initializes a cipher context ctx for decryption with cipher type. it decrypts the encrypted symmetric key, which is ekl bytes long and passed in through the ek parameter, using the private key priv. the IV gets supplied in the iv parameter. boom. that's the setup. 💅
  • EVP_OpenUpdate() and EVP_OpenFinal() — these two have exactly the same properties as the EVP_DecryptUpdate() and EVP_DecryptFinal() routines. and those are documented over on the EVP_EncryptInit(3) manual page, so if you know those, you already know these. iykyk. 🫶

👑 NOTES 👑

big brain stuff incoming:

  • you can absolutely call EVP_OpenInit() twice, the exact same way you'd do it with EVP_DecryptInit(). the first call should have priv set to NULL, and then — after you set whatever cipher parameters you need — you call it again with type set to NULL. two-step init, it's a whole ritual. 🕯️
  • if the cipher you pass in the type parameter is a variable length cipher, then the key length gets set to the value of the recovered key length. but if the cipher is a fixed length cipher, then the recovered key length must match the fixed cipher length or it's not gonna play nice. ⚠️

⭐ RETURN VALUES ⭐

  • EVP_OpenInit() — returns 0 on error, or a non zero integer if it works. and plot twist: that non zero integer is actually the recovered secret key size. cute AND informative. 💀✨
  • EVP_OpenUpdate() — returns 1 for success or 0 for failure. simple, clean, decisive.
  • EVP_OpenFinal() — returns 0 if the decrypt failed, or 1 for success. no in-between, she's binary like that.

🌈 SEE ALSO 🌈

go read those too, bestie, they're all connected. 🧚

Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

fr fr, read the license, it's not optional. 🍓

and that's the whole page, gorgeous. this was OpenSSL 4.0.3, dated 2026-09-29, and you just finished EVP_OPENINIT(3SSL). slay, periodt, go decrypt something ethically. 💅👑🌸

📦 where this page comes from