EVP_PKEY_ENCRYPT(3SSL)

📦
version 4.0.3 · 13 versions
, in ubuntu stonking

💖 EVP_PKEY_ENCRYPT 💖

okay so bestie, welcome to the EVP_PKEY_ENCRYPT(3SSL) page — aka the OpenSSL glow-up guide to encrypting stuff with a public key algorithm. no cap, this is the whole vibe. let's go 🫶

✨ NAME ✨

EVP_PKEY_encrypt_init_ex, EVP_PKEY_encrypt_init, EVP_PKEY_encrypt — encrypt using a public key algorithm 🔐

✨ SYNOPSIS ✨

#include <openssl/evp.h>

int EVP_PKEY_encrypt_init(EVP_PKEY_CTX *ctx);
int EVP_PKEY_encrypt_init_ex(EVP_PKEY_CTX *ctx, const OSSL_PARAM params[]);
int EVP_PKEY_encrypt(EVP_PKEY_CTX *ctx,
                     unsigned char *out, size_t *outlen,
                     const unsigned char *in, size_t inlen);

✨ DESCRIPTION ✨

EVP_PKEY_encrypt_init() sets up the public key algorithm context ctx for an encryption operation 💅. and like… a key has to already be associated with ctx before you call it, bestie — that's normally the whole point of making it with EVP_PKEY_CTX_new(3) or EVP_PKEY_CTX_new_from_pkey(3). no key, no party 🙈

EVP_PKEY_encrypt_init_ex() is literally the same thing but it also sets the algorithm-specific params. so if you've got params to pass, this is your girl ✨

EVP_PKEY_encrypt() is the main character here — it performs a public key encryption operation using ctx 👑. the data you wanna encrypt goes in through the in and inlen parameters.

now the buff situation, listen carefully:

  • if out is NULL, then the maximum size of the output buffer gets written to outlen. classic "how much room do I need" move 🎀
  • if out is not NULL, then before the call outlen should contain the length of the out buffer. if the call succeeds, the encrypted data is written to out and the amount of data actually written goes into outlen. slay ✨

✨ NOTES ✨

after you call EVP_PKEY_encrypt_init(), you can do algorithm specific control operations to set literally any appropriate parameters for the operation 💅. and plot twist — those same operations can be included directly in the EVP_PKEY_encrypt_init_ex() call. efficiency, we love to see it 🦋

also, EVP_PKEY_encrypt() can be called more than once on the same context if you're doing several operations with the same parameters. reuse the vibe, not the drama 🌸

✨ RETURN VALUES ✨

EVP_PKEY_encrypt_init(), EVP_PKEY_encrypt_init_ex() and EVP_PKEY_encrypt() all return 1 for success 🎉 and 0 or a negative value for failure 😭.

and specifically: a return value of -2 means the operation is not supported by the public key algorithm. that's the "this algorithm said no ❌" signal, iykyk.

✨ EXAMPLES ✨

encrypting data using OAEP (for RSA keys) 🧚. also peep PEM_read_PUBKEY(3) or d2i_X509(3) if you need ways to load a public key 💜

#include <openssl/evp.h>
#include <openssl/rsa.h>

EVP_PKEY_CTX *ctx;
unsigned char *out, *in;
size_t outlen, inlen;
EVP_PKEY *key;

/*
 * NB: assumes key, in, inlen are already set up,
 * and that key is an RSA public key
 */
ctx = EVP_PKEY_CTX_new_from_pkey(NULL, key, NULL);
if (!ctx)
    /* Error occurred */
if (EVP_PKEY_encrypt_init(ctx) <= 0)
    /* Error */
if (EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_OAEP_PADDING) <= 0)
    /* Error */

/* Determine buffer length */
if (EVP_PKEY_encrypt(ctx, NULL, &outlen, in, inlen) <= 0)
    /* Error */

out = OPENSSL_malloc(outlen);

if (!out)
    /* malloc failure */

if (EVP_PKEY_encrypt(ctx, out, &outlen, in, inlen) <= 0)
    /* Error */

/* Encrypted data is outlen bytes written to buffer out */

see that? first call with NULL to figure out how big out needs to be, then OPENSSL_malloc(outlen), then the real call. it's giving ✨two-step ritual✨ and it works every time 🫶

✨ SEE ALSO ✨

d2i_X509(3), EVP_PKEY_CTX_new(3), EVP_PKEY_decrypt(3), EVP_PKEY_sign(3), EVP_PKEY_verify(3), EVP_PKEY_verify_recover(3), EVP_PKEY_derive(3)

✨ HISTORY ✨

these functions were added in OpenSSL 1.0.0. vintage, but make it iconic 💅

Copyright 2006-2026 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

⚠️ real talk bestie: the license stuff above is not a vibe suggestion, it's the actual rule — don't use this file except in compliance with the License, fr fr 🙏

and that's the whole page! this was EVP_PKEY_ENCRYPT(3SSL) from the OpenSSL crew, sitting pretty at version 4.0.3, dated 2026-09-29. go encrypt something cute 💖✨🎀🦋🌸

📦 where this page comes from