D2I_PKCS8PRIVATEKEY_BIO(3SSL)

📦
version 4.0.3 · 14 versions
, in ubuntu stonking

💖 d2i_PKCS8PrivateKey_bio — PKCS#8 format private key functions 💖

okay bestie, listen. this is a page from the OpenSSL manual, section 3SSL, and it's all about yeeting private keys in and out of PKCS#8 format. it's giving ✨cryptography✨ but honestly? it's not that deep once you see it. sit with me. 🫶

🌸 NAME 🌸

d2i_PKCS8PrivateKey_bio, d2i_PKCS8PrivateKey_fp, i2d_PKCS8PrivateKey_bio, i2d_PKCS8PrivateKey_fp, i2d_PKCS8PrivateKey_nid_bio, i2d_PKCS8PrivateKey_nid_fp — these are the PKCS#8 format private key functions, no cap. that's the whole girl squad right there. 💅

✨ SYNOPSIS ✨

first, you gotta pull in the header, obviously:

#include <openssl/pem.h>

and then here's the actual cast of characters, verbatim, don't @ me:

EVP_PKEY *d2i_PKCS8PrivateKey_bio(BIO *bp, EVP_PKEY **x, pem_password_cb *cb, void *u);
EVP_PKEY *d2i_PKCS8PrivateKey_fp(FILE *fp, EVP_PKEY **x, pem_password_cb *cb, void *u);

int i2d_PKCS8PrivateKey_bio(BIO *bp, const EVP_PKEY *x, const EVP_CIPHER *enc,
                            char *kstr, int klen,
                            pem_password_cb *cb, void *u);

int i2d_PKCS8PrivateKey_fp(FILE *fp, const EVP_PKEY *x, const EVP_CIPHER *enc,
                           char *kstr, int klen,
                           pem_password_cb *cb, void *u);

int i2d_PKCS8PrivateKey_nid_bio(BIO *bp, const EVP_PKEY *x, int nid,
                                char *kstr, int klen,
                                pem_password_cb *cb, void *u);

int i2d_PKCS8PrivateKey_nid_fp(FILE *fp, const EVP_PKEY *x, int nid,
                               char *kstr, int klen,
                               pem_password_cb *cb, void *u);

🦋 DESCRIPTION 🦋

so the PKCS#8 functions encode and decode private keys in PKCS#8 format, and they do it using both PKCS#5 v1.5 and PKCS#5 v2.0 password based encryption algorithms. versatile queen. 👑

and here's the tea: other than the fact that they use DER instead of PEM, these functions are identical to the corresponding PEM function — the one described over in PEM_read_PrivateKey(3). same energy, different wrapper. 🎀

💀 NOTES 💀

  • rn, these functions are literally the only way to store encrypted private keys using DER format. the moment. the only one. ⭐
  • currently all the functions use BIOs or FILE pointers — there are no functions that support password-protection and work directly on memory. and like… bestie, it's fine, you can absolutely work around it by converting the buffers to memory BIOs, see BIO_s_mem(3) for the details. 🧚
  • if you don't need password-protection at all, i2d_PKCS8PrivateKey(3) encodes a private key to an unencrypted DER PKCS#8 form. no password, no drama. 💅
  • and these functions make no assumption regarding the pass phrase they get from the password callback. nope. it will simply be treated as a byte sequence. that's it. no vibes-checking, no trimming, no guessing. 🙈

🌈 RETURN VALUES 🌈

  • d2i_PKCS8PrivateKey_bio() and d2i_PKCS8PrivateKey_fp() return a valid EVP_PKEY structure, or NULL if an error occurred. 😭
  • i2d_PKCS8PrivateKey_bio(), i2d_PKCS8PrivateKey_fp(), i2d_PKCS8PrivateKey_nid_bio() and i2d_PKCS8PrivateKey_nid_fp() return 1 on success or 0 on error. iconic binary behaviour. 🔥

👑 SEE ALSO 👑

🎀 HISTORY 🎀

i2d_PKCS8PrivateKey(3) was added in OpenSSL 3.6. new-ish but thriving. ✨

Copyright 2002-2025 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

aaaand that's the whole page, bestie, you ate it. 🫶 this was OpenSSL 4.0.3, dated 2026-09-29, and it lives in section 3SSL of the manual — go forth and encrypt responsibly. mwah. 💖🌸🦋

📦 where this page comes from