EVP(3)

💅 EVP(3) — okay bestie, this is the Library Functions Manual page for evp and she is GORGEOUS ✨

🌸 NAME 🌸

evp — high-level cryptographic functions</p> 🔥 like the wrapper that makes all the scary crypto actually usable, periodt.

---

🦋 SYNOPSIS 🦋

#include <openssl/evp.h>

That's it. One include and you're in. 💅

---

🎀 DESCRIPTION 🎀

Okay so the EVP library gives you a high-level interface to cryptographic functions. And the abbreviation “EVP” is intended to mean “EnVeloPe” — like, in the sense of “wrapper library”. 🫶

⚠️ But bestie, hear me — it is NOT related to the technical meaning of the term “envelope” in contexts like CMS_encrypt(3), EVP_SealInit(3), PKCS7_encrypt(3), or SMIME_write_ASN1(3). Two different envelopes, iykyk. Don't mix them up. 🙈

EVP_SealInit(3) and EVP_OpenInit(3) are the ones that actually do public key encryption and decryption, implementing those digital "envelopes". 📨

The EVP_DigestSignInit(3) and EVP_DigestVerifyInit(3) functions implement digital signatures and Message Authentication Codes (MACs). And yes, the older EVP_SignInit(3) and EVP_VerifyInit(3) functions exist too — they're giving legacy icon energy. 👑

Symmetric encryption? That's available with the EVP_EncryptInit(3) functions. 💖 Message digests? Those live in the EVP_DigestInit(3) functions.

Authenticated encryption with additional data (AEAD) — the ✨fancy✨ one — is available with the EVP_AEAD_CTX_init(3) functions.

---

🌈 The EVP_PKEY_*() era 🌈

The EVP_PKEY_*() functions provide a high-level interface to asymmetric algorithms. Literally the main character of this whole page.

• To create a new EVP_PKEY, see EVP_PKEY_new(3).
• EVP_PKEYs can be associated with a private key of a particular algorithm by using the functions described in the EVP_PKEY_set1_RSA(3) page — yes, that page, go read it 🫶
• Or you can generate brand-new keys using EVP_PKEY_keygen(3). 🔑
• And once you have them, EVP_PKEYs can be compared using EVP_PKEY_cmp(3), or printed using EVP_PKEY_print_private(3). 💅

The EVP_PKEY_*() functions support the full range of asymmetric algorithm operations, and here's the rundown:

• 🌸 For key agreement, see EVP_PKEY_derive(3).
• 🦋 For signing and verifying, see EVP_PKEY_sign(3), EVP_PKEY_verify(3), and EVP_PKEY_verify_recover(3). But — and I cannot stress this enough — note that these functions do not perform a digest of the data to be signed. 😭 So normally you would use the EVP_DigestSignInit(3) functions for this purpose instead. Like, literally that's the vibe.
• 🔥 For encryption and decryption, see EVP_PKEY_encrypt(3) and EVP_PKEY_decrypt(3), respectively. However (again, important), note that these functions perform encryption and decryption only. And because public key encryption is an expensive operation, normally you would wrap an encrypted message in a digital envelope using the EVP_SealInit(3) and EVP_OpenInit(3) functions. 💌

---

🍓 Password-based stuff 🍓

The EVP_BytesToKey(3) function provides some limited support for password based encryption. Careful selection of the parameters will provide a PKCS#5 PBKDF1 compatible implementation. 👑

💀 But real talk: new applications should typically not use this — preferring, for example, PBKDF2 from PCKS#5. (Yes, the typo is canon, I don't make the rules.) 🙈

---

🧚 Base64 moment 🧚

The EVP_EncodeInit(3) family of functions provides base64 encoding and decoding. Slay, honestly. ⭐

---

💜 SEE ALSO 💜

Okay, this list is long, so buckle up bestie — every single one, no skipping, no cap. 📋✨

• ASN1_item_digest(3)
• ASN1_item_sign(3)
• BIO_f_cipher(3)
• BIO_f_md(3)
• CMAC_Init(3)
• CMS_encrypt(3)
• CMS_sign(3)
• crypto(3)
• d2i_PKCS8PrivateKey_bio(3)
• d2i_PrivateKey(3)
• EVP_AEAD_CTX_init(3)
• EVP_aes_128_cbc(3)
• EVP_BytesToKey(3)
• EVP_camellia_128_cbc(3)
• EVP_chacha20(3)
• EVP_CIPHER_CTX_ctrl(3)
• EVP_CIPHER_CTX_get_cipher_data(3)
• EVP_CIPHER_CTX_init(3)
• EVP_CIPHER_CTX_set_flags(3)
• EVP_CIPHER_do_all(3)
• EVP_CIPHER_meth_new(3)
• EVP_CIPHER_nid(3)
• EVP_des_cbc(3)
• EVP_DigestInit(3)
• EVP_DigestSignInit(3)
• EVP_DigestVerifyInit(3)
• EVP_EncodeInit(3)
• EVP_EncryptInit(3)
• EVP_MD_CTX_ctrl(3)
• EVP_MD_nid(3)
• EVP_OpenInit(3)
• EVP_PKCS82PKEY(3)
• EVP_PKEY_asn1_get_count(3)
• EVP_PKEY_cmp(3)
• EVP_PKEY_CTX_ctrl(3)
• EVP_PKEY_CTX_get_operation(3)
• EVP_PKEY_CTX_new(3)
• EVP_PKEY_CTX_set_hkdf_md(3)
• EVP_PKEY_decrypt(3)
• EVP_PKEY_derive(3)
• EVP_PKEY_encrypt(3)
• EVP_PKEY_get_default_digest_nid(3)
• EVP_PKEY_keygen(3)
• EVP_PKEY_new(3)
• EVP_PKEY_print_private(3)
• EVP_PKEY_set1_RSA(3)
• EVP_PKEY_sign(3)
• EVP_PKEY_size(3)
• EVP_PKEY_verify(3)
• EVP_PKEY_verify_recover(3)
• EVP_rc4(3)
• EVP_SealInit(3)
• EVP_sha1(3)
• EVP_sha3_224(3)
• EVP_SignInit(3)
• EVP_sm3(3)
• EVP_sm4_cbc(3)
• EVP_VerifyInit(3)
• HMAC(3)
• OCSP_basic_sign(3)
• OCSP_request_sign(3)
• PEM_get_EVP_CIPHER_INFO(3)
• PEM_read_bio_PrivateKey(3)
• PKCS12_create(3)
• PKCS5_PBKDF2_HMAC(3)
• PKCS7_encrypt(3)
• PKCS7_sign(3)
• RSA_pkey_ctx_ctrl(3)
• SSL_CTX_set_tlsext_ticket_key_cb(3)
• X509_ALGOR_set0(3)
• X509_check_private_key(3)
• X509_digest(3)
• X509_get_pubkey(3)
• X509_PUBKEY_set(3)
• X509_sign(3)
• X509_to_X509_REQ(3)

---

And that's the whole page, bestie. 🫶 She's from Debian, dated December 6, 2024, and she ate. 💅✨ Go forth and #include <openssl/evp.h> responsibly. 🎀