EVP_ASYM_CIPHER-RSA(7ossl)

📦
version 15.1 · 3 versions
, in freebsd 15.1

💅 EVP_ASYM_CIPHER-RSA — RSA Asymmetric Cipher algorithm support

okay so this is the EVP_ASYM_CIPHER-RSA(7ossl) page from the OpenSSL manual, and bestie, it's literally all about how RSA does its asymmetric cipher thing ✨ Pull up a chair, we're getting into padding modes.

🌸 NAME

EVP_ASYM_CIPHER-RSA — RSA Asymmetric Cipher algorithm support 🎀

🦋 DESCRIPTION

Asymmetric Cipher support for the RSA key type. That's the whole vibe. No cap. 💜

💫 RSA Asymmetric Cipher parameters

🔥 The string-form padding tea

  • "pad-mode" (OSSL_ASYM_CIPHER_PARAM_PAD_MODE) <UTF8 string> — the default provider understands these RSA padding modes when they're handed over as a string:
    • "none" (OSSL_PKEY_RSA_PAD_MODE_NONE)
    • "oaep" (OSSL_PKEY_RSA_PAD_MODE_OAEP)
    • "pkcs1" (OSSL_PKEY_RSA_PAD_MODE_PKCSV15) — ⚠️ heads up: this padding mode is no longer supported by the FIPS provider for key agreement and key transport. That's a FIPS 140-3 requirement, not me being dramatic. Check out "OPTIONS" in openssl-fipsinstall(1) under -rsa_pkcs15_pad_disabled.
    • "x931" (OSSL_PKEY_RSA_PAD_MODE_X931)

🔢 The integer-form padding tea

  • "pad-mode" (OSSL_ASYM_CIPHER_PARAM_PAD_MODE) <integer> — same param, but the default provider also gets it as a number. The roster:
    • 1 (RSA_PKCS1_PADDING) — ⚠️ again, this padding mode is no longer supported by the FIPS provider for key agreement and key transport (FIPS 140-3 requirement, fr fr).
    • 3 (RSA_NO_PADDING)
    • 4 (RSA_PKCS1_OAEP_PADDING)
    • 5 (RSA_X931_PADDING)

See EVP_PKEY_CTX_set_rsa_padding(3) for further details 🫶

🎀 The rest of the parameter squad

  • "digest" (OSSL_ASYM_CIPHER_PARAM_OAEP_DIGEST) <UTF8 string>
  • "digest-props" (OSSL_ASYM_CIPHER_PARAM_OAEP_DIGEST_PROPS) <UTF8 string>
  • "mgf1-digest" (OSSL_ASYM_CIPHER_PARAM_MGF1_DIGEST) <UTF8 string>
  • "mgf1-digest-props" (OSSL_ASYM_CIPHER_PARAM_MGF1_DIGEST_PROPS) <UTF8 string>
  • "oaep-label" (OSSL_ASYM_CIPHER_PARAM_OAEP_LABEL) <octet string>
  • "tls-client-version" (OSSL_ASYM_CIPHER_PARAM_TLS_CLIENT_VERSION) <unsigned integer> — see RSA_PKCS1_WITH_TLS_PADDING on the page EVP_PKEY_CTX_set_rsa_padding(3).
  • "tls-negotiated-version" (OSSL_ASYM_CIPHER_PARAM_TLS_CLIENT_VERSION) <unsigned integer> — see RSA_PKCS1_WITH_TLS_PADDING on the page EVP_PKEY_CTX_set_rsa_padding(3).
🙈 and yes, both of those say OSSL_ASYM_CIPHER_PARAM_TLS_CLIENT_VERSION — that's genuinely how the page reads, I'm not out here editing docs, iykyk.

See "Asymmetric Cipher Parameters" in provider-asym_cipher(7) for more information 💖

👑 FIPS provider bonus round

The OpenSSL FIPS provider also supports the following parameters:

  • "fips-indicator" (OSSL_ASYM_CIPHER_PARAM_FIPS_APPROVED_INDICATOR) <integer>
  • "key-check" (OSSL_ASYM_CIPHER_PARAM_FIPS_KEY_CHECK) <integer>

See "Asymmetric Cipher Parameters" in provider-asym_cipher(7) for more information ✨

  • "pkcs15-pad-disabled" (OSSL_ASYM_CIPHER_PARAM_FIPS_RSA_PKCS15_PAD_DISABLED) <integer> — the default value of 1 causes an error during encryption if the RSA padding mode is set to "pkcs1". Setting this to zero will ignore the error and set the approved "fips-indicator" to 0.
💀 lowkey important: this option breaks FIPS compliance if it causes the approved "fips-indicator" to return 0. Not a slay. Proceed with caution.

🌈 SEE ALSO

EVP_PKEY-RSA(7), EVP_PKEY(3), provider-asym_cipher(7), provider-keymgmt(7), OSSL_PROVIDER-default(7) OSSL_PROVIDER-FIPS(7)

Copyright 2022-2025 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

okay that's the whole page, periodt 💅 big kiss to the OpenSSL girlies — this gem is from [OpenSSL 3.5.6], dated [2026-04-07], and it's filed under EVP_ASYM_CIPHER-RSA(7ossl) 🎀✨🦋 go encrypt something, bestie 🫶

📦 where this page comes from