EVP_KEM-RSA(7ossl)

📦
version 15.1 · 3 versions
, in freebsd 15.1

💅 EVP_KEM-RSA

okay so bestie, welcome to EVP_KEM-RSA — that's page 7 of the ossl manual, and it's literally all about the RSA keytype's KEM (key encapsulation mechanism) support. glad you're here, grab a strawberry 🍓

🌸 NAME 🌸

EVP_KEM-RSA — the EVP_KEM RSA keytype and algorithm support. yes, both. she does it all 💅

✨ DESCRIPTION ✨

so the RSA keytype and all its parameters get their whole own moment in EVP_PKEY-RSA(7) — go read that if you want the full tea 🫖. and if you want the deets on encapsulating and decapsulating, that's EVP_PKEY_encapsulate(3) and EVP_PKEY_decapsulate(3). iykyk.

🔑 RSA KEM parameters

  • "operation" (OSSL_KEM_PARAM_OPERATION) <UTF8 string> — the operating mode, basically. the OpenSSL RSA Key Encapsulation Mechanism only currently supports this one default operation (operating mode) down below 👇
    • "RSASVE" — okay so the encapsulate function simply generates a secret using random bytes and then encrypts that secret using the RSA public key (with no padding). then the decapsulate function recovers the secret using the RSA private key. that's the whole vibe. ✨

you can set this using EVP_PKEY_CTX_set_kem_op().

  • "fips-indicator" (OSSL_KEM_PARAM_FIPS_APPROVED_INDICATOR) <integer> — described in provider-kem(7), go look 👀
  • "key-check" (OSSL_KEM_PARAM_FIPS_KEY_CHECK) <integer> — also described in provider-kem(7), same place, same energy 💜

📜 CONFORMING TO 📜

  • SP800-56Br2
    • Section 7.2.1.2 RSASVE Generate Operation (RSASVE.GENERATE).
    • Section 7.2.1.3 RSASVE Recovery Operation (RSASVE.RECOVER).

like, she's certified. periodt. 👑

👀 SEE ALSO 👀

EVP_PKEY_CTX_set_kem_op(3), EVP_PKEY_encapsulate(3), EVP_PKEY_decapsulate(3) EVP_KEYMGMT(3), EVP_PKEY(3), provider-keymgmt(7)

🦋 HISTORY 🦋

this functionality was added in OpenSSL 3.0. iconic behavior honestly.

and okay, here's the lore 🫶: the "operation" (operating mode) used to be a required parameter prior to OpenSSL 3.5. but as of OpenSSL 3.5, "RSASVE" is the default operating mode, and no explicit value need be specified. glow-up fr fr 💖

Copyright 2020-2025 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

and that's the whole page, bestie!! 🌈 this one's from OpenSSL 3.5.6, dated 2026-04-07, and it lives at EVP_KEM-RSA(7ossl) in the manual — mwah, go encapsulate something 💋💅

📦 where this page comes from