EVP_KEM-X25519(7ossl)

💜 EVP_KEM-X25519 — the X25519 & X448 KEM moment (7ossl)

okay so bestie, welcome to EVP_KEM-X25519, aka the 7ossl manual page for EVP_KEM-X25519, EVP_KEM-X448 — the EVP_KEM X25519 and EVP_KEM X448 keytype and algorithm support. yes that's a mouthful, but we move 💅

---

✨ NAME ✨

EVP_KEM-X25519, EVP_KEM-X448 — EVP_KEM X25519 and EVP_KEM X448 keytype and algorithm support. that's it, that's the whole vibe check 🦋

---

🌸 DESCRIPTION 🌸

The X25519 and <X448> keytype and its parameters? yeah, those live over in EVP_PKEY-X25519(7) — go say hi. and if you want the actual tea on how stuff gets wrapped up, peep EVP_PKEY_encapsulate(3) and EVP_PKEY_decapsulate(3) for more info 🫶

🔥 X25519 and X448 KEM parameters 🔥

• "operation" (OSSL_KEM_PARAM_OPERATION) <UTF8 string> — this is the operating-mode knob, and lowkey the OpenSSL X25519 and X448 Key Encapsulation Mechanisms only support the following default operation (operating mode):
  • "DHKEM" (OSSL_KEM_PARAM_OPERATION_DHKEM) — bestie, here's what goes down: the encapsulate function generates an ephemeral keypair. it produces keymaterial by doing an X25519 or X448 key exchange using the ephemeral private key and a supplied recipient public key. a HKDF operation using the keymaterial and a kem context then produces a shared secret. the shared secret and the ephemeral public key are returned. then the decapsulate function uses the recipient private key and the ephemeral public key to produce the same keymaterial, which can then be used to produce the same shared secret. iconic symmetry, no cap ✨ see <https://www.rfc-editor.org/rfc/rfc9180.html#name-dh-based-kem-dhkem>

this can be set using either EVP_PKEY_CTX_set_kem_op() or EVP_PKEY_CTX_set_params() — your choice, both slay 💅

• "ikme" (OSSL_KEM_PARAM_IKME) <octet string> — used to specify the key material used for generation of the ephemeral key. it should not be reused for other purposes (fr fr, don't do it 🙈). it should have a length of at least 32 for X25519, and 56 for X448. if this value is not set, then a random ikm is used — cute, automatic, effortless 🌈

---

👑 CONFORMING TO 👑

RFC9180 — we stay conforming, periodt.

---

🎀 SEE ALSO 🎀

EVP_PKEY_CTX_set_kem_op(3), EVP_PKEY_encapsulate(3), EVP_PKEY_decapsulate(3) EVP_KEYMGMT(3), EVP_PKEY(3), provider-keymgmt(7) — the whole friend group, go read them 🫶

---

🦋 HISTORY 🦋

This functionality was added in OpenSSL 3.2. 💖

the plot twist: the "operation" (operating mode) was a required parameter prior to OpenSSL 3.5. as of OpenSSL 3.5, "DHKEM" is the default operating mode, and no explicit value need be specified. glow-up achieved ✨

---

💀 COPYRIGHT 💀

Copyright 2022-2025 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

and that's the page, bestie 🍓 — this was version 3.5.6, dated 2026-04-07, and yes that's the EVP_KEM-X25519(7ossl) manual. mwah 💋🧚