OSSL_PROVIDER-BASE(7ossl)

📦
version 15.1 · 3 versions
, in freebsd 15.1

💅 OSSL_PROVIDER-BASE (7ossl) — the OpenSSL base provider, explained bestie-style

okay so real talk, this is the manual page for the OpenSSL base provider. It lives in the 7ossl section of the manual, and it's genuinely one of the most useful pages to know about. Let's get into it 💖

✨ NAME ✨

OSSL_PROVIDER-base — the OpenSSL base provider. That's it, that's the name, she's iconic and she knows it 🎀

🌸 DESCRIPTION 🌸

The OpenSSL base provider is the one that supplies the encoding for OpenSSL's asymmetric cryptography. So when you need your keys and params turned into bytes (or bytes turned back into keys), this is the girl doing the work 🦋

🔍 Properties

The implementations in this provider specifically have this property defined:

  • "provider=base"

You can use it in a property query string with fetching functions. It isn't mandatory to query for this property — except if you want to make sure you get implementations of this provider and none other. Then it's highkey essential, no cap.

Then there's these three:

  • "type=parameters"
  • "type=private"
  • "type=public"

You can use these in a property query string with fetching functions to select which data are to be encoded. So: either the private key material, the public key material, or the domain parameters can be selected. Pick your fighter 💅

And for output formats:

  • "format=der"
  • "format=pem"
  • "format=text"

These may be used in a property query string with fetching functions to select the encoding output format. Either DER, PEM and plaintext are currently permitted. Three vibes, all valid ✨

👑 OPERATIONS AND ALGORITHMS 👑

The OpenSSL base provider supports these operations and algorithms — and bestie, it's a lot, so buckle up:

🎲 Random Number Generation

In addition to this provider, the "SEED-SRC" and "JITTER" algorithms are also available in the default provider. So you're not locked in, but like… she's got them too 😌

🔐 Asymmetric Key Encoder

RSA
RSA-PSS
DH
DHX
DSA
EC
ED25519
ED448
X25519
X448
SM2
ML-DSA-44
ML-DSA-65
ML-DSA-87
ML-KEM-512
ML-KEM-768
ML-KEM-1024
SLH-DSA-SHA2-128s
SLH-DSA-SHA2-128f
SLH-DSA-SHA2-192s
SLH-DSA-SHA2-192f
SLH-DSA-SHA2-256s
SLH-DSA-SHA2-256f
SLH-DSA-SHAKE-128s
SLH-DSA-SHAKE-128f
SLH-DSA-SHAKE-192s
SLH-DSA-SHAKE-192f
SLH-DSA-SHAKE-256s
SLH-DSA-SHAKE-256f

In addition to this provider, all of these encoding algorithms are also available in the default provider. Some of these algorithms may be used in combination with the FIPS provider. Ate, honestly 🔥

🔓 Asymmetric Key Decoder

RSA
RSA-PSS
DH
DHX
DSA
EC
ED25519
ED448
X25519
X448
SM2
DER
ML-DSA-44
ML-DSA-65
ML-DSA-87
ML-KEM-512
ML-KEM-768
ML-KEM-1024
SLH-DSA-SHA2-128s
SLH-DSA-SHA2-128f
SLH-DSA-SHA2-192s
SLH-DSA-SHA2-192f
SLH-DSA-SHA2-256s
SLH-DSA-SHA2-256f
SLH-DSA-SHAKE-128s
SLH-DSA-SHAKE-128f
SLH-DSA-SHAKE-192s
SLH-DSA-SHAKE-192f
SLH-DSA-SHAKE-256s
SLH-DSA-SHAKE-256f

⚠️ heads up: this decoder list is not identical to the encoder list above — it's got DER in there, and it does not have ML-KEM-...? wait, no — it does have all the ML-KEM ones, it just has DER extra and no format shenanigans. Anyway: same deal, in addition to this provider, all of these decoding algorithms are also available in the default provider. Some of these algorithms may be used in combination with the FIPS provider 🌈

ngl the decoder list literally includes DER as an algorithm name and the encoder list doesn't — that's just how it is, don't come for me, I'm reporting the facts 💀

🗄️ Stores

In addition to this provider, all of these store algorithms are also available in the default provider. Periodt 🫶

🦋 SEE ALSO 🦋

📜 HISTORY 📜

This functionality was added in OpenSSL 3.0.

Support for ML-DSA and <ML-KEM> was added in OpenSSL 3.5.

(iykyk — the angle brackets around ML-KEM are literally in the original, so I'm keeping them, character for character 🙈)

Copyright 2020-2025 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

okay that's the whole page, bestie, you're now officially a base provider expert 🧚✨ slay

this was page OSSL_PROVIDER-BASE(7ossl), version 3.5.6, dated 2026-04-07 — mwah, go read the default provider page next 💋💖

📦 where this page comes from