OPENSSL-GLOSSARY(7ossl)

📦
version 15.1 · 3 versions
, in freebsd 15.1

✨ NAME ✨

Okay so bestie, this is the openssl-glossary page, served in section 7ossl, and it's literally the ultimate cheat sheet for all the OpenSSL terminology. The way this is gonna make everything click, I'm obsessed. 💅

💖 DESCRIPTION 💖

Alright bestie, buckle up. This is the glossary that gives you the 411 on all the OpenSSL words you're gonna see floating around. No cap, it's giving main character energy for your documentation journey. ✨

🎀 Algorithm 🎀

Okay so picture this: cryptographic primitives like the SHA256 digest or AES encryption? OpenSSL calls those "algorithms." And the ICONIC part? You can have more than one implementation of the SAME algorithm available for use. Slay. 💖

crypto(7)

🎀 ASN.1, ASN1 🎀

ASN.1 ("Abstract Syntax Notation One") is like, a whole notation for describing abstract types and values. It's defined in the ITU-T documents X.680 to X.683, and here they all are:

🎀 Base Provider 🎀

An OpenSSL Provider that contains encoders and decoders for OpenSSL keys. And guess what? All the algorithm implementations in the Base Provider are also available in the Default Provider. So it's like, the understudy that still ate. 🫶

OSSL_PROVIDER-base(7)

🎀 Decoder 🎀

A decoder is a type of algorithm used for decoding keys and parameters from some external format such as PEM or DER. It's giving reverse uno card but make it cryptographic. 😭

OSSL_DECODER_CTX_new_for_pkey(3)

🎀 Default Provider 🎀

An OpenSSL Provider that contains the most common OpenSSL algorithm implementations. It is loaded by default if no other provider is available. And all the algorithm implementations in the Base Provider are also available in the Default Provider. The way that's giving inclusive queen energy. 👑

OSSL_PROVIDER-default(7)

🎀 DER ("Distinguished Encoding Rules") 🎀

DER is a binary encoding of data, structured according to an ASN.1 specification. This is a common encoding used for cryptographic objects such as private and public keys, certificates, CRLs, ... and it's defined in ITU-T document X.690:

https://www.itu.int/rec/T-REC-X.690

🎀 Encoder 🎀

An encoder is a type of algorithm used for encoding keys and parameters to some external format such as PEM or DER. Basically the opposite of a decoder, and honestly? A little icon. 💅

OSSL_ENCODER_CTX_new_for_pkey(3)

🎀 Explicit Fetching 🎀

Explicit Fetching is a type of Fetching (see Fetching). Explicit Fetching is where a function call is made to obtain an algorithm object representing an implementation such as EVP_MD_fetch(3) or EVP_CIPHER_fetch(3). It's literally calling it out by name, no subtlety. Periodt.

🎀 Fetching 🎀

Fetching is the process of looking through the available algorithm implementations, applying selection criteria (via a property query string), and finally choosing the implementation that will be used. Also see Explicit Fetching and Implicit Fetching. The way that whole selection process is giving job interview energy, I can't. 💀

crypto(7)

🎀 FIPS Provider 🎀

An OpenSSL Provider that contains OpenSSL algorithm implementations that have been validated according to the FIPS 140-2 standard. Very official, very certified, very "I have my credentials" vibes. 🌈

OSSL_PROVIDER-FIPS(7)

🎀 Implicit Fetching 🎀

Implicit Fetching is a type of Fetching (see Fetching). Implicit Fetching is where an algorithm object with no associated implementation is used such as the return value from EVP_sha256(3) or EVP_aes_128_cbc(3). With implicit fetching an implementation is fetched automatically using default selection criteria the first time the algorithm is used. So it's like, the algorithm just slides in when it's needed. Lowkey magical. 🦋

🎀 Legacy Provider 🎀

An OpenSSL Provider that contains algorithm implementations that are considered insecure or are no longer in common use. It's giving throwback vibes but make it a security warning. 🙈

OSSL_PROVIDER-legacy(7)

🎀 Library Context 🎀

A Library Context in OpenSSL is represented by the type OSSL_LIB_CTX. It can be thought of as a scope within which configuration options apply. If an application does not explicitly create a library context then the "default" one is used. Many OpenSSL functions can take a library context as an argument. A NULL value can always be passed to indicate the default library context. So it's like, a little bubble of config energy. 🎀

OSSL_LIB_CTX(3)

🎀 MSBLOB 🎀

MSBLOB is a Microsoft specific binary format for RSA and DSA keys, both private and public. This form is never passphrase protected. So no secret handshake here, bestie. 😭

🎀 Null Provider 🎀

An OpenSSL Provider that contains no algorithm implementations. This can be useful to prevent the default provider from being automatically loaded in a library context. It's literally the empty void provider, and sometimes that's exactly the vibe you need. 💀

OSSL_PROVIDER-null(7)

🎀 Operation 🎀

An operation is a group of OpenSSL functions with a common purpose such as encryption, or digesting. It's giving friend group with a shared goal, and honestly? Iconic. 👑

crypto(7)

🎀 PEM ("Privacy Enhanced Message") 🎀

PEM is a format used for encoding of binary content into a mail and ASCII friendly form. The content is a series of base64-encoded lines, surrounded by begin/end markers each on their own line. For example:

-----BEGIN PRIVATE KEY-----
MIICdg....
... bhTQ==
-----END PRIVATE KEY-----

Optional header line(s) may appear after the begin line, and their existence depends on the type of object being written or read. For all OpenSSL uses, the binary content is expected to be a DER encoded structure. And this is defined in IETF RFC 1421:

https://tools.ietf.org/html/rfc1421

🎀 PKCS#8 🎀

PKCS#8 is a specification of ASN.1 structures that OpenSSL uses for storing or transmitting any private key in a key type agnostic manner. There are two structures worth noting for OpenSSL use, one that contains the key data in unencrypted form (known as "PrivateKeyInfo") and an encrypted wrapper structure (known as "EncryptedPrivateKeyInfo"). It's giving "I can be anyone's key, I don't discriminate" energy. 💖

This is specified in RFC 5208:

https://tools.ietf.org/html/rfc5208

🎀 Property 🎀

A property is a way of classifying and selecting algorithm implementations. A property is a key/value pair expressed as a string. For example all algorithm implementations in the default provider have the property "provider=default". An algorithm implementation can have multiple properties defined against it. Also see Property Query String. It's like the tags on your fave posts, but for algorithms. ✨

property(7)

🎀 Property Query String 🎀

A property query string is a string containing a sequence of properties that can be used to select an algorithm implementation. For example the query string "provider=example,foo=bar" will select algorithms from the "example" provider that have a "foo" property defined for them with a value of "bar". Property Query Strings are used during fetching. See Fetching. It's literally the search filter for your algorithm needs. 🔥

property(7)

🎀 Provider 🎀

A provider in OpenSSL is a component that groups together algorithm implementations. Providers can come from OpenSSL itself or from third parties. It's giving collective energy, and honestly? A little iconic. 🌸

provider(7)

🎀 PVK 🎀

PVK is a Microsoft specific binary format for RSA and DSA private keys. This form may be passphrase protected. So unlike MSBLOB, this one can have a little secret password moment. 🙈

🎀 SubjectPublicKeyInfo 🎀

SubjectPublicKeyInfo is an ASN.1 structure that OpenSSL uses for storing and transmitting any public key in a key type agnostic manner. This is specified as part of the specification for certificates, RFC 5280:

https://tools.ietf.org/html/rfc5280

🌈 HISTORY 🌈

This glossary was added in OpenSSL 3.0. So it's like, a modern classic at this point. Slay. 💅

Copyright 2020-2022 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at https://www.openssl.org/source/license.html. So like, read the license bestie, it's important. 🫶

This iconic page is from OpenSSL version 3.5.6, dated 2026-04-07, and it's literally serving OPENSSL-GLOSSARY(7ossl) energy. Periodt. 💖✨

📦 where this page comes from