EVP_ASYM_CIPHER-RSA(7ossl)

📦 version 3.5.0, in opensuse-leap 16.0

🌸 NAME 🌸

EVP_ASYM_CIPHER-RSA — the RSA Asymmetric Cipher algorithm support page, bestie. This is 7ossl (section 7, OpenSSL vibes), and it's literally the whole rundown on how the RSA key type does asymmetric cipher things ✨

💖 DESCRIPTION 💖

So. Asymmetric Cipher support for the RSA key type. That's the vibe. Now let's get into the actual deets, because there are a lot of parameters and they all matter 👑

🎀 RSA Asymmetric Cipher parameters 🎀

  • "pad-mode" (OSSL_ASYM_CIPHER_PARAM_PAD_MODE) <UTF8 string> — the default provider understands these RSA padding modes when you hand them over in string form 🦋
    • "none" (OSSL_PKEY_RSA_PAD_MODE_NONE)
    • "oaep" (OSSL_PKEY_RSA_PAD_MODE_OAEP)
    • "pkcs1" (OSSL_PKEY_RSA_PAD_MODE_PKCSV15) — ⚠️ heads up, this padding mode is no longer supported by the FIPS provider for key agreement and key transport. (This is a FIPS 140-3 requirement — not me being dramatic, it's the rules.)
    • "x931" (OSSL_PKEY_RSA_PAD_MODE_X931)
  • "pad-mode" (OSSL_ASYM_CIPHER_PARAM_PAD_MODE) <integer> — and the default provider also gets these RSA padding modes when you pass them as integers, no cap 🫶
    • 1 (RSA_PKCS1_PADDING) — again, this padding mode is no longer supported by the FIPS provider for key agreement and key transport. (FIPS 140-3 requirement, same energy as above.)
    • 3 (RSA_NO_PADDING)
    • 4 (RSA_PKCS1_OAEP_PADDING)
    • 5 (RSA_X931_PADDING)

See EVP_PKEY_CTX_set_rsa_padding(3) for further details 👀

  • "digest" (OSSL_ASYM_CIPHER_PARAM_OAEP_DIGEST) <UTF8 string>
  • "digest-props" (OSSL_ASYM_CIPHER_PARAM_OAEP_DIGEST_PROPS) <UTF8 string>
  • "mgf1-digest" (OSSL_ASYM_CIPHER_PARAM_MGF1_DIGEST) <UTF8 string>
  • "mgf1-digest-props" (OSSL_ASYM_CIPHER_PARAM_MGF1_DIGEST_PROPS) <UTF8 string>
  • "oaep-label" (OSSL_ASYM_CIPHER_PARAM_OAEP_LABEL) <octet string>
  • "tls-client-version" (OSSL_ASYM_CIPHER_PARAM_TLS_CLIENT_VERSION) <unsigned integer> — see RSA_PKCS1_WITH_TLS_PADDING on the page EVP_PKEY_CTX_set_rsa_padding(3) 💅
  • "tls-negotiated-version" (OSSL_ASYM_CIPHER_PARAM_TLS_CLIENT_VERSION) <unsigned integer> — see RSA_PKCS1_WITH_TLS_PADDING on the page EVP_PKEY_CTX_set_rsa_padding(3) 💅

See "Asymmetric Cipher Parameters" in provider-asym_cipher(7) for more information 🌈

The OpenSSL FIPS provider also supports the following parameters, and yes, they're iconic in their own way:

  • "fips-indicator" (OSSL_ASYM_CIPHER_PARAM_FIPS_APPROVED_INDICATOR) <integer>
  • "key-check" (OSSL_ASYM_CIPHER_PARAM_FIPS_KEY_CHECK) <integer>

See "Asymmetric Cipher Parameters" in provider-asym_cipher(7) for more information 🌸

  • "pkcs15-pad-disabled" (OSSL_ASYM_CIPHER_PARAM_FIPS_RSA_PKCS15_PAD_DISABLED) <integer> — okay so the default value of 1 causes an error during encryption if the RSA padding mode is set to "pkcs1". Setting this to zero will ignore the error and set the approved "fips-indicator" to 0. 🚨 And real talk: this option breaks FIPS compliance if it causes the approved "fips-indicator" to return 0. So like... know what you're doing, bestie.

🦋 SEE ALSO 🦋

EVP_PKEY-RSA(7), EVP_PKEY(3), provider-asym_cipher(7), provider-keymgmt(7), OSSL_PROVIDER-default(7) OSSL_PROVIDER-FIPS(7) — go read these, they're the supporting cast and they ate 💜

Copyright 2022-2024 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

and that's the page, bestie 🎀✨ this was version 3.5.0, dated 2026-09-25 — the EVP_ASYM_CIPHER-RSA(7ossl) glow-up, signed off with love 💖🦋🌸

📦 where this page comes from