EVP_KEM-X25519(7ossl)

📦 version 3.5.0, in opensuse-leap 16.0

💖 NAME 💖

ok so bestie, welcome to EVP_KEM-X25519 — that's the page you're on, one of the OpenSSL family of manuals, and honestly it's a whole vibe. This page covers EVP_KEM-X25519 and EVP_KEM-X448: the EVP_KEM X25519 and EVP_KEM X448 keytype and algorithm support. That's it, that's the headline, and yes it's giving "small page, big personality" ✨

🌸 DESCRIPTION 🌸

So the X25519 and X448 keytype plus all its parameters? Already documented over in EVP_PKEY-X25519(7) — go read that one for the deets. And if you want more info on the encapsulate/decapsulate side of things, EVP_PKEY_encapsulate(3) and EVP_PKEY_decapsulate(3) are right there waiting for you 🫶

🎀 X25519 and X448 KEM parameters 🎀

  • "operation" (OSSL_KEM_PARAM_OPERATION) <UTF8 string> — this is the operating mode dial, and the OpenSSL X25519 and X448 Key Encapsulation Mechanisms only support this one default operation (operating mode), no cap:
    • "DHKEM" (OSSL_KEM_PARAM_OPERATION_DHKEM) — okay so here's the tea ☕: the encapsulate function generates an ephemeral keypair. It produces keymaterial by doing an X25519 or X448 key exchange using the ephemeral private key and a supplied recipient public key. Then a HKDF operation using that keymaterial and a kem context produces a shared secret. The shared secret and the ephemeral public key are what get returned 💅 Meanwhile the decapsulate function uses the recipient private key and the ephemeral public key to produce that same keymaterial, which can then be used to produce that same shared secret. Iconic symmetry, no notes. See https://www.rfc-editor.org/rfc/rfc9180.html#name-dh-based-kem-dhkem for the source material 🔥
    • This can be set using either EVP_PKEY_CTX_set_kem_op() or EVP_PKEY_CTX_set_params(). Two ways, pick your fighter.
  • "ikme" (OSSL_KEM_PARAM_IKME) <octet string> — this one is for specifying the key material used for generation of the ephemeral key. ⚠️ Big warning bestie: this value should not be reused for other purposes. The length should be at least 32 for X25519, and 56 for X448. If this value is not set, then a random ikm is used — so like, default behaviour still slays, no stress 🦋

🧚 CONFORMING TO 🧚

RFC9180 — that's the one, periodt 👑

⭐ SEE ALSO ⭐

EVP_PKEY_CTX_set_kem_op(3), EVP_PKEY_encapsulate(3), EVP_PKEY_decapsulate(3) EVP_KEYMGMT(3), EVP_PKEY(3), provider-keymgmt(7) — a whole little friend group of pages, go say hi 😌

💜 HISTORY 💜

This functionality was added in OpenSSL 3.2. ✨

And the glow-up: the "operation" (operating mode) used to be a required parameter prior to OpenSSL 3.5 😭 — like you literally had to type it out. As of OpenSSL 3.5, "DHKEM" is the default operating mode, and no explicit value need be specified. We love an upgrade that removes busywork 🎀

Copyright 2022-2025 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at https://www.openssl.org/source/license.html. 📜

aaand that's the page, bestie 💖 huge love, mwah 🫶 — officially brought to you by OpenSSL 3.5.0, dated 2026-09-25, signing off from EVP_KEM-X25519(7ossl) 🦋✨

📦 where this page comes from