OPENSSL-GLOSSARY(7ossl)

📦 version 3.5.0, in opensuse-leap 16.0

🦋 openssl-glossary 🦋

okay so this is the OpenSSL glossary, like from section 7ossl of the manual — it's the lil dictionary bestie, the one you open when someone in the group chat says "just fetch the provider" and you're like ??? 💀 Anyway. Every term, every cross-reference, all of it, coming right up ✨

✨ NAME ✨

openssl-glossary — An OpenSSL Glossary. that's it, that's the whole name. iconic of it honestly 🎀

💖 DESCRIPTION 💖

welcome to the word list!! read it like a vibe check for vocabulary, except every entry is real and load-bearing 🫶

🌸 Algorithm

cryptographic primitives like the SHA256 digest, or AES encryption — OpenSSL calls those "algorithms". and here's the thing: there can be more than one implementation for any given algorithm available for use. so the algorithm is the concept, the implementation is the actual code doing the work. iykyk 💅

also peep crypto(7).

🌸 ASN.1, ASN1

ASN.1 stands for ("Abstract Syntax Notation One") — it's a notation for describing abstract types and values. it's defined in the ITU-T documents X.680 to X.683:

like, all four of them. go read 'em if you're feeling brave 🦋

🌸 Base Provider

an OpenSSL Provider that contains encoders and decoders for OpenSSL keys. and here's the cute part — all the algorithm implementations in the Base Provider are also available in the Default Provider. so it's not a replacement situation, it's a "both, actually" situation 💖

see OSSL_PROVIDER-base(7).

🌸 Decoder

a decoder is a type of algorithm used for decoding keys and parameters from some external format such as PEM or DER. so it takes the outside-world bytes and turns them into OpenSSL things. reverse of an encoder, obviously, main character energy 🔥

see OSSL_DECODER_CTX_new_for_pkey(3).

🌸 Default Provider

an OpenSSL Provider that contains the most common OpenSSL algorithm implementations. it is loaded by default if no other provider is available. and yup, all the algorithm implementations in the Base Provider are also available in the Default Provider. (yes this is basically the same sentence as above, they're mutual, it's fine, it's giving mutuals 🫶)

see OSSL_PROVIDER-default(7).

🌸 DER ("Distinguished Encoding Rules")

DER is a binary encoding of data, structured according to an ASN.1 specification. super common encoding for cryptographic objects like private and public keys, certificates, CRLs, ... (the "..." is doing a lot of work there ngl 😭)

it's defined in ITU-T document X.690:

🌸 Encoder

an encoder is a type of algorithm used for encoding keys and parameters to some external format such as PEM or DER. it's the one packing your stuff up for the outside world. slay 💅

see OSSL_ENCODER_CTX_new_for_pkey(3).

🌸 Explicit Fetching

Explicit Fetching is a type of Fetching (see Fetching, bestie, it's literally the entry below). Explicit Fetching is where a function call is made to obtain an algorithm object representing an implementation — such as EVP_MD_fetch(3) or EVP_CIPHER_fetch(3). so you asked for it, out loud, on purpose. no cap ✨

🌸 Fetching

Fetching is the process of looking through the available algorithm implementations, applying selection criteria (via a property query string), and finally choosing the implementation that will be used. it's a whole lil audition process honestly 👑

also see Explicit Fetching and Implicit Fetching.

also peep crypto(7).

🌸 FIPS Provider

an OpenSSL Provider that contains OpenSSL algorithm implementations that have been validated according to the FIPS 140-2 standard. that's the whole personality of this provider. compliance queen 🌈

see OSSL_PROVIDER-FIPS(7).

🌸 Implicit Fetching

Implicit Fetching is a type of Fetching (see Fetching). Implicit Fetching is where an algorithm object with no associated implementation is used — such as the return value from EVP_sha256(3) or EVP_aes_128_cbc(3). with implicit fetching an implementation is fetched automatically using default selection criteria the first time the algorithm is used. so it just kinda... happens. no ask, just vibes 💀

🌸 Legacy Provider

an OpenSSL Provider that contains algorithm implementations that are considered insecure or are no longer in common use. tread carefully bestie, that's the whole point of it being quarantined over here 🙈

see OSSL_PROVIDER-legacy(7).

🌸 Library Context

a Library Context in OpenSSL is represented by the type OSSL_LIB_CTX. think of it as a scope within which configuration options apply. if an application doesn't explicitly create a library context then the "default" one is used. many OpenSSL functions can take a library context as an argument, and a NULL value can always be passed to indicate the default library context. so NULL is never wrong there, it's the cozy fallback 💜

see OSSL_LIB_CTX(3).

🌸 MSBLOB

MSBLOB is a Microsoft specific binary format for RSA and DSA keys, both private and public. and listen — this form is never passphrase protected. never ever. not even a little. so like, know that before you ship it anywhere 😭

🌸 Null Provider

an OpenSSL Provider that contains no algorithm implementations. sounds useless but it's actually handy — this can be useful to prevent the default provider from being automatically loaded in a library context. chaos agent in the best way 💅

see OSSL_PROVIDER-null(7).

🌸 Operation

an operation is a group of OpenSSL functions with a common purpose — such as encryption, or digesting. it's the theme, the era, the category ✨

also peep crypto(7).

🌸 PEM ("Privacy Enhanced Message")

PEM is a format used for encoding of binary content into a mail and ASCII friendly form. the content is a series of base64-encoded lines, surrounded by begin/end markers each on their own line. for example:

-----BEGIN PRIVATE KEY-----
MIICdg....
... bhTQ==
-----END PRIVATE KEY-----

optional header line(s) may appear after the begin line, and their existence depends on the type of object being written or read. (so don't panic if there's extra stuff up top, it's allowed 🎀)

for all OpenSSL uses, the binary content is expected to be a DER encoded structure.

this is defined in IETF RFC 1421:

🌸 PKCS#8

PKCS#8 is a specification of ASN.1 structures that OpenSSL uses for storing or transmitting any private key in a key type agnostic manner. there are two structures worth noting for OpenSSL use:

  1. one that contains the key data in unencrypted form (known as "PrivateKeyInfo")
  2. an encrypted wrapper structure (known as "EncryptedPrivateKeyInfo")

this is specified in RFC 5208:

🌸 Property

a property is a way of classifying and selecting algorithm implementations. a property is a key/value pair expressed as a string. for example all algorithm implementations in the default provider have the property "provider=default". and an algorithm implementation can have multiple properties defined against it. collect them all tbh ⭐

also see Property Query String.

see property(7).

🌸 Property Query String

a property query string is a string containing a sequence of properties that can be used to select an algorithm implementation. for example the query string "provider=example,foo=bar" will select algorithms from the "example" provider that have a "foo" property defined for them with a value of "bar". see, it's a little filter, it's literally a search query but make it cryptography 🔍

Property Query Strings are used during fetching. see Fetching.

see property(7).

🌸 Provider

a provider in OpenSSL is a component that groups together algorithm implementations. providers can come from OpenSSL itself or from third parties. yes, outsiders allowed, it's an open door policy 💖

see provider(7).

🌸 PVK

PVK is a Microsoft specific binary format for RSA and DSA private keys. (just private! unlike MSBLOB which does both, ok noted 🦋) this form may be passphrase protected.

🌸 SubjectPublicKeyInfo

SubjectPublicKeyInfo is an ASN.1 structure that OpenSSL uses for storing and transmitting any public key in a key type agnostic manner. public keys only bestie, that's its whole lane ✨

this is specified as part of the specification for certificates, RFC 5280:

🕰️ HISTORY 🕰️

this glossary was added in OpenSSL 3.0. so it's not ancient lore, it's a relatively fresh addition 🌱

Copyright 2020-2022 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at https://www.openssl.org/source/license.html.

and that's the whole glossary, bestie — you're officially fluent 🎓💅

this page is from OpenSSL 3.5.0, dated 2026-09-25, and it's the OPENSSL-GLOSSARY(7ossl) page. go forth and cite it correctly 🫶🌸
📦 where this page comes from