EVP_ASYM_CIPHER-RSA(7ossl)

💅 EVP_ASYM_CIPHER-RSA — RSA Asymmetric Cipher algorithm support ✨

okay so this is a page from the OpenSSL manual, bestie — EVP_ASYM_CIPHER-RSA(7ossl) — and it's literally all about the Asymmetric Cipher support that comes with the RSA key type. no cap, that's the whole vibe. let's get into it 🫶

---

✨ DESCRIPTION ✨

Asymmetric Cipher support for the RSA key type. that's it, that's the headline 💖

🎀 RSA Asymmetric Cipher parameters 🎀

the padding situation (string edition)

• "pad-mode" (OSSL_ASYM_CIPHER_PARAM_PAD_MODE) <UTF8 string> — the default provider understands these RSA padding modes when you hand them over as strings:
  • "none" (OSSL_PKEY_RSA_PAD_MODE_NONE)
  • "oaep" (OSSL_PKEY_RSA_PAD_MODE_OAEP)
  • "pkcs1" (OSSL_PKEY_RSA_PAD_MODE_PKCSV15) — heads up: this padding mode is no longer supported by the FIPS provider for key agreement and key transport. (this is a FIPS 140-3 requirement, so like… not negotiable 😭). go peek at "OPTIONS" in openssl-fipsinstall(1) → -rsa_pkcs15_pad_disabled.
  • "x931" (OSSL_PKEY_RSA_PAD_MODE_X931)

the padding situation (integer edition, she's numeric 💅)

• "pad-mode" (OSSL_ASYM_CIPHER_PARAM_PAD_MODE) <integer> — same parameter, but the default provider also gets it when you pass an integer:
  • 1 (RSA_PKCS1_PADDING) — again, this padding mode is no longer supported by the FIPS provider for key agreement and key transport. (FIPS 140-3 requirement, bestie!)
  • 3 (RSA_NO_PADDING)
  • 4 (RSA_PKCS1_OAEP_PADDING)
  • 5 (RSA_X931_PADDING)

see EVP_PKEY_CTX_set_rsa_padding(3) for further details 👑

OAEP + MGF1 + TLS bits 🌸

• "digest" (OSSL_ASYM_CIPHER_PARAM_OAEP_DIGEST) <UTF8 string>
• "digest-props" (OSSL_ASYM_CIPHER_PARAM_OAEP_DIGEST_PROPS) <UTF8 string>
• "mgf1-digest" (OSSL_ASYM_CIPHER_PARAM_MGF1_DIGEST) <UTF8 string>
• "mgf1-digest-props" (OSSL_ASYM_CIPHER_PARAM_MGF1_DIGEST_PROPS) <UTF8 string>
• "oaep-label" (OSSL_ASYM_CIPHER_PARAM_OAEP_LABEL) <octet string>
• "tls-client-version" (OSSL_ASYM_CIPHER_PARAM_TLS_CLIENT_VERSION) <unsigned integer> — see RSA_PKCS1_WITH_TLS_PADDING on the page EVP_PKEY_CTX_set_rsa_padding(3).
• "tls-negotiated-version" (OSSL_ASYM_CIPHER_PARAM_TLS_CLIENT_VERSION) <unsigned integer> — see RSA_PKCS1_WITH_TLS_PADDING on the page EVP_PKEY_CTX_set_rsa_padding(3).

ngl those last two literally list the same OSSL_ASYM_CIPHER_PARAM_TLS_CLIENT_VERSION macro — yes, both of them, that's not a typo on my end, that's just how the page reads 🙈

see "Asymmetric Cipher Parameters" in provider-asym_cipher(7) for more information 🦋

---

🔥 FIPS provider extras 🔥

the OpenSSL FIPS provider also supports these parameters:

• "fips-indicator" (OSSL_ASYM_CIPHER_PARAM_FIPS_APPROVED_INDICATOR) <integer>
• "key-check" (OSSL_ASYM_CIPHER_PARAM_FIPS_KEY_CHECK) <integer>

see "Asymmetric Cipher Parameters" in provider-asym_cipher(7) for more information ✨

• "pkcs15-pad-disabled" (OSSL_ASYM_CIPHER_PARAM_FIPS_RSA_PKCS15_PAD_DISABLED) <integer> — the default value of 1 causes an error during encryption if the RSA padding mode is set to "pkcs1". setting this to zero will ignore the error and set the approved "fips-indicator" to 0.

⚠️ real talk: this option breaks FIPS compliance if it causes the approved "fips-indicator" to return 0. so like… know what you're doing, bestie 💀

---

👀 SEE ALSO 👀

EVP_PKEY-RSA(7), EVP_PKEY(3), provider-asym_cipher(7), provider-keymgmt(7), OSSL_PROVIDER-default(7) OSSL_PROVIDER-FIPS(7)

---

🎀 COPYRIGHT 🎀

Copyright 2022-2025 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

okay that's the whole page, mwah 💋 this was version 3.5.9, dated 2026-09-29, brought to you by EVP_ASYM_CIPHER-RSA(7ossl) — slay, go encrypt something responsibly 🧚💜