OPENSSL-GLOSSARY(7ossl)

📦
version 3.5.9 · 8 versions
, in alpine 3.23, alpine 3.24

🌸 openssl-glossary — the vibe check ✨

okay bestie, welcome to openssl-glossary (that's the 7ossl manual, if you're keeping track)! This is literally the official OpenSSL glossary, and I'm gonna walk you through every single term so you never have to nod along pretending you know what "implicit fetching" means. No cap, by the end you'll be speaking crypto fluently. 💅

🎀 DESCRIPTION 🎀

Algorithm

Cryptographic primitives — think the SHA256 digest, or AES encryption — are what OpenSSL calls "algorithms". And here's the tea: there can be more than one implementation for any given algorithm available for use. Slay, options. 🦋

See also crypto(7).

ASN.1, ASN1

ASN.1 ("Abstract Syntax Notation One") is a notation for describing abstract types and values. It's defined in the ITU-T documents X.680 to X.683, and yes, you can go read them all:

Base Provider

An OpenSSL Provider that contains encoders and decoders for OpenSSL keys. And the cute part? All the algorithm implementations in the Base Provider are also available in the Default Provider. Sharing is caring. 🫶

See also OSSL_PROVIDER-base(7).

Decoder

A decoder is a type of algorithm used for decoding keys and parameters from some external format such as PEM or DER. It's giving "translate this for me please". 🙈

See also OSSL_DECODER_CTX_new_for_pkey(3).

Default Provider

An OpenSSL Provider that contains the most common OpenSSL algorithm implementations. It gets loaded by default if no other provider is available — main character energy, honestly. And again: all the algorithm implementations in the Base Provider are also available in the Default Provider.

See also OSSL_PROVIDER-default(7).

DER ("Distinguished Encoding Rules")

DER is a binary encoding of data, structured according to an ASN.1 specification. It's a super common encoding for cryptographic objects like private and public keys, certificates, CRLs, ... the whole squad. 💀

It's defined in ITU-T document X.690:

Encoder

An encoder is a type of algorithm used for encoding keys and parameters to some external format such as PEM or DER. The decoder's matching set, fr fr. ✨

See also OSSL_ENCODER_CTX_new_for_pkey(3).

Explicit Fetching

Explicit Fetching is a type of Fetching (see Fetching, below 👀). It's where a function call is made to obtain an algorithm object representing an implementation — such as EVP_MD_fetch(3) or EVP_CIPHER_fetch(3). You literally asked for it, periodt.

Fetching

Fetching is the process of looking through the available algorithm implementations, applying selection criteria (via a property query string), and finally choosing the implementation that will be used. It's a whole audition process and one algorithm gets the role. 🎬

Also see Explicit Fetching and Implicit Fetching.

See also crypto(7).

FIPS Provider

An OpenSSL Provider that contains OpenSSL algorithm implementations that have been validated according to the FIPS 140-2 standard. Certified icon behavior. 👑

See also OSSL_PROVIDER-FIPS(7).

Implicit Fetching

Implicit Fetching is a type of Fetching (see Fetching). This is where an algorithm object with no associated implementation is used — like the return value from EVP_sha256(3) or EVP_aes_128_cbc(3). With implicit fetching, an implementation is fetched automatically using default selection criteria the first time the algorithm is used. It just happens. No questions. 🧚

Legacy Provider

An OpenSSL Provider that contains algorithm implementations that are considered insecure or are no longer in common use. Respectfully, they're retired but still showing up to the group chat. 💀

See also OSSL_PROVIDER-legacy(7).

Library Context

A Library Context in OpenSSL is represented by the type OSSL_LIB_CTX. Think of it as a scope within which configuration options apply — like a little bubble of settings. If an application doesn't explicitly create a library context, then the "default" one is used. Many OpenSSL functions can take a library context as an argument, and a NULL value can always be passed to indicate the default library context. Easy. 💖

See also OSSL_LIB_CTX(3).

MSBLOB

MSBLOB is a Microsoft specific binary format for RSA and DSA keys, both private and public. Warning bestie: this form is never passphrase protected. 🚨

Null Provider

An OpenSSL Provider that contains no algorithm implementations. Sounds useless but it's actually iconic — it can be useful to prevent the default provider from being automatically loaded in a library context. Boundaries! 🚧

See also OSSL_PROVIDER-null(7).

Operation

An operation is a group of OpenSSL functions with a common purpose, such as encryption, or digesting. Squad goals. ⭐

See also crypto(7).

PEM ("Privacy Enhanced Message")

PEM is a format used for encoding of binary content into a mail and ASCII friendly form. The content is a series of base64-encoded lines, surrounded by begin/end markers each on their own line. For example:

 -----BEGIN PRIVATE KEY-----
 MIICdg....
 ... bhTQ==
 -----END PRIVATE KEY-----

Optional header line(s) may appear after the begin line, and their existence depends on the type of object being written or read. Lowkey depends on the vibe of the object.

For all OpenSSL uses, the binary content is expected to be a DER encoded structure.

This is defined in IETF RFC 1421:

PKCS#8

PKCS#8 is a specification of ASN.1 structures that OpenSSL uses for storing or transmitting any private key in a key type agnostic manner. There are two structures worth noting for OpenSSL use:

  • one that contains the key data in unencrypted form (known as "PrivateKeyInfo")
  • an encrypted wrapper structure (known as "EncryptedPrivateKeyInfo")

This is specified in RFC 5208:

Property

A property is a way of classifying and selecting algorithm implementations. It's a key/value pair expressed as a string. For example, all algorithm implementations in the default provider have the property "provider=default". And an algorithm implementation can have multiple properties defined against it. Multitalented. 🌈

Also see Property Query String.

See also property(7).

Property Query String

A property query string is a string containing a sequence of properties that can be used to select an algorithm implementation. For example, the query string "provider=example,foo=bar" will select algorithms from the "example" provider that have a "foo" property defined for them with a value of "bar". It's a filter and it ate. 🔥

Property Query Strings are used during fetching. See Fetching.

See also property(7).

Provider

A provider in OpenSSL is a component that groups together algorithm implementations. Providers can come from OpenSSL itself or from third parties. Collab era. 🤝

See also provider(7).

PVK

PVK is a Microsoft specific binary format for RSA and DSA private keys. Unlike MSBLOB, this form may be passphrase protected. 🔐

SubjectPublicKeyInfo

SubjectPublicKeyInfo is an ASN.1 structure that OpenSSL uses for storing and transmitting any public key in a key type agnostic manner.

This is specified as part of the specification for certificates, RFC 5280:

🦋 HISTORY 🦋

This glossary was added in OpenSSL 3.0. So it's not even that old, bestie — it's giving fresh. ✨

Copyright 2020-2022 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

okay that's the whole glow-up! 🎀 This page is from OpenSSL 3.5.9, dated 2026-09-29 — screenshot it, cite it, live by it. Byeee 💖🫶🌸
📦 where this page comes from