EVP_ASYM_CIPHER-RSA(7SSL)

📦
version 4.0.3 · 11 versions
, in ubuntu stonking

💖 NAME 💖

EVP_ASYM_CIPHER-RSA — RSA Asymmetric Cipher algorithm support, bestie. That's the whole vibe. It's the 7SSL page in the OpenSSL manual set, and it's basically the cheat sheet for how RSA does its asymmetric cipher thing.

✨ DESCRIPTION ✨

So, okay: this is all about Asymmetric Cipher support for the RSA key type. That's it, that's the assignment. 🫶

🔐 RSA Asymmetric Cipher parameters 🔐

These are the parameters you can set. Every single one, no skipping, I got you. 👑

  • "pad-mode" (OSSL_ASYM_CIPHER_PARAM_PAD_MODE) <UTF8 string> — the padding mode, but as a string. The default provider gets these ones:
    • "none" (OSSL_PKEY_RSA_PAD_MODE_NONE) — literally none.
    • "oaep" (OSSL_PKEY_RSA_PAD_MODE_OAEP) — the OAEP one.
    • "pkcs1" (OSSL_PKEY_RSA_PAD_MODE_PKCSV15) — ⚠️ heads up: this padding mode is no longer supported by the FIPS provider for key agreement and key transport. That's a FIPS 140-3 requirement, not a suggestion. Peep "OPTIONS" in openssl-fipsinstall(1), specifically -rsa_pkcs15_pad_disabled.
    • "x931" (OSSL_PKEY_RSA_PAD_MODE_X931) — the X9.31 one.
  • "pad-mode" (OSSL_ASYM_CIPHER_PARAM_PAD_MODE) <integer> — same parameter, but the integer flavour. The default provider understands these numbers:
    • 1 (RSA_PKCS1_PADDING) — ⚠️ again, this padding mode is no longer supported by the FIPS provider for key agreement and key transport. (FIPS 140-3 requirement, fr fr.)
    • 3 (RSA_NO_PADDING) — no padding.
    • 4 (RSA_PKCS1_OAEP_PADDING) — OAEP.
    • 5 (RSA_X931_PADDING) — X9.31.

Need more deets? Go read EVP_PKEY_CTX_set_rsa_padding(3). ✨

  • "digest" (OSSL_ASYM_CIPHER_PARAM_OAEP_DIGEST) <UTF8 string> — the OAEP digest.
  • "digest-props" (OSSL_ASYM_CIPHER_PARAM_OAEP_DIGEST_PROPS) <UTF8 string> — properties for that digest.
  • "mgf1-digest" (OSSL_ASYM_CIPHER_PARAM_MGF1_DIGEST) <UTF8 string> — the MGF1 digest.
  • "mgf1-digest-props" (OSSL_ASYM_CIPHER_PARAM_MGF1_DIGEST_PROPS) <UTF8 string> — properties for that one.
  • "oaep-label" (OSSL_ASYM_CIPHER_PARAM_OAEP_LABEL) <octet string> — the OAEP label, as octets.
  • "tls-client-version" (OSSL_ASYM_CIPHER_PARAM_TLS_CLIENT_VERSION) <unsigned integer> — go look at RSA_PKCS1_WITH_TLS_PADDING on the EVP_PKEY_CTX_set_rsa_padding(3) page. 📖
  • "tls-negotiated-version" (OSSL_ASYM_CIPHER_PARAM_TLS_CLIENT_VERSION) <unsigned integer> — yep, same deal: see RSA_PKCS1_WITH_TLS_PADDING on EVP_PKEY_CTX_set_rsa_padding(3).
(Not me pointing out that both "tls-client-version" and "tls-negotiated-version" are documented with OSSL_ASYM_CIPHER_PARAM_TLS_CLIENT_VERSION — that's literally what the page says, so I'm passing it straight to you. 🙈)

For even more on all of that, see "Asymmetric Cipher Parameters" in provider-asym_cipher(7).

The OpenSSL FIPS provider also supports these parameters:

  • "fips-indicator" (OSSL_ASYM_CIPHER_PARAM_FIPS_APPROVED_INDICATOR) <integer> — the approved indicator.
  • "key-check" (OSSL_ASYM_CIPHER_PARAM_FIPS_KEY_CHECK) <integer> — the key check.

For more on both of those, see "Asymmetric Cipher Parameters" in provider-asym_cipher(7). 💅

  • "pkcs15-pad-disabled" (OSSL_ASYM_CIPHER_PARAM_FIPS_RSA_PKCS15_PAD_DISABLED) <integer> — the default value of 1 makes it throw an error during encryption if the RSA padding mode is set to "pkcs1". Set it to zero and it'll ignore that error and set the approved "fips-indicator" to 0. ⚠️ Warning though: this option breaks FIPS compliance if it causes the approved "fips-indicator" to return 0. Choose wisely, bestie. 😭

🌈 SEE ALSO 🌈

EVP_PKEY-RSA(7), EVP_PKEY(3), provider-asym_cipher(7), provider-keymgmt(7), OSSL_PROVIDER-default(7) OSSL_PROVIDER-FIPS(7)

Copyright 2022-2025 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

🌸 okay that's the whole page, and yes you ate it. This was 4.0.3, dated 2026-09-29, from the EVP_ASYM_CIPHER-RSA(7SSL) page — ty for coming to my TED talk, ily, go encrypt something responsibly 💖✨🦋

📦 where this page comes from