EVP_KEM-RSA(7SSL)

📦
version 4.0.3 · 13 versions
, in ubuntu stonking

💖 EVP_KEM-RSA — the RSA keytype's KEM era 💖

okay bestie, this is EVP_KEM-RSA(7SSL) from the OpenSSL manuals, and it's literally the glow-up story of how RSA does Key Encapsulation Mechanism stuff. sit with me, this one's short and cute. 🎀

✨ NAME ✨

EVP_KEM-RSA — the EVP_KEM RSA keytype and its algorithm support, no cap.

🌸 DESCRIPTION 🌸

so the RSA keytype and all its lil parameters get described over in EVP_PKEY-RSA(7). and if you wanna actually use the encapsulation/decapsulation machinery, go peek at EVP_PKEY_encapsulate(3) and EVP_PKEY_decapsulate(3) for more info. 🦋

🔑 RSA KEM parameters 🔑

  • "operation" (OSSL_KEM_PARAM_OPERATION) <UTF8 string> — the operating mode, bestie. and rn, OpenSSL's RSA Key Encapsulation Mechanism only supports this one default operation:
    • "RSASVE" — the encapsulate function just generates a secret out of random bytes and then encrypts that secret with the RSA public key (with no padding, okay, important). the decapsulate function then recovers the secret using the RSA private key. iconic behaviour. 💅

you can set this with EVP_PKEY_CTX_set_kem_op().

  • "fips-indicator" (OSSL_KEM_PARAM_FIPS_APPROVED_INDICATOR) <integer> — described in provider-kem(7).
  • "key-check" (OSSL_KEM_PARAM_FIPS_KEY_CHECK) <integer> — also described in provider-kem(7).

👑 CONFORMING TO 👑

  • SP800-56Br2
    • Section 7.2.1.2 RSASVE Generate Operation (RSASVE.GENERATE).
    • Section 7.2.1.3 RSASVE Recovery Operation (RSASVE.RECOVER).

like, it's giving standards-compliant. ⭐

🫶 SEE ALSO 🫶

EVP_PKEY_CTX_set_kem_op(3), EVP_PKEY_encapsulate(3), EVP_PKEY_decapsulate(3) EVP_KEYMGMT(3), EVP_PKEY(3), provider-keymgmt(7)

🕰️ HISTORY 🕰️

this whole functionality was added in OpenSSL 3.0. 🍼

and the "operation" (operating mode) was a required parameter prior to OpenSSL 3.5. as of OpenSSL 3.5, "RSASVE" is the default operating mode, and no explicit value need be specified. so yeah, that glow-up happened. 💅

ngl if you're on anything older than 3.5, don't forget to set your "operation" or it's gonna be a whole thing. 😭

Copyright 2020-2025 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

aaaand that's the whole thing, bestie, we ate. 🍓 this was page 4.0.3 of the OpenSSL manual, dated 2026-09-29, filed under EVP_KEM-RSA(7SSL) — love her, read her, slay. 🌈💖✨

📦 where this page comes from