{
    "mode": "man",
    "parameter": "provider-asym_cipher",
    "section": "7ssl",
    "url": "https://www.chedong.com/phpMan.php/man/provider-asym_cipher/7ssl/json",
    "generated": "2026-05-30T06:07:21Z",
    "synopsis": "#include <openssl/coredispatch.h>\n#include <openssl/corenames.h>\n/*\n* None of these are actual functions, but are displayed like this for\n* the function signatures for functions that are offered as function\n* pointers in OSSLDISPATCH arrays.\n*/\n/* Context management */\nvoid *OSSLFUNCasymciphernewctx(void *provctx);\nvoid OSSLFUNCasymcipherfreectx(void *ctx);\nvoid *OSSLFUNCasymcipherdupctx(void *ctx);\n/* Encryption */\nint OSSLFUNCasymcipherencryptinit(void *ctx, void *provkey,\nconst OSSLPARAM params[]);\nint OSSLFUNCasymcipherencrypt(void *ctx, unsigned char *out, sizet *outlen,\nsizet outsize, const unsigned char *in,\nsizet inlen);\n/* Decryption */\nint OSSLFUNCasymcipherdecryptinit(void *ctx, void *provkey,\nconst OSSLPARAM params[]);\nint OSSLFUNCasymcipherdecrypt(void *ctx, unsigned char *out, sizet *outlen,\nsizet outsize, const unsigned char *in,\nsizet inlen);\n/* Asymmetric Cipher parameters */\nint OSSLFUNCasymciphergetctxparams(void *ctx, OSSLPARAM params[]);\nconst OSSLPARAM *OSSLFUNCasymciphergettablectxparams(void *provctx);\nint OSSLFUNCasymciphersetctxparams(void *ctx, const OSSLPARAM params[]);\nconst OSSLPARAM *OSSLFUNCasymciphersettablectxparams(void *provctx);",
    "sections": {
        "NAME": {
            "content": "provider-asymcipher - The asymcipher library <-> provider functions\n",
            "subsections": []
        },
        "SYNOPSIS": {
            "content": "#include <openssl/coredispatch.h>\n#include <openssl/corenames.h>\n\n/*\n* None of these are actual functions, but are displayed like this for\n* the function signatures for functions that are offered as function\n* pointers in OSSLDISPATCH arrays.\n*/\n\n/* Context management */\nvoid *OSSLFUNCasymciphernewctx(void *provctx);\nvoid OSSLFUNCasymcipherfreectx(void *ctx);\nvoid *OSSLFUNCasymcipherdupctx(void *ctx);\n\n/* Encryption */\nint OSSLFUNCasymcipherencryptinit(void *ctx, void *provkey,\nconst OSSLPARAM params[]);\nint OSSLFUNCasymcipherencrypt(void *ctx, unsigned char *out, sizet *outlen,\nsizet outsize, const unsigned char *in,\nsizet inlen);\n\n/* Decryption */\nint OSSLFUNCasymcipherdecryptinit(void *ctx, void *provkey,\nconst OSSLPARAM params[]);\nint OSSLFUNCasymcipherdecrypt(void *ctx, unsigned char *out, sizet *outlen,\nsizet outsize, const unsigned char *in,\nsizet inlen);\n\n/* Asymmetric Cipher parameters */\nint OSSLFUNCasymciphergetctxparams(void *ctx, OSSLPARAM params[]);\nconst OSSLPARAM *OSSLFUNCasymciphergettablectxparams(void *provctx);\nint OSSLFUNCasymciphersetctxparams(void *ctx, const OSSLPARAM params[]);\nconst OSSLPARAM *OSSLFUNCasymciphersettablectxparams(void *provctx);\n",
            "subsections": []
        },
        "DESCRIPTION": {
            "content": "This documentation is primarily aimed at provider authors. See provider(7) for further\ninformation.\n\nThe asymmetric cipher (OSSLOPASYMCIPHER) operation enables providers to implement\nasymmetric cipher algorithms and make them available to applications via the API functions\nEVPPKEYencrypt(3), EVPPKEYdecrypt(3) and other related functions).\n\nAll \"functions\" mentioned here are passed as function pointers between libcrypto and the\nprovider in OSSLDISPATCH arrays via OSSLALGORITHM arrays that are returned by the\nprovider's providerqueryoperation() function (see \"Provider Functions\" in\nprovider-base(7)).\n\nAll these \"functions\" have a corresponding function type definition named\nOSSLFUNC{name}fn, and a helper function to retrieve the function pointer from an\nOSSLDISPATCH element named OSSLFUNC{name}.  For example, the \"function\"\nOSSLFUNCasymciphernewctx() has these:\n\ntypedef void *(OSSLFUNCasymciphernewctxfn)(void *provctx);\nstatic osslinline OSSLFUNCasymciphernewctxfn\nOSSLFUNCasymciphernewctx(const OSSLDISPATCH *opf);\n\nOSSLDISPATCH arrays are indexed by numbers that are provided as macros in\nopenssl-coredispatch.h(7), as follows:\n\nOSSLFUNCasymciphernewctx               OSSLFUNCASYMCIPHERNEWCTX\nOSSLFUNCasymcipherfreectx              OSSLFUNCASYMCIPHERFREECTX\nOSSLFUNCasymcipherdupctx               OSSLFUNCASYMCIPHERDUPCTX\n\nOSSLFUNCasymcipherencryptinit         OSSLFUNCASYMCIPHERENCRYPTINIT\nOSSLFUNCasymcipherencrypt              OSSLFUNCASYMCIPHERENCRYPT\n\nOSSLFUNCasymcipherdecryptinit         OSSLFUNCASYMCIPHERDECRYPTINIT\nOSSLFUNCasymcipherdecrypt              OSSLFUNCASYMCIPHERDECRYPT\n\nOSSLFUNCasymciphergetctxparams       OSSLFUNCASYMCIPHERGETCTXPARAMS\nOSSLFUNCasymciphergettablectxparams  OSSLFUNCASYMCIPHERGETTABLECTXPARAMS\nOSSLFUNCasymciphersetctxparams       OSSLFUNCASYMCIPHERSETCTXPARAMS\nOSSLFUNCasymciphersettablectxparams  OSSLFUNCASYMCIPHERSETTABLECTXPARAMS\n\nAn asymmetric cipher algorithm implementation may not implement all of these functions.  In\norder to be a consistent set of functions a provider must implement\nOSSLFUNCasymciphernewctx and OSSLFUNCasymcipherfreectx.  It must also implement both\nof OSSLFUNCasymcipherencryptinit and OSSLFUNCasymcipherencrypt, or both of\nOSSLFUNCasymcipherdecryptinit and OSSLFUNCasymcipherdecrypt.\nOSSLFUNCasymciphergetctxparams is optional but if it is present then so must\nOSSLFUNCasymciphergettablectxparams.  Similarly, OSSLFUNCasymciphersetctxparams\nis optional but if it is present then so must OSSLFUNCasymciphersettablectxparams.\n\nAn asymmetric cipher algorithm must also implement some mechanism for generating, loading or\nimporting keys via the key management (OSSLOPKEYMGMT) operation.  See provider-keymgmt(7)\nfor further details.\n",
            "subsections": [
                {
                    "name": "Context Management Functions",
                    "content": "OSSLFUNCasymciphernewctx() should create and return a pointer to a provider side\nstructure for holding context information during an asymmetric cipher operation.  A pointer\nto this context will be passed back in a number of the other asymmetric cipher operation\nfunction calls.  The parameter provctx is the provider context generated during provider\ninitialisation (see provider(7)).\n\nOSSLFUNCasymcipherfreectx() is passed a pointer to the provider side asymmetric cipher\ncontext in the ctx parameter.  This function should free any resources associated with that\ncontext.\n\nOSSLFUNCasymcipherdupctx() should duplicate the provider side asymmetric cipher context\nin the ctx parameter and return the duplicate copy.\n"
                },
                {
                    "name": "Encryption Functions",
                    "content": "OSSLFUNCasymcipherencryptinit() initialises a context for an asymmetric encryption given\na provider side asymmetric cipher context in the ctx parameter, and a pointer to a provider\nkey object in the provkey parameter.  The params, if not NULL, should be set on the context\nin a manner similar to using OSSLFUNCasymciphersetctxparams().  The key object should\nhave been previously generated, loaded or imported into the provider using the key management\n(OSSLOPKEYMGMT) operation (see provider-keymgmt(7)>.  OSSLFUNCasymcipherencrypt()\nperforms the actual encryption itself.  A previously initialised asymmetric cipher context is\npassed in the ctx parameter.  The data to be encrypted is pointed to by the in parameter\nwhich is inlen bytes long.  Unless out is NULL, the encrypted data should be written to the\nlocation pointed to by the out parameter and it should not exceed outsize bytes in length.\nThe length of the encrypted data should be written to *outlen.  If out is NULL then the\nmaximum length of the encrypted data should be written to *outlen.\n"
                },
                {
                    "name": "Decryption Functions",
                    "content": "OSSLFUNCasymcipherdecryptinit() initialises a context for an asymmetric decryption given\na provider side asymmetric cipher context in the ctx parameter, and a pointer to a provider\nkey object in the provkey parameter.  The params, if not NULL, should be set on the context\nin a manner similar to using OSSLFUNCasymciphersetctxparams().  The key object should\nhave been previously generated, loaded or imported into the provider using the key management\n(OSSLOPKEYMGMT) operation (see provider-keymgmt(7)>.\n\nOSSLFUNCasymcipherdecrypt() performs the actual decryption itself.  A previously\ninitialised asymmetric cipher context is passed in the ctx parameter.  The data to be\ndecrypted is pointed to by the in parameter which is inlen bytes long.  Unless out is NULL,\nthe decrypted data should be written to the location pointed to by the out parameter and it\nshould not exceed outsize bytes in length.  The length of the decrypted data should be\nwritten to *outlen.  If out is NULL then the maximum length of the decrypted data should be\nwritten to *outlen.\n"
                },
                {
                    "name": "Asymmetric Cipher Parameters",
                    "content": "See OSSLPARAM(3) for further details on the parameters structure used by the\nOSSLFUNCasymciphergetctxparams() and OSSLFUNCasymciphersetctxparams() functions.\n\nOSSLFUNCasymciphergetctxparams() gets asymmetric cipher parameters associated with the\ngiven provider side asymmetric cipher context ctx and stores them in params.  Passing NULL\nfor params should return true.\n\nOSSLFUNCasymciphersetctxparams() sets the asymmetric cipher parameters associated with\nthe given provider side asymmetric cipher context ctx to params.  Any parameter settings are\nadditional to any that were previously set.  Passing NULL for params should return true.\n\nParameters currently recognised by built-in asymmetric cipher algorithms are as follows.  Not\nall parameters are relevant to, or are understood by all asymmetric cipher algorithms:\n\n\"pad-mode\" (OSSLASYMCIPHERPARAMPADMODE) <integer>\nThe type of padding to be used. The interpretation of this value will depend on the\nalgorithm in use. The default provider understands these RSA padding modes: 1\n(RSAPKCS1PADDING), 3 (RSANOPADDING), 4 (RSAPKCS1OAEPPADDING), 5\n(RSAX931PADDING), 6 (RSAPKCS1PSSPADDING) and 7 (RSAPKCS1WITHTLSPADDING). See\nEVPPKEYCTXsetrsapadding(3) for further details.\n\n\"digest\" (OSSLASYMCIPHERPARAMOAEPDIGEST) <UTF8 string>\nGets or sets the name of the OAEP digest algorithm used when OAEP padding is in use.\n\n\"digest\" (OSSLASYMCIPHERPARAMDIGEST) <UTF8 string>\nGets or sets the name of the digest algorithm used by the algorithm (where applicable).\n\n\"digest-props\" (OSSLASYMCIPHERPARAMOAEPDIGESTPROPS) <UTF8 string>\nGets or sets the properties to use when fetching the OAEP digest algorithm.\n\n\"digest-props\" (OSSLASYMCIPHERPARAMDIGESTPROPS) <UTF8 string>\nGets or sets the properties to use when fetching the cipher digest algorithm.\n\n\"mgf1-digest\" (OSSLASYMCIPHERPARAMMGF1DIGEST) <UTF8 string>\nGets or sets the name of the MGF1 digest algorithm used when OAEP or PSS padding is in\nuse.\n\n\"mgf1-digest-props\" (OSSLASYMCIPHERPARAMMGF1DIGESTPROPS) <UTF8 string>\nGets or sets the properties to use when fetching the MGF1 digest algorithm.\n\n\"oaep-label\" (OSSLASYMCIPHERPARAMOAEPLABEL) <octet string>\nGets or sets the OAEP label used when OAEP padding is in use.\n\n\"tls-client-version\" (OSSLASYMCIPHERPARAMTLSCLIENTVERSION) <unsigned integer>\nThe TLS protocol version first requested by the client. See RSAPKCS1WITHTLSPADDING on\nthe page EVPPKEYCTXsetrsapadding(3).\n\n\"tls-negotiated-version\" (OSSLASYMCIPHERPARAMTLSCLIENTVERSION) <unsigned integer>\nThe negotiated TLS protocol version. See RSAPKCS1WITHTLSPADDING on the page\nEVPPKEYCTXsetrsapadding(3).\n\n\"implicit-rejection\" (OSSLPKEYPARAMIMPLICITREJECTION) <unsigned integer>\nGets of sets the use of the implicit rejection mechanism for RSA PKCS#1 v1.5 decryption.\nWhen set (non zero value), the decryption API will return a deterministically random\nvalue if the PKCS#1 v1.5 padding check fails.  This makes explotation of the\nBleichenbacher significantly harder, even if the code using the RSA decryption API is not\nimplemented in side-channel free manner. Set by default.\n\nOSSLFUNCasymciphergettablectxparams() and OSSLFUNCasymciphersettablectxparams()\nget a constant OSSLPARAM array that describes the gettable and settable parameters, i.e.\nparameters that can be used with OSSLFUNCasymciphergetctxparams() and\nOSSLFUNCasymciphersetctxparams() respectively.  See OSSLPARAM(3) for the use of\nOSSLPARAM as parameter descriptor.\n"
                }
            ]
        },
        "RETURN VALUES": {
            "content": "OSSLFUNCasymciphernewctx() and OSSLFUNCasymcipherdupctx() should return the newly\ncreated provider side asymmetric cipher context, or NULL on failure.\n\nAll other functions should return 1 for success or 0 on error.\n",
            "subsections": []
        },
        "SEE ALSO": {
            "content": "provider(7)\n",
            "subsections": []
        },
        "HISTORY": {
            "content": "The provider ASYMCIPHER interface was introduced in OpenSSL 3.0.\n",
            "subsections": []
        },
        "COPYRIGHT": {
            "content": "Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved.\n\nLicensed under the Apache License 2.0 (the \"License\").  You may not use this file except in\ncompliance with the License.  You can obtain a copy in the file LICENSE in the source\ndistribution or at <https://www.openssl.org/source/license.html>.\n\n\n\n3.0.2                                        2026-04-07                   PROVIDER-ASYMCIPHER(7SSL)",
            "subsections": []
        }
    },
    "summary": "provider-asymcipher - The asymcipher library <-> provider functions",
    "flags": [],
    "examples": [],
    "see_also": [
        {
            "name": "provider",
            "section": "7",
            "url": "https://www.chedong.com/phpMan.php/man/provider/7/json"
        }
    ]
}