crypto — OpenSSL
The OpenSSL crypto library implements a wide range of
cryptographic algorithms used in various Internet standards. The services
provided by this library are used by the OpenSSL implementations of TLS and
S/MIME, and they have also been used to implement SSH, OpenPGP, and other
ciphers including AES, Blowfish, CAST, ChaCha20, IDEA, DES, RC2, and
RC4 are provided by the generic interface
stand-alone interfaces include
key cryptography and key agreement are provided by
are handled by X509_new(3) and
codes and hash functions offered include
output, and data encoding facilities include
Elements used in the names of API functions include the
- See “set0” below.
- See “set1” below.
- basic input and/or output abstraction: The function manipulates objects of
the idiosyncratic OpenSSL BIO object type. See
- The function uses a BIO object for input or output.
In many cases, simpler variants of the function are available that operate
FILE objects or directly in RAM, usually using byte
- filter BIO: The function returns a pointer to a static built-in object
that, when passed to BIO_new(3),
results in the creation of a BIO object that can write data to and/or read
data from another BIO object.
- source and/or sink BIO: The function returns a pointer to a static
built-in object that, when passed to
BIO_new(3), results in the creation of
a BIO object that can write data to an external destination and/or read
data from an external source, for example a file descriptor or object, a
memory buffer, or the network.
- big number: The function operates on BIGNUM objects
representing integer numbers of variable, almost unlimited size. See
- callback: The function takes or returns a function pointer that is called
by API functions from inside the library. The function pointed to may be
defined by the application program. In some cases, API functions with
“cb” in their name may return function pointers to internal
functions defined inside the library that are not API functions. The
element “cb” is also used in the names of some function
pointer datatypes declared with
typedef. In a
small number of cases, the all caps form “CB” is used with
the same meaning.
- context: The function operates on a wrapper object around another object.
The purposes and properties of such “CTX” wrapper objects
vary wildly depending on the objects in question. A few function names use
the lower case form “ctx” in the same sense.
- DER to internal: The function decodes input conforming to ASN.1 basic
encoding rules (BER) and either stores the result in an existing object or
in a newly allocated object. The latter is usually preferable because
creating a new object is more robust and less error prone. In spite of the
name, the input usually does not need to conform to ASN.1 distinguished
encoding rules (DER), which are more restrictive than BER.
- digital EnVeloPe library: See evp(3).
- This name element is used for two completely unrelated purposes.
extended version: The function is similar to an older function
without the “ex” in its name, but takes one or more
additional arguments in order to make it more versatile. In several
cases, the older version is now deprecated.
extra data: Some object types support storing additional,
application-specific data inside objects in addition to the data the
object is designed to hold. The function sets, retrieves, or prepares
for using such extra data. Related function names usually contain
“ex_data” or “ex_new_index”. See
- file pointer: The function takes a FILE * argument.
Usually, the function is a variant of another function taking a
BIO * argument instead.
- internal to DER: The function encodes an object passed as an argument
according to ASN.1 distinguished encoding rules (DER). There are a few
rare exceptions of functions that have “i2d” in their name
but produce output anyway that only conforms to ASN.1 basic encoding rules
(BER) and not to DER.
- The function returns an internal pointer owned by the object passed as an
argument. The returned pointer must not be freed by the calling code. It
will be freed automatically when the object owning the pointer will be
- The function returns a copy of a sub-object of an object passed as an
argument. The caller is responsible for freeing the returned object when
it is no longer needed.
If the object type is reference counted, usually the reference
count is incremented instead of copying the object. Consequently,
modifying the returned object may still impact all objects containing
references to it. The caller is responsible for freeing the returned
object when it is no longer needed; for reference-counted objects still
referenced elsewhere, this will merely decrement the reference
- Functions containing “get” in their name without a following
digit may behave in “get0” or, more rarely, in
“get1” style. To find out which is the case, refer to the
individual manual pages.
- linear hash: The function manipulates a dynamic hash table. See
- message digest. Some function names use the all caps form
“MD” in the same sense.
- The function manipulates an object holding a function table. Usually, such
function tables allow the application program to implement additional
cryptographic or I/O algorithms and to use them with the same high-level
API functions as the algorithms provided by the library itself, or to
replace the implementations of algorithms provided by the library with
custom implementations provided by the application program. Some API
functions use the name elements “method” or
“METHOD” in the same sense. See also the “cb”
entry in the present list.
- indefinite length form: The function encodes according to ASN.1 basic
encoding rules (BER) using the indefinite length form. Even if the
function name also includes “i2d”, the output does not
conform to ASN.1 distinguished encoding rules (DER). See
function names contain the all caps version “NDEF” with the
- numerical identifier: A non-standard, LibreSSL-specific
int number associated with an ASN.1 object
identifier. In several cases, the all caps form “NID” is
used in the same sense. See
- This name element and its all caps form “OBJ” usually refer
to ASN.1 object identifiers represented by the
ASN1_OBJECT data type. See
- In most cases, this name element and its lower case form
“pkey” mean “private key”, but for both forms,
there are some cases where they mean “public key”
- The function transfers ownership of a pointer passed as an argument to an
object passed as another argument, by storing the pointer inside the
object. The transferred pointer must not be freed by the calling code. It
will be freed automatically when the object now owning the pointer will be
- The function copies the content of one object passed as an argument into
another object also passed as an argument. When the calling code no longer
needs the copied object, it can free that object.
In some cases, if the object to be copied is reference
counted, the function does not actually copy the object but merely
increments its reference count and stores the pointer to it in the other
object. When the calling code no longer needs its original pointer to
the now inner object, it can free the original pointer, thus
decrementing the reference count of the inner object and transferring
ownership of the inner object to the outer object. The inner object will
then be freed automatically when the outer object is freed later on.
- Functions containing “set” in their name without a following
digit may behave in “set0” or, more rarely, in
“set1” style. To find out which is the case, refer to the
individual manual pages.
- stack: The function manipulates a variable-sized array of pointers in the
idiosyncratic style described in
- X.509 time-stamp protocol: See
- The function increments the reference count of the argument by one. Only a
minority of object types support reference counting. For those that do, if
the reference count is greater than one, the corresponding
“free” function reverses the effect of one call to the
“up_ref” function rather than freeing the object.