Sortix nightly manual
This manual documents Sortix nightly, a development build that has not been officially released. You can instead view this document in the latest official manual.
PKCS7_ENCRYPT(3) | Library Functions Manual | PKCS7_ENCRYPT(3) |
NAME
PKCS7_encrypt
—
create a PKCS#7 envelopedData structure
SYNOPSIS
#include
<openssl/pkcs7.h>
PKCS7 *
PKCS7_encrypt
(STACK_OF(X509)
*certs, BIO *in,
const EVP_CIPHER *cipher,
int flags);
DESCRIPTION
PKCS7_encrypt
() creates and returns a PKCS#7
envelopedData structure. certs is a list of
recipient certificates. in is the content to
be encrypted. cipher is the symmetric cipher
to use. flags is an optional set of flags.
Only RSA keys are supported in PKCS#7 and envelopedData so the recipient
certificates supplied to this function must all contain RSA public keys,
though they do not have to be signed using the RSA algorithm.
The algorithm passed in the cipher parameter
must support ASN.1 encoding of its parameters.
Many browsers implement a "sign and encrypt" option which is simply an
S/MIME envelopedData containing an S/MIME signed message. This can be readily
produced by storing the S/MIME signed message in a memory
BIO and passing it to
PKCS7_encrypt
().
The following flags can be passed in the flags
parameter.
If the PKCS7_TEXT
flag is set, MIME headers
for type text/plain are prepended to the data.
Normally the supplied content is translated into MIME canonical format (as
required by the S/MIME specifications). If
PKCS7_BINARY
is set, no translation occurs.
This option should be used if the supplied data is in binary format;
otherwise, the translation will corrupt it. If
PKCS7_BINARY
is set, then
PKCS7_TEXT
is ignored.
If the PKCS7_STREAM
flag is set, a partial
PKCS7 structure is output suitable for
streaming I/O: no data is read from in.
If the flag PKCS7_STREAM
is set, the returned
PKCS7 structure is
not complete and outputting its contents via a
function that does not properly finalize the
PKCS7 structure will give unpredictable
results.
Several functions including
PKCS7_final(3),
SMIME_write_PKCS7(3),
PEM_write_bio_PKCS7_stream(3),
and
i2d_PKCS7_bio_stream(3)
finalize the structure. Alternatively finalization can be performed by
obtaining the streaming ASN.1 BIO directly
using BIO_new_PKCS7
().
RETURN VALUES
PKCS7_encrypt
() returns either a
PKCS7 structure or
NULL
if an error occurred. The error can be
obtained from
ERR_get_error(3).
SEE ALSO
PKCS7_decrypt(3), PKCS7_final(3), PKCS7_new(3), PKCS7_sign(3)HISTORY
PKCS7_encrypt
() first appeared in OpenSSL
0.9.5 and has been available since OpenBSD 2.7.
The PKCS7_STREAM
flag was first supported in
OpenSSL 1.0.0.June 3, 2020 | Debian |