diff options
Diffstat (limited to 'src/lib/libcrypto/doc/EVP_EncryptInit.pod')
-rw-r--r-- | src/lib/libcrypto/doc/EVP_EncryptInit.pod | 224 |
1 files changed, 0 insertions, 224 deletions
diff --git a/src/lib/libcrypto/doc/EVP_EncryptInit.pod b/src/lib/libcrypto/doc/EVP_EncryptInit.pod deleted file mode 100644 index 77ed4ccdba..0000000000 --- a/src/lib/libcrypto/doc/EVP_EncryptInit.pod +++ /dev/null | |||
@@ -1,224 +0,0 @@ | |||
1 | =pod | ||
2 | |||
3 | =head1 NAME | ||
4 | |||
5 | EVP_EncryptInit, EVP_EncryptUpdate, EVP_EncryptFinal - EVP cipher routines | ||
6 | |||
7 | =head1 SYNOPSIS | ||
8 | |||
9 | #include <openssl/evp.h> | ||
10 | |||
11 | void EVP_EncryptInit(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *type, | ||
12 | unsigned char *key, unsigned char *iv); | ||
13 | void EVP_EncryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, | ||
14 | int *outl, unsigned char *in, int inl); | ||
15 | void EVP_EncryptFinal(EVP_CIPHER_CTX *ctx, unsigned char *out, | ||
16 | int *outl); | ||
17 | |||
18 | void EVP_DecryptInit(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *type, | ||
19 | unsigned char *key, unsigned char *iv); | ||
20 | void EVP_DecryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, | ||
21 | int *outl, unsigned char *in, int inl); | ||
22 | int EVP_DecryptFinal(EVP_CIPHER_CTX *ctx, unsigned char *outm, | ||
23 | int *outl); | ||
24 | |||
25 | void EVP_CipherInit(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *type, | ||
26 | unsigned char *key, unsigned char *iv, int enc); | ||
27 | void EVP_CipherUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, | ||
28 | int *outl, unsigned char *in, int inl); | ||
29 | int EVP_CipherFinal(EVP_CIPHER_CTX *ctx, unsigned char *outm, | ||
30 | int *outl); | ||
31 | |||
32 | void EVP_CIPHER_CTX_cleanup(EVP_CIPHER_CTX *a); | ||
33 | |||
34 | const EVP_CIPHER *EVP_get_cipherbyname(const char *name); | ||
35 | #define EVP_get_cipherbynid(a) EVP_get_cipherbyname(OBJ_nid2sn(a)) | ||
36 | #define EVP_get_cipherbyobj(a) EVP_get_cipherbynid(OBJ_obj2nid(a)) | ||
37 | |||
38 | #define EVP_CIPHER_nid(e) ((e)->nid) | ||
39 | #define EVP_CIPHER_block_size(e) ((e)->block_size) | ||
40 | #define EVP_CIPHER_key_length(e) ((e)->key_len) | ||
41 | #define EVP_CIPHER_iv_length(e) ((e)->iv_len) | ||
42 | |||
43 | int EVP_CIPHER_type(const EVP_CIPHER *ctx); | ||
44 | #define EVP_CIPHER_CTX_cipher(e) ((e)->cipher) | ||
45 | #define EVP_CIPHER_CTX_nid(e) ((e)->cipher->nid) | ||
46 | #define EVP_CIPHER_CTX_block_size(e) ((e)->cipher->block_size) | ||
47 | #define EVP_CIPHER_CTX_key_length(e) ((e)->cipher->key_len) | ||
48 | #define EVP_CIPHER_CTX_iv_length(e) ((e)->cipher->iv_len) | ||
49 | #define EVP_CIPHER_CTX_type(c) EVP_CIPHER_type(EVP_CIPHER_CTX_cipher(c)) | ||
50 | |||
51 | int EVP_CIPHER_param_to_asn1(EVP_CIPHER_CTX *c, ASN1_TYPE *type); | ||
52 | int EVP_CIPHER_asn1_to_param(EVP_CIPHER_CTX *c, ASN1_TYPE *type); | ||
53 | |||
54 | =head1 DESCRIPTION | ||
55 | |||
56 | The EVP cipher routines are a high level interface to certain | ||
57 | symmetric ciphers. | ||
58 | |||
59 | EVP_EncryptInit() initialises a cipher context B<ctx> for encryption | ||
60 | with cipher B<type>. B<type> is normally supplied by a function such | ||
61 | as EVP_des_cbc() . B<key> is the symmetric key to use and B<iv> is the | ||
62 | IV to use (if necessary), the actual number of bytes used for the | ||
63 | key and IV depends on the cipher. It is possible to set all parameters | ||
64 | to NULL except B<type> in an initial call and supply the remaining | ||
65 | parameters in subsequent calls. This is normally done when the | ||
66 | EVP_CIPHER_asn1_to_param() function is called to set the cipher | ||
67 | parameters from an ASN1 AlgorithmIdentifier and the key from a | ||
68 | different source. | ||
69 | |||
70 | EVP_EncryptUpdate() encrypts B<inl> bytes from the buffer B<in> and | ||
71 | writes the encrypted version to B<out>. This function can be called | ||
72 | multiple times to encrypt successive blocks of data. The amount | ||
73 | of data written depends on the block alignment of the encrypted data: | ||
74 | as a result the amount of data written may be anything from zero bytes | ||
75 | to (inl + cipher_block_size - 1) so B<outl> should contain sufficient | ||
76 | room. The actual number of bytes written is placed in B<outl>. | ||
77 | |||
78 | EVP_EncryptFinal() encrypts the "final" data, that is any data that | ||
79 | remains in a partial block. It uses L<standard block padding|/NOTES> (aka PKCS | ||
80 | padding). The encrypted final data is written to B<out> which should | ||
81 | have sufficient space for one cipher block. The number of bytes written | ||
82 | is placed in B<outl>. After this function is called the encryption operation | ||
83 | is finished and no further calls to EVP_EncryptUpdate() should be made. | ||
84 | |||
85 | EVP_DecryptInit(), EVP_DecryptUpdate() and EVP_DecryptFinal() are the | ||
86 | corresponding decryption operations. EVP_DecryptFinal() will return an | ||
87 | error code if the final block is not correctly formatted. The parameters | ||
88 | and restrictions are identical to the encryption operations except that | ||
89 | the decrypted data buffer B<out> passed to EVP_DecryptUpdate() should | ||
90 | have sufficient room for (B<inl> + cipher_block_size) bytes unless the | ||
91 | cipher block size is 1 in which case B<inl> bytes is sufficient. | ||
92 | |||
93 | EVP_CipherInit(), EVP_CipherUpdate() and EVP_CipherFinal() are functions | ||
94 | that can be used for decryption or encryption. The operation performed | ||
95 | depends on the value of the B<enc> parameter. It should be set to 1 for | ||
96 | encryption and 0 for decryption. | ||
97 | |||
98 | EVP_CIPHER_CTX_cleanup() clears all information from a cipher context. | ||
99 | It should be called after all operations using a cipher are complete | ||
100 | so sensitive information does not remain in memory. | ||
101 | |||
102 | EVP_get_cipherbyname(), EVP_get_cipherbynid() and EVP_get_cipherbyobj() | ||
103 | return an EVP_CIPHER structure when passed a cipher name, a NID or an | ||
104 | ASN1_OBJECT structure. | ||
105 | |||
106 | EVP_CIPHER_nid() and EVP_CIPHER_CTX_nid() return the NID of a cipher when | ||
107 | passed an B<EVP_CIPHER> or B<EVP_CIPHER_CTX> structure. The actual NID | ||
108 | value is an internal value which may not have a corresponding OBJECT | ||
109 | IDENTIFIER. | ||
110 | |||
111 | EVP_CIPHER_key_length() and EVP_CIPHER_CTX_key_length() return the key | ||
112 | length of a cipher when passed an B<EVP_CIPHER> or B<EVP_CIPHER_CTX> | ||
113 | structure. The constant B<EVP_MAX_KEY_LENGTH> is the maximum key length | ||
114 | for all ciphers. | ||
115 | |||
116 | EVP_CIPHER_iv_length() and EVP_CIPHER_CTX_iv_length() return the IV | ||
117 | length of a cipher when passed an B<EVP_CIPHER> or B<EVP_CIPHER_CTX>. | ||
118 | It will return zero if the cipher does not use an IV. The constant | ||
119 | B<EVP_MAX_IV_LENGTH> is the maximum IV length for all ciphers. | ||
120 | |||
121 | EVP_CIPHER_block_size() and EVP_CIPHER_CTX_block_size() return the block | ||
122 | size of a cipher when passed an B<EVP_CIPHER> or B<EVP_CIPHER_CTX> | ||
123 | structure. The constant B<EVP_MAX_IV_LENGTH> is also the maximum block | ||
124 | length for all ciphers. | ||
125 | |||
126 | EVP_CIPHER_type() and EVP_CIPHER_CTX_type() return the type of the passed | ||
127 | cipher or context. This "type" is the actual NID of the cipher OBJECT | ||
128 | IDENTIFIER as such it ignores the cipher parameters and 40 bit RC2 and | ||
129 | 128 bit RC2 have the same NID. If the cipher does not have an object | ||
130 | identifier or does not have ASN1 support this function will return | ||
131 | B<NID_undef>. | ||
132 | |||
133 | EVP_CIPHER_CTX_cipher() returns the B<EVP_CIPHER> structure when passed | ||
134 | an B<EVP_CIPHER_CTX> structure. | ||
135 | |||
136 | EVP_CIPHER_param_to_asn1() sets the AlgorithmIdentifier "parameter" based | ||
137 | on the passed cipher. This will typically include any parameters and an | ||
138 | IV. The cipher IV (if any) must be set when this call is made. This call | ||
139 | should be made before the cipher is actually "used" (before any | ||
140 | EVP_EncryptUpdate(), EVP_DecryptUpdate() calls for example). This function | ||
141 | may fail if the cipher does not have any ASN1 support. | ||
142 | |||
143 | EVP_CIPHER_asn1_to_param() sets the cipher parameters based on an ASN1 | ||
144 | AlgorithmIdentifier "parameter". The precise effect depends on the cipher | ||
145 | In the case of RC2, for example, it will set the IV and effective key length. | ||
146 | This function should be called after the base cipher type is set but before | ||
147 | the key is set. For example EVP_CipherInit() will be called with the IV and | ||
148 | key set to NULL, EVP_CIPHER_asn1_to_param() will be called and finally | ||
149 | EVP_CipherInit() again with all parameters except the key set to NULL. It is | ||
150 | possible for this function to fail if the cipher does not have any ASN1 support | ||
151 | or the parameters cannot be set (for example the RC2 effective key length | ||
152 | does not have an B<EVP_CIPHER> structure). | ||
153 | |||
154 | =head1 RETURN VALUES | ||
155 | |||
156 | EVP_EncryptInit(), EVP_EncryptUpdate() and EVP_EncryptFinal() do not return | ||
157 | values. | ||
158 | |||
159 | EVP_DecryptInit() and EVP_DecryptUpdate() do not return values. | ||
160 | EVP_DecryptFinal() returns 0 if the decrypt failed or 1 for success. | ||
161 | |||
162 | EVP_CipherInit() and EVP_CipherUpdate() do not return values. | ||
163 | EVP_CipherFinal() returns 1 for a decryption failure or 1 for success, if | ||
164 | the operation is encryption then it always returns 1. | ||
165 | |||
166 | EVP_CIPHER_CTX_cleanup() does not return a value. | ||
167 | |||
168 | EVP_get_cipherbyname(), EVP_get_cipherbynid() and EVP_get_cipherbyobj() | ||
169 | return an B<EVP_CIPHER> structure or NULL on error. | ||
170 | |||
171 | EVP_CIPHER_nid() and EVP_CIPHER_CTX_nid() return a NID. | ||
172 | |||
173 | EVP_CIPHER_block_size() and EVP_CIPHER_CTX_block_size() return the block | ||
174 | size. | ||
175 | |||
176 | EVP_CIPHER_key_length() and EVP_CIPHER_CTX_key_length() return the key | ||
177 | length. | ||
178 | |||
179 | EVP_CIPHER_iv_length() and EVP_CIPHER_CTX_iv_length() return the IV | ||
180 | length or zero if the cipher does not use an IV. | ||
181 | |||
182 | EVP_CIPHER_type() and EVP_CIPHER_CTX_type() return the NID of the cipher's | ||
183 | OBJECT IDENTIFIER or NID_undef if it has no defined OBJECT IDENTIFIER. | ||
184 | |||
185 | EVP_CIPHER_CTX_cipher() returns an B<EVP_CIPHER> structure. | ||
186 | |||
187 | EVP_CIPHER_param_to_asn1() and EVP_CIPHER_asn1_to_param() return 1 for | ||
188 | success or zero for failure. | ||
189 | |||
190 | =head1 NOTES | ||
191 | |||
192 | Where possible the B<EVP> interface to symmetric ciphers should be used in | ||
193 | preference to the low level interfaces. This is because the code then becomes | ||
194 | transparent to the cipher used and much more flexible. | ||
195 | |||
196 | PKCS padding works by adding B<n> padding bytes of value B<n> to make the total | ||
197 | length of the encrypted data a multiple of the block size. Padding is always | ||
198 | added so if the data is already a multiple of the block size B<n> will equal | ||
199 | the block size. For example if the block size is 8 and 11 bytes are to be | ||
200 | encrypted then 5 padding bytes of value 5 will be added. | ||
201 | |||
202 | When decrypting the final block is checked to see if it has the correct form. | ||
203 | |||
204 | Although the decryption operation can produce an error, it is not a strong | ||
205 | test that the input data or key is correct. A random block has better than | ||
206 | 1 in 256 chance of being of the correct format and problems with the | ||
207 | input data earlier on will not produce a final decrypt error. | ||
208 | |||
209 | =head1 BUGS | ||
210 | |||
211 | The current B<EVP> cipher interface is not as flexible as it should be. Only | ||
212 | certain "spot" encryption algorithms can be used for ciphers which have various | ||
213 | parameters associated with them (RC2, RC5 for example) this is inadequate. | ||
214 | |||
215 | Several of the functions do not return error codes because the software versions | ||
216 | can never fail. This is not true of hardware versions. | ||
217 | |||
218 | =head1 SEE ALSO | ||
219 | |||
220 | L<evp(3)|evp(3)> | ||
221 | |||
222 | =head1 HISTORY | ||
223 | |||
224 | =cut | ||