---
name: "libressl-AES_encrypt"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-AES_encrypt"
---

# libressl-AES\_encrypt(3)

low-level interface to the AES symmetric cipher

## NAME

**AES\_set\_encrypt\_key**, **AES\_set\_decrypt\_key**, **AES\_encrypt**, **AES\_decrypt**, **AES\_cbc\_encrypt** – low-level interface to the AES symmetric cipher

## SYNOPSIS

Crypto Library (libcrypto, -lcrypto)

**#include \<openssl/aes.h\>**

*int*\

**AES\_set\_encrypt\_key**(*const unsigned char \*userKey*, *const int bits*, *AES\_KEY \*key*);

*int*\

**AES\_set\_decrypt\_key**(*const unsigned char \*userKey*, *const int bits*, *AES\_KEY \*key*);

*void*\

**AES\_encrypt**(*const unsigned char \*in*, *unsigned char \*out*, *const AES\_KEY \*key*);

*void*\

**AES\_decrypt**(*const unsigned char \*in*, *unsigned char \*out*, *const AES\_KEY \*key*);

*void*\

**AES\_cbc\_encrypt**(*const unsigned char \*in*, *unsigned char \*out*, *size\_t length*, *const AES\_KEY \*key*, *unsigned char \*ivec*, *const int enc*);

## DESCRIPTION

These functions provide a low-level interface to the AES symmetric cipher algorithm, also called Rijndael. For reasons of flexibility, it is recommended that application programs use the high-level interface described in EVP\_EncryptInit(3) and EVP\_aes\_128\_cbc(3) instead whenever possible.

*AES\_KEY* is a structure that can hold up to 60 *int* values and a number of rounds.

**AES\_set\_encrypt\_key**() expands the *userKey*, which is *bits* long, into the *key* structure to prepare for encryption. The number of bits and bytes read from *userKey*, the number of *int* values stored into *key*, and the number of rounds are as follows:

| | | | |
| --- | --- | --- | --- |
| bits | bytes | ints | rounds |
| 128 | 16 | 44 | 10 |
| 192 | 24 | 52 | 12 |
| 256 | 32 | 60 | 14 |

**AES\_set\_decrypt\_key**() does the same, but in preparation for decryption.

**AES\_encrypt**() reads a single 16 byte block from \**in*, encrypts it with the *key*, and writes the 16 resulting bytes to \**out*. The 16 byte buffers starting at *in* and *out* can overlap, and *in* and *out* can even point to the same memory location.

**AES\_decrypt**() decrypts a single block and is otherwise identical to **AES\_encrypt**().

If *enc* is non-zero, **AES\_cbc\_encrypt**() encrypts *len* bytes at *in* to *out* using the 128 bit *key* and the 128 bit initialization vector *ivec* in CBC mode. If *enc* is 0, **AES\_cbc\_encrypt**() performs the corresponding decryption.

## RETURN VALUES

**AES\_set\_encrypt\_key**() and **AES\_set\_decrypt\_key**() return 0 for success, -1 if *userKey* or *key* is NULL, or -2 if the number of *bits* is unsupported.

## SEE ALSO

[crypto(3)](/crypto/3.md), EVP\_aes\_128\_cbc(3), EVP\_EncryptInit(3)

## STANDARDS

ISO/IEC 18033-3:2010 Information technology — Security techniques — Encryption algorithms — Part 3: Block ciphers

## HISTORY

These functions first appeared in OpenSSL 0.9.7 and have been available since OpenBSD 3.2.

## AUTHORS

Vincent Rijmen Antoon Bosselaers Paulo Barreto