---
name: "libressl-CMS_get0_RecipientInfos"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-CMS_get0_RecipientInfos"
---

# libressl-CMS\_get0\_RecipientInfos(3)

CMS EnvelopedData RecipientInfo routines

## NAME

**CMS\_get0\_RecipientInfos**, **CMS\_RecipientInfo\_type**, **CMS\_RecipientInfo\_ktri\_get0\_signer\_id**, **CMS\_RecipientInfo\_ktri\_cert\_cmp**, **CMS\_RecipientInfo\_set0\_pkey**, **CMS\_RecipientInfo\_kekri\_get0\_id**, **CMS\_RecipientInfo\_kekri\_id\_cmp**, **CMS\_RecipientInfo\_set0\_key**, **CMS\_RecipientInfo\_decrypt**, **CMS\_RecipientInfo\_encrypt** – CMS EnvelopedData RecipientInfo routines

## SYNOPSIS

Crypto Library (libcrypto, -lcrypto)

**#include \<openssl/cms.h\>**

*STACK\_OF(CMS\_RecipientInfo)* *\**\

**CMS\_get0\_RecipientInfos**(*CMS\_ContentInfo \*cms*);

*int*\

**CMS\_RecipientInfo\_type**(*CMS\_RecipientInfo \*ri*);

*int*\

**CMS\_RecipientInfo\_ktri\_get0\_signer\_id**(*CMS\_RecipientInfo \*ri*, *ASN1\_OCTET\_STRING \*\*keyid*, *X509\_NAME \*\*issuer*, *ASN1\_INTEGER \*\*sno*);

*int*\

**CMS\_RecipientInfo\_ktri\_cert\_cmp**(*CMS\_RecipientInfo \*ri*, *X509 \*certificate*);

*int*\

**CMS\_RecipientInfo\_set0\_pkey**(*CMS\_RecipientInfo \*ri*, *EVP\_PKEY \*pkey*);

*int*\

**CMS\_RecipientInfo\_kekri\_get0\_id**(*CMS\_RecipientInfo \*ri*, *X509\_ALGOR \*\*palg*, *ASN1\_OCTET\_STRING \*\*pid*, *ASN1\_GENERALIZEDTIME \*\*pdate*, *ASN1\_OBJECT \*\*potherid*, *ASN1\_TYPE \*\*pothertype*);

*int*\

**CMS\_RecipientInfo\_kekri\_id\_cmp**(*CMS\_RecipientInfo \*ri*, *const unsigned char \*id*, *size\_t idlen*);

*int*\

**CMS\_RecipientInfo\_set0\_key**(*CMS\_RecipientInfo \*ri*, *unsigned char \*key*, *size\_t keylen*);

*int*\

**CMS\_RecipientInfo\_decrypt**(*CMS\_ContentInfo \*cms*, *CMS\_RecipientInfo \*ri*);

*int*\

**CMS\_RecipientInfo\_encrypt**(*CMS\_ContentInfo \*cms*, *CMS\_RecipientInfo \*ri*);

## DESCRIPTION

**CMS\_get0\_RecipientInfos**() returns all the *RecipientInfo* structures associated with the *EnvelopedData* structure *cms*.

**CMS\_RecipientInfo\_type**() returns the type of *ri*:

| | | |
| --- | --- | --- |
| CMS\_RECIPINFO\_TRANS | for | *KeyTransRecipientInfo*, |
| CMS\_RECIPINFO\_AGREE | for | *KeyAgreeRecipientInfo*, |
| CMS\_RECIPINFO\_KEK | for | *KEKRecipientInfo*, |
| CMS\_RECIPINFO\_PASS | for | *PasswordRecipientinfo*, or |
| CMS\_RECIPINFO\_OTHER | for | *OtherRecipientInfo*. |

**CMS\_RecipientInfo\_ktri\_get0\_signer\_id**() retrieves the certificate *RecipientIdentifier* associated with the *KeyTransRecipientInfo* structure *ri*. Either the *SubjectKeyIdentifier* will be set in *keyid* or both issuer name and serial number in *issuer* and *sno*.

**CMS\_RecipientInfo\_ktri\_cert\_cmp**() compares the *certificate* against the *KeyTransRecipientInfo* structure *ri*.

**CMS\_RecipientInfo\_set0\_pkey**() associates the private key *pkey* with the *KeyTransRecipientInfo* structure *ri*.

**CMS\_RecipientInfo\_kekri\_get0\_id**() retrieves the key information from the *KEKRecipientInfo* structure *ri*. Fields are copied out as follows:

| | | |
| --- | --- | --- |
| *keyEncryptionAlgorithm* | to | \**palg*, |
| *keyIdentifier* | to | \**pid*, |
| *date* | to | \**pdate* (optional), |
| *other.keyAttrId* | to | \**potherid* (optional), |
| *other.keyAttr* | to | \**pothertype* (optional). |

Where a field is optional and absent, NULL is written to the corresponding parameter. Parameters the application is not interested in can be set to NULL.

**CMS\_RecipientInfo\_kekri\_id\_cmp**() compares the identifier in the *id* and *idlen* parameters against the *keyIdentifier* field of the *KEKRecipientInfo* structure *ri*.

**CMS\_RecipientInfo\_set0\_key**() associates the symmetric *key* of length *keylen* with the *KEKRecipientInfo* structure *ri*.

**CMS\_RecipientInfo\_decrypt**() attempts to decrypt the *RecipientInfo* structure *ri* in *cms*. A key must have been associated with *ri* first.

**CMS\_RecipientInfo\_encrypt**() attempts to encrypt the *RecipientInfo* structure *ri* in *cms*. A key must have been associated with *ri* first and the content encryption key must be available, for example by a previous call to **CMS\_RecipientInfo\_decrypt**().

The main purpose of these functions is to enable an application to lookup recipient keys using any appropriate technique when the simpler method of CMS\_decrypt(3) is not appropriate.

In typical usage, an application retrieves all *CMS\_RecipientInfo* structures using **CMS\_get0\_RecipientInfos**() and checks the type of each using **CMS\_RecipientInfo\_type**(). Depending on the type, the *CMS\_RecipientInfo* structure can be ignored or its key identifier data retrieved using an appropriate function. If the corresponding secret or private key can be obtained by any appropriate means, it can then be associated with the structure and **CMS\_RecipientInfo\_decrypt**() called. If successful, CMS\_decrypt(3) can be called with a NULL key to decrypt the enveloped content.

The function **CMS\_RecipientInfo\_encrypt**() can be used to add a new recipient to an existing enveloped data structure. Typically an application will first decrypt an appropriate *CMS\_RecipientInfo* structure to make the content encrypt key available. It will then add a new recipient using a function such as CMS\_add1\_recipient\_cert(3) and finally encrypt the content encryption key using **CMS\_RecipientInfo\_encrypt**().

## RETURN VALUES

**CMS\_get0\_RecipientInfos**() returns an internal pointer to all the *CMS\_RecipientInfo* structures, or NULL if an error occurs.

**CMS\_RecipientInfo\_type**() returns an integer constant.

**CMS\_RecipientInfo\_ktri\_get0\_signer\_id**(), **CMS\_RecipientInfo\_set0\_pkey**(), **CMS\_RecipientInfo\_kekri\_get0\_id**(), **CMS\_RecipientInfo\_set0\_key**(), **CMS\_RecipientInfo\_decrypt**(), and **CMS\_RecipientInfo\_encrypt**() return 1 for success or 0 if an error occurs.

**CMS\_RecipientInfo\_ktri\_cert\_cmp**() and **CMS\_RecipientInfo\_kekri\_id\_cmp**() return 0 when *ri* matches or non-zero otherwise.

Any error can be obtained from ERR\_get\_error(3).

## SEE ALSO

CMS\_ContentInfo\_new(3), CMS\_decrypt(3)

## STANDARDS

RFC 5652 Cryptographic Message Syntax (CMS):

- section 6.1: EnvelopedData Type

- section 6.2: RecipientInfo Type

- section 6.2.1: KeyTransRecipientInfo Type

- section 6.2.3: KEKRecipientInfo Type

## HISTORY

These functions first appeared in OpenSSL 0.9.8h, except that **CMS\_RecipientInfo\_encrypt**() first appeared in OpenSSL 1.0.2. They have been available since OpenBSD 6.7.