---
name: "libressl-EVP_OpenInit"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-EVP_OpenInit"
---

# libressl-EVP\_OpenInit(3)

EVP envelope decryption

## NAME

**EVP\_OpenInit**, **EVP\_OpenUpdate**, **EVP\_OpenFinal** – EVP envelope decryption

## SYNOPSIS

Crypto Library (libcrypto, -lcrypto)

**#include \<openssl/evp.h\>**

*int*\

**EVP\_OpenInit**(*EVP\_CIPHER\_CTX \*ctx*, *EVP\_CIPHER \*type*, *unsigned char \*ek*, *int ekl*, *unsigned char \*iv*, *EVP\_PKEY \*priv*);

*int*\

**EVP\_OpenUpdate**(*EVP\_CIPHER\_CTX \*ctx*, *unsigned char \*out*, *int \*outl*, *unsigned char \*in*, *int inl*);

*int*\

**EVP\_OpenFinal**(*EVP\_CIPHER\_CTX \*ctx*, *unsigned char \*out*, *int \*outl*);

## DESCRIPTION

The EVP envelope routines are a high level interface to envelope decryption. They decrypt a public key encrypted symmetric key and then decrypt data using it.

**EVP\_OpenInit**() initializes a cipher context *ctx* for decryption with cipher *type*. It decrypts the encrypted symmetric key of length *ekl* bytes passed in the *ek* parameter using the private key *priv*. The IV is supplied in the *iv* parameter.

**EVP\_OpenUpdate**() and **EVP\_OpenFinal**() have exactly the same properties as the EVP\_DecryptUpdate(3) and EVP\_DecryptFinal(3) routines.

It is possible to call **EVP\_OpenInit**() twice in the same way as EVP\_DecryptInit(3). The first call should have *priv* set to NULL and (after setting any cipher parameters) it should be called again with *type* set to NULL.

If the cipher passed in the *type* parameter is a variable length cipher then the key length will be set to the value of the recovered key length. If the cipher is a fixed length cipher then the recovered key length must match the fixed cipher length.

**EVP\_OpenUpdate**() is implemented as a macro.

## RETURN VALUES

**EVP\_OpenInit**() and **EVP\_OpenUpdate**() return 1 for success or 0 for failure.

**EVP\_OpenFinal**() returns 0 if the decrypt failed or 1 for success.

## SEE ALSO

evp(3), EVP\_EncryptInit(3), EVP\_SealInit(3)

## HISTORY

**EVP\_OpenInit**(), **EVP\_OpenUpdate**(), and **EVP\_OpenFinal**() first appeared in SSLeay 0.5.1 and have been available since OpenBSD 2.4.