---
name: "libressl-SSL_CIPHER_get_name"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-SSL_CIPHER_get_name"
---

# libressl-SSL\_CIPHER\_get\_name(3)

get SSL\_CIPHER properties

## NAME

**SSL\_CIPHER\_get\_name**, **SSL\_CIPHER\_get\_bits**, **SSL\_CIPHER\_get\_version**, **SSL\_CIPHER\_get\_cipher\_nid**, **SSL\_CIPHER\_get\_digest\_nid**, **SSL\_CIPHER\_get\_handshake\_digest**, **SSL\_CIPHER\_get\_kx\_nid**, **SSL\_CIPHER\_get\_auth\_nid**, **SSL\_CIPHER\_is\_aead**, **SSL\_CIPHER\_find**, **SSL\_CIPHER\_get\_id**, **SSL\_CIPHER\_description** – get SSL\_CIPHER properties

## SYNOPSIS

SSL Library (libssl, -lssl) libcrypto

**#include \<openssl/ssl.h\>**

*const* *char* *\**\

**SSL\_CIPHER\_get\_name**(*const SSL\_CIPHER \*cipher*);

*int*\

**SSL\_CIPHER\_get\_bits**(*const SSL\_CIPHER \*cipher*, *int \*alg\_bits*);

*const* *char* *\**\

**SSL\_CIPHER\_get\_version**(*const SSL\_CIPHER \*cipher*);

*int*\

**SSL\_CIPHER\_get\_cipher\_nid**(*const SSL\_CIPHER \*cipher*);

*int*\

**SSL\_CIPHER\_get\_digest\_nid**(*const SSL\_CIPHER \*cipher*);

*const* *EVP\_MD* *\**\

**SSL\_CIPHER\_get\_handshake\_digest**(*const SSL\_CIPHER \*cipher*);

*int*\

**SSL\_CIPHER\_get\_kx\_nid**(*const SSL\_CIPHER \*cipher*);

*int*\

**SSL\_CIPHER\_get\_auth\_nid**(*const SSL\_CIPHER \*cipher*);

*int*\

**SSL\_CIPHER\_is\_aead**(*const SSL\_CIPHER \*cipher*);

*const* *SSL\_CIPHER* *\**\

**SSL\_CIPHER\_find**(*SSL \*ssl*, *const unsigned char \*ptr*);

*unsigned* *long*\

**SSL\_CIPHER\_get\_id**(*const SSL\_CIPHER \*cipher*);

*char* *\**\

**SSL\_CIPHER\_description**(*const SSL\_CIPHER \*cipher*, *char \*buf*, *int size*);

## DESCRIPTION

**SSL\_CIPHER\_get\_name**() returns a pointer to the name of *cipher*.

**SSL\_CIPHER\_get\_bits**() returns the number of secret bits used for *cipher*. If *alg\_bits* is not NULL, the number of bits processed by the chosen algorithm is stored into it.

**SSL\_CIPHER\_get\_version**() returns a string which indicates the SSL/TLS protocol version that first defined the cipher. This is currently "TLSv1/SSLv3". In some cases it should possibly return "TLSv1.2" but the function does not; use **SSL\_CIPHER\_description**() instead.

**SSL\_CIPHER\_get\_cipher\_nid**() returns the cipher NID corresponding to the *cipher*. If there is no cipher (e.g. for cipher suites with no encryption), then NID\_undef is returned.

**SSL\_CIPHER\_get\_digest\_nid**() returns the digest NID corresponding to the MAC used by the *cipher* during record encryption/decryption. If there is no digest (e.g. for AEAD cipher suites), then NID\_undef is returned.

**SSL\_CIPHER\_get\_handshake\_digest**() returns the *EVP\_MD* object representing the digest used during a TLS handshake with the cipher *c*, which may be different to the digest used in the message authentication code for encrypted records.

**SSL\_CIPHER\_get\_kx\_nid**() returns the key exchange NID corresponding to the method used by the *cipher*. If there is no key exchange, then NID\_undef is returned. Examples of possible return values include NID\_kx\_rsa, NID\_kx\_dhe, and NID\_kx\_ecdhe.

**SSL\_CIPHER\_get\_auth\_nid**() returns the authentication NID corresponding to the method used by the *cipher*. If there is no authentication, NID\_undef is returned. Examples of possible return values include NID\_auth\_rsa and NID\_auth\_ecdsa.

**SSL\_CIPHER\_is\_aead**() returns 1 if the *cipher* is AEAD (e.g. GCM or ChaCha20/Poly1305), or 0 if it is not AEAD.

**SSL\_CIPHER\_find**() returns a pointer to a *SSL\_CIPHER* structure which has the cipher ID specified in *ptr*. The *ptr* parameter is an array of length two which stores the two-byte TLS cipher ID (as allocated by IANA) in network byte order. *SSL\_CIPHER\_find* returns NULL if an error occurs or the indicated cipher is not found.

**SSL\_CIPHER\_get\_id**() returns the ID of the given *cipher*, which must not be NULL. The ID here is an OpenSSL-specific concept, which stores a prefix of 0x0300 in the higher two bytes and the IANA-specified cipher suite ID in the lower two bytes. For instance, TLS\_RSA\_WITH\_NULL\_MD5 has IANA ID "0x00, 0x01", so **SSL\_CIPHER\_get\_id**() returns 0x03000001.

**SSL\_CIPHER\_description**() copies a textual description of *cipher* into the buffer *buf*, which must be at least *size* bytes long. The *cipher* argument must not be a NULL pointer. If *buf* is NULL, a buffer is allocated using [asprintf(3)](/asprintf/3.md); that buffer should be freed using the [free(3)](/free/3.md) function. If *len* is too small to hold the description, a pointer to the static string "Buffer too small" is returned. If memory allocation fails, which can happen even if a *buf* of sufficient size is provided, a pointer to the static string "OPENSSL\_malloc Error" is returned and the content of *buf* remains unchanged.

The string returned by **SSL\_CIPHER\_description**() consists of several fields separated by whitespace:

- ⟨*ciphername*⟩

  Textual representation of the cipher name.

- ⟨*protocol* *version*⟩

  Protocol version: **SSLv3**, **TLSv1.2**, or **TLSv1.3**. The TLSv1.0 ciphers are flagged with SSLv3. No new ciphers were added by TLSv1.1.

- Kx=⟨*key* *exchange*⟩

  Key exchange method: **DH**, **ECDH**, **GOST**, **RSA**, or **TLSv1.3**.

- Au=⟨*authentication*⟩

  Authentication method: **ECDSA**, **GOST01**, **RSA**, **TLSv1.3**, or **None**. **None** is the representation of anonymous ciphers.

- Enc=⟨*symmetric* *encryption* *method*⟩

  Encryption method with number of secret bits: **3DES(168)**, **RC4(128)**, **AES(128)**, **AES(256)**, **AESGCM(128)**, **AESGCM(256)**, **Camellia(128)**, **Camellia(256)**, **ChaCha20-Poly1305**, **GOST-28178-89-CNT**, or **None**.

- Mac=⟨*message* *authentication* *code*⟩

  Message digest: **MD5**, **SHA1**, **SHA256**, **SHA384**, **AEAD**, **GOST94**, **GOST89IMIT**, or **STREEBOG256**.

## RETURN VALUES

**SSL\_CIPHER\_get\_name**() returns an internal pointer to a NUL-terminated string. **SSL\_CIPHER\_get\_version**() returns a pointer to a static NUL-terminated string. If *cipher* is a NULL pointer, both functions return a pointer to the static string "(NONE)".

**SSL\_CIPHER\_get\_bits**() returns a positive integer representing the number of secret bits or 0 if *cipher* is a NULL pointer.

**SSL\_CIPHER\_get\_cipher\_nid**(), **SSL\_CIPHER\_get\_digest\_nid**(), **SSL\_CIPHER\_get\_kx\_nid**(), and **SSL\_CIPHER\_get\_auth\_nid**() return an NID constant or NID\_undef if an error occurred. **SSL\_CIPHER\_get\_handshake\_digest**() returns a valid *EVP\_MD* object or NULL if an error occurred.

**SSL\_CIPHER\_is\_aead**() returns 1 if the *cipher* is AEAD or 0 otherwise.

**SSL\_CIPHER\_find**() returns a pointer to a valid *SSL\_CIPHER* structure or NULL if an error occurred.

**SSL\_CIPHER\_get\_id**() returns a 32-bit unsigned integer.

**SSL\_CIPHER\_description**() returns *buf* or a newly allocated string on success or a pointer to a static string on error.

## EXAMPLES

An example for the output of **SSL\_CIPHER\_description**():

```
ECDHE-RSA-AES256-GCM-SHA256 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(256) Mac=AEAD
```

A complete list can be retrieved by invoking the following command:

```
$ openssl ciphers -v ALL:COMPLEMENTOFALL
```

## SEE ALSO

[openssl(1)](/openssl/1.md), [ssl(3)](/ssl/3.md), SSL\_get\_ciphers(3), SSL\_get\_current\_cipher(3)

## HISTORY

**SSL\_CIPHER\_description**() first appeared in SSLeay 0.8.0. **SSL\_CIPHER\_get\_name**(), **SSL\_CIPHER\_get\_bits**(), and **SSL\_CIPHER\_get\_version**() first appeared in SSLeay 0.8.1. These functions have been available since OpenBSD 2.4.

**SSL\_CIPHER\_get\_id**() first appeared in OpenSSL 1.0.1 and has been available since OpenBSD 5.3.

**SSL\_CIPHER\_get\_cipher\_nid**(), **SSL\_CIPHER\_get\_digest\_nid**(), **SSL\_CIPHER\_get\_kx\_nid**(), **SSL\_CIPHER\_get\_auth\_nid**(), and **SSL\_CIPHER\_is\_aead**() first appeared in OpenSSL 1.1.0 and have been available since OpenBSD 6.3. **SSL\_CIPHER\_find**() first appeared in OpenSSL 1.1.0 and has been available since OpenBSD 7.0. **SSL\_CIPHER\_get\_handshake\_digest**() first appeared in OpenSSL 1.1.1 and has been available since OpenBSD 7.6.

## BUGS

If **SSL\_CIPHER\_description**() cannot handle a built-in cipher, the according description of the cipher property is "unknown". This case should not occur.