---
name: "libressl-d2i_PrivateKey"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-d2i_PrivateKey"
---

# libressl-d2i\_PrivateKey(3)

decode and encode EVP\_PKEY objects

## NAME

**d2i\_PrivateKey**, **d2i\_AutoPrivateKey**, **d2i\_PrivateKey\_bio**, **d2i\_PrivateKey\_fp**, **i2d\_PrivateKey**, **i2d\_PrivateKey\_bio**, **i2d\_PrivateKey\_fp**, **i2d\_PKCS8PrivateKeyInfo\_bio**, **i2d\_PKCS8PrivateKeyInfo\_fp**, **d2i\_PublicKey**, **i2d\_PublicKey** – decode and encode EVP\_PKEY objects

## SYNOPSIS

Crypto Library (libcrypto, -lcrypto)

**#include \<openssl/evp.h\>**

*EVP\_PKEY* *\**\

**d2i\_PrivateKey**(*int type*, *EVP\_PKEY \*\*val\_out*, *const unsigned char \*\*der\_in*, *long length*);

*EVP\_PKEY* *\**\

**d2i\_AutoPrivateKey**(*EVP\_PKEY \*\*val\_out*, *const unsigned char \*\*der\_in*, *long length*);

*EVP\_PKEY* *\**\

**d2i\_PrivateKey\_bio**(*BIO \*in\_bio*, *EVP\_PKEY \*\*val\_out*);

*EVP\_PKEY* *\**\

**d2i\_PrivateKey\_fp**(*FILE \*in\_fp*, *EVP\_PKEY \*\*val\_out*);

*int*\

**i2d\_PrivateKey**(*EVP\_PKEY \*val\_in*, *unsigned char \*\*der\_out*);

*int*\

**i2d\_PrivateKey\_bio**(*BIO \*out\_bio*, *EVP\_PKEY \*val\_in*);

*int*\

**i2d\_PrivateKey\_fp**(*FILE \*out\_fp*, *EVP\_PKEY \*val\_in*);

*int*\

**i2d\_PKCS8PrivateKeyInfo\_bio**(*BIO \*out\_bio*, *EVP\_PKEY \*val\_in*);

*int*\

**i2d\_PKCS8PrivateKeyInfo\_fp**(*FILE \*out\_fp*, *EVP\_PKEY \*val\_in*);

*EVP\_PKEY* *\**\

**d2i\_PublicKey**(*int type*, *EVP\_PKEY \*\*val\_out*, *const unsigned char \*\*der\_in*, *long length*);

*int*\

**i2d\_PublicKey**(*EVP\_PKEY \*val\_in*, *unsigned char \*\*der\_out*);

## DESCRIPTION

These are algorithm-independent interfaces to decode and encode private and public keys. For details about the semantics, examples, caveats, and bugs, see ASN1\_item\_d2i(3).

**d2i\_PrivateKey**() decodes a private key using algorithm *type*. It attempts to use any algorithm specific format or the PKCS#8 unencrypted *PrivateKeyInfo* format defined in RFC 5208 section 5. The *type* parameter should be a public key algorithm constant such as EVP\_PKEY\_RSA. An error occurs if the decoded key does not match *type*.

**d2i\_AutoPrivateKey**() is similar to **d2i\_PrivateKey**() except that it attempts to automatically detect the algorithm.

**d2i\_PrivateKey\_bio**() and **d2i\_PrivateKey\_fp**() are similar to **d2i\_PrivateKey**() except that they read from a *BIO* or *FILE* pointer.

**i2d\_PrivateKey**() encodes *val\_in*. It uses an algorithm specific format or, if none is defined for that key type, the PKCS#8 unencrypted *PrivateKeyInfo* format.

**i2d\_PrivateKey\_bio**() and **i2d\_PrivateKey\_fp**() are similar to **i2d\_PrivateKey**() except that they write to a *BIO* or *FILE* pointer and use a different convention for their return values.

**i2d\_PKCS8PrivateKeyInfo\_bio**() and **i2d\_PKCS8PrivateKeyInfo\_fp**() encode *val\_in* in PKCS#8 unencrypted *PrivateKeyInfo* format. They are similar to **i2d\_PrivateKey**() except that they don't use any algorithm-specific formats and that they write to a *BIO* or *FILE* pointer rather than to a buffer.

All these functions use DER format and unencrypted keys. Applications wishing to encrypt or decrypt private keys should use other functions such as d2i\_PKCS8PrivateKey\_bio(3) instead.

If \**val\_out* is not NULL when calling **d2i\_PrivateKey**() or **d2i\_AutoPrivateKey**() (i.e. an existing structure is being reused) and the key format is PKCS#8, then \**val\_out* will be freed and replaced on a successful call.

**d2i\_PublicKey**() calls d2i\_DSAPublicKey(3), o2i\_ECPublicKey(3), or d2i\_RSAPublicKey(3) depending on *type* and stores the result in the returned *EVP\_PKEY* object.

**i2d\_PublicKey**() calls i2d\_DSAPublicKey(3), i2o\_ECPublicKey(3), or i2d\_RSAPublicKey(3) depending on the algorithm used by *val\_in*.

## RETURN VALUES

**d2i\_PrivateKey**(), **d2i\_AutoPrivateKey**(), **d2i\_PrivateKey\_bio**(), **d2i\_PrivateKey\_fp**(), and **d2i\_PublicKey**() return a valid *EVP\_PKEY* structure or NULL if an error occurs.

**i2d\_PrivateKey**() and **i2d\_PublicKey**() return the number of bytes successfully encoded or a negative value if an error occurs.

**i2d\_PrivateKey\_bio**(), **i2d\_PrivateKey\_fp**(), **i2d\_PKCS8PrivateKeyInfo\_bio**(), and **i2d\_PKCS8PrivateKeyInfo\_fp**() return 1 for success or 0 if an error occurs.

For all functions, the error code can be obtained by calling ERR\_get\_error(3).

## SEE ALSO

d2i\_PKCS8\_PRIV\_KEY\_INFO(3), d2i\_PKCS8PrivateKey\_bio(3), EVP\_PKEY\_new(3), EVP\_PKEY\_type(3), PEM\_write\_PrivateKey(3), PKCS8\_PRIV\_KEY\_INFO\_new(3)

## STANDARDS

RFC 5208: Public-Key Cryptography Standards (PKCS) #8: Private-Key Information Syntax Specification

## HISTORY

**d2i\_PrivateKey**(), **i2d\_PrivateKey**(), **d2i\_PublicKey**(), and **i2d\_PublicKey**() first appeared in SSLeay 0.6.0 and have been available since OpenBSD 2.4.

**d2i\_AutoPrivateKey**(), **d2i\_PrivateKey\_bio**(), **d2i\_PrivateKey\_fp**(), **i2d\_PrivateKey\_bio**(), **i2d\_PrivateKey\_fp**(), **i2d\_PKCS8PrivateKeyInfo\_bio**(), and **i2d\_PKCS8PrivateKeyInfo\_fp**() first appeared in OpenSSL 0.9.5 and have been available since OpenBSD 2.7.