#use wml::openssl-macros area=docs page=CMS_decrypt

<title>Documents, CMS_decrypt(3)</title>

<h1>CMS_decrypt(3)</h1>

#use wml::imp::generic

{:
## What's this? [[s|(<STRONG>[^<].+?)</A>(</STRONG><DD>)|$1$2|sg]]
[[s|<P>\s+<P>|<P>|sg]]
[[s|<P>\s+</|</|sg]]
[[s|<DD>\s*<DT>|<DD>&nbsp;<DT>|sg]]
[[s|<DD>\s*</DL>|<DD>&nbsp;</DL>|sg]]
[[s|\[|&#91;|sg]]
[[s|\]|&#93;|sg]]

<!-- INDEX BEGIN -->

<UL>

	<LI><A HREF="#NAME">NAME</A>
	<LI><A HREF="#SYNOPSIS">SYNOPSIS</A>
	<LI><A HREF="#DESCRIPTION">DESCRIPTION</A>
	<LI><A HREF="#NOTES">NOTES</A>
	<LI><A HREF="#RETURN_VALUES">RETURN VALUES</A>
	<LI><A HREF="#BUGS">BUGS</A>
	<LI><A HREF="#SEE_ALSO">SEE ALSO</A>
	<LI><A HREF="#HISTORY">HISTORY</A>
</UL>
<!-- INDEX END -->

<HR>
<P>
<HR>
<H1><A NAME="NAME">NAME</A></H1>
<PRE> CMS_decrypt - decrypt content from a CMS envelopedData structure
</PRE>
<P>
<HR>
<H1><A NAME="SYNOPSIS">SYNOPSIS</A></H1>
<PRE> #include &lt;openssl/cms.h&gt;
</PRE>
<PRE> int CMS_decrypt(CMS_ContentInfo *cms, EVP_PKEY *pkey, X509 *cert, BIO *dcont, BIO *out, unsigned int flags);
</PRE>
<P>
<HR>
<H1><A NAME="DESCRIPTION">DESCRIPTION</A></H1>
<P>
<CODE>CMS_decrypt()</CODE> extracts and decrypts the content from a CMS
EnvelopedData structure. <STRONG>pkey</STRONG> is the private key of the recipient, <STRONG>cert</STRONG> is the recipient's certificate, <STRONG>out</STRONG> is a BIO to write the content to and
<STRONG>flags</STRONG> is an optional set of flags.

</P>
<P>
The <STRONG>dcont</STRONG> parameter is used in the rare case where the encrypted content is detached.
It will normally be set to NULL.

</P>
<P>
<HR>
<H1><A NAME="NOTES">NOTES</A></H1>
<P>
<CODE>OpenSSL_add_all_algorithms()</CODE> (or equivalent) should be called
before using this function or errors about unknown algorithms will occur.

</P>
<P>
Although the recipients certificate is not needed to decrypt the data it is
needed to locate the appropriate (of possible several) recipients in the
CMS structure. If <STRONG>cert</STRONG> is set to NULL all possible recipients are tried.

</P>
<P>
It is possible to determine the correct recipient key by other means (for
example looking them up in a database) and setting them in the CMS
structure in advance using the CMS utility functions such as
<CODE>CMS_set1_pkey().</CODE> In this case both <STRONG>cert</STRONG> and <STRONG>pkey</STRONG> should be set to NULL.

</P>
<P>
To process KEKRecipientInfo types <CODE>CMS_set1_key()</CODE> or
<CODE>CMS_RecipientInfo_set0_key()</CODE> and
<CODE>CMS_ReceipientInfo_decrypt()</CODE> should be called before
<CODE>CMS_decrypt()</CODE> and
<STRONG>cert</STRONG> and <STRONG>pkey</STRONG> set to NULL.

</P>
<P>
The following flags can be passed in the <STRONG>flags</STRONG> parameter.

</P>
<P>
If the <STRONG>CMS_TEXT</STRONG> flag is set MIME headers for type <STRONG>text/plain</STRONG> are deleted from the content. If the content is not of type <STRONG>text/plain</STRONG> then an error is returned.

</P>
<P>
<HR>
<H1><A NAME="RETURN_VALUES">RETURN VALUES</A></H1>
<P>
<CODE>CMS_decrypt()</CODE> returns either 1 for success or 0 for failure.
The error can be obtained from <CODE>ERR_get_error(3)</CODE>

</P>
<P>
<HR>
<H1><A NAME="BUGS">BUGS</A></H1>
<P>
The lack of single pass processing and the need to hold all data in memory
as mentioned in <CODE>CMS_verify()</CODE> also applies to
<CODE>CMS_decrypt().</CODE>

</P>
<P>
<HR>
<H1><A NAME="SEE_ALSO">SEE ALSO</A></H1>
<P>
<A HREF="../crypto/ERR_get_error.html#">ERR_get_error(3)</A>, <A HREF="../crypto/CMS_encrypt.html#">CMS_encrypt(3)</A>



</P>
<P>
<HR>
<H1><A NAME="HISTORY">HISTORY</A></H1>
<P>
<CODE>CMS_decrypt()</CODE> was added to OpenSSL 0.9.8

</P>
:}