#use wml::openssl-macros area=docs page=PKCS7_decrypt

<title>Documents, PKCS7_decrypt(3)</title>

<h1>PKCS7_decrypt(3)</h1>

#use wml::imp::generic

{:
## What's this? [[s|(<STRONG>[^<].+?)</A>(</STRONG><DD>)|$1$2|sg]]
[[s|<P>\s+<P>|<P>|sg]]
[[s|<P>\s+</|</|sg]]
[[s|<DD>\s*<DT>|<DD>&nbsp;<DT>|sg]]
[[s|<DD>\s*</DL>|<DD>&nbsp;</DL>|sg]]
[[s|\[|&#91;|sg]]
[[s|\]|&#93;|sg]]

<!-- INDEX BEGIN -->

<UL>

	<LI><A HREF="#NAME">NAME</A>
	<LI><A HREF="#SYNOPSIS">SYNOPSIS</A>
	<LI><A HREF="#DESCRIPTION">DESCRIPTION</A>
	<LI><A HREF="#NOTES">NOTES</A>
	<LI><A HREF="#RETURN_VALUES">RETURN VALUES</A>
	<LI><A HREF="#BUGS">BUGS</A>
	<LI><A HREF="#SEE_ALSO">SEE ALSO</A>
	<LI><A HREF="#HISTORY">HISTORY</A>
</UL>
<!-- INDEX END -->

<HR>
<P>
<HR>
<H1><A NAME="NAME">NAME</A></H1>
<P>
PKCS7_decrypt - decrypt content from a PKCS#7 envelopedData structure

</P>
<P>
<HR>
<H1><A NAME="SYNOPSIS">SYNOPSIS</A></H1>
<PRE> #include &lt;openssl/pkcs7.h&gt;
</PRE>
<PRE> int PKCS7_decrypt(PKCS7 *p7, EVP_PKEY *pkey, X509 *cert, BIO *data, int flags);
</PRE>
<P>
<HR>
<H1><A NAME="DESCRIPTION">DESCRIPTION</A></H1>
<P>
<CODE>PKCS7_decrypt()</CODE> extracts and decrypts the content from a
PKCS#7 envelopedData structure. <STRONG>pkey</STRONG> is the private key of the recipient, <STRONG>cert</STRONG> is the recipients certificate, <STRONG>data</STRONG> is a BIO to write the content to and
<STRONG>flags</STRONG> is an optional set of flags.

</P>
<P>
<HR>
<H1><A NAME="NOTES">NOTES</A></H1>
<P>
<CODE>OpenSSL_add_all_algorithms()</CODE> (or equivalent) should be called
before using this function or errors about unknown algorithms will occur.

</P>
<P>
Although the recipients certificate is not needed to decrypt the data it is
needed to locate the appropriate (of possible several) recipients in the
PKCS#7 structure.

</P>
<P>
The following flags can be passed in the <STRONG>flags</STRONG> parameter.

</P>
<P>
If the <STRONG>PKCS7_TEXT</STRONG> flag is set MIME headers for type <STRONG>text/plain</STRONG> are deleted from the content. If the content is not of type <STRONG>text/plain</STRONG> then an error is returned.

</P>
<P>
<HR>
<H1><A NAME="RETURN_VALUES">RETURN VALUES</A></H1>
<P>
<CODE>PKCS7_decrypt()</CODE> returns either 1 for success or 0 for failure.
The error can be obtained from <CODE>ERR_get_error(3)</CODE>

</P>
<P>
<HR>
<H1><A NAME="BUGS">BUGS</A></H1>
<P>
<CODE>PKCS7_decrypt()</CODE> must be passed the correct recipient key and
certificate. It would be better if it could look up the correct key and
certificate from a database.

</P>
<P>
The lack of single pass processing and need to hold all data in memory as
mentioned in <CODE>PKCS7_sign()</CODE> also applies to
<CODE>PKCS7_verify().</CODE>

</P>
<P>
<HR>
<H1><A NAME="SEE_ALSO">SEE ALSO</A></H1>
<P>
<A HREF="../crypto/ERR_get_error.html#">ERR_get_error(3)</A>, <A HREF="../crypto/PKCS7_encrypt.html#">PKCS7_encrypt(3)</A>



</P>
<P>
<HR>
<H1><A NAME="HISTORY">HISTORY</A></H1>
<P>
<CODE>PKCS7_decrypt()</CODE> was added to OpenSSL 0.9.5

</P>
:}