Add fix for CVE-2013-4353

[openssl.git] / doc / crypto / EVP_PKEY_encrypt.pod

diff --git a/doc/crypto/EVP_PKEY_encrypt.pod b/doc/crypto/EVP_PKEY_encrypt.pod
index 72673aa8b42da6c6fadde875b3642ae00226eb92..e495a81242b98950ac700c46eca934c15ae71c37 100644 (file)
--- a/doc/crypto/EVP_PKEY_encrypt.pod
+++ b/doc/crypto/EVP_PKEY_encrypt.pod
@@ -38,13 +38,44 @@ context if several operations are performed using the same parameters.
 =head1 RETURN VALUES
 
 EVP_PKEY_encrypt_init() and EVP_PKEY_encrypt() return 1 for success and 0
-or a negative value for failure.
+or a negative value for failure. In particular a return value of -2
+indicates the operation is not supported by the public key algorithm.
 
 =head1 EXAMPLE
 
 Encrypt data using OAEP (for RSA keys):
 
-[to be added]
+ #include <openssl/evp.h>
+ #include <openssl/rsa.h>
+
+ EVP_PKEY_CTX *ctx;
+ unsigned char *out, *in;
+ size_t outlen, inlen; 
+ EVP_PKEY *key;
+ /* NB: assumes key in, inlen are already set up
+  * and that key is an RSA public key
+  */
+ ctx = EVP_PKEY_CTX_new(key);
+ if (!ctx)
+       /* Error occurred */
+ if (EVP_PKEY_encrypt_init(ctx) <= 0)
+       /* Error */
+ if (EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_OAEP_PADDING) <= 0)
+       /* Error */
+
+ /* Determine buffer length */
+ if (EVP_PKEY_encrypt(ctx, NULL, &outlen, in, inlen) <= 0)
+       /* Error */
+
+ out = OPENSSL_malloc(outlen);
+
+ if (!out)
+       /* malloc failure */
+ 
+ if (EVP_PKEY_encrypt(ctx, out, &outlen, in, inlen) <= 0)
+       /* Error */
+
+ /* Encrypted data is outlen bytes written to buffer out */
 
 =head1 SEE ALSO
 
@@ -52,11 +83,11 @@ L<EVP_PKEY_CTX_new(3)|EVP_PKEY_CTX_new(3)>,
 L<EVP_PKEY_decrypt(3)|EVP_PKEY_decrypt(3)>,
 L<EVP_PKEY_sign(3)|EVP_PKEY_sign(3)>,
 L<EVP_PKEY_verify(3)|EVP_PKEY_verify(3)>,
-L<EVP_PKEY_verifyrecover(3)|EVP_PKEY_verifyrecover(3)>,
+L<EVP_PKEY_verify_recover(3)|EVP_PKEY_verify_recover(3)>,
 L<EVP_PKEY_derive(3)|EVP_PKEY_derive(3)> 
 
 =head1 HISTORY
 
-These functions were first added to OpenSSL 0.9.9.
+These functions were first added to OpenSSL 1.0.0.
 
 =cut