openssl_private_decrypt recovers a short RSA encrypted block created using the matching public key and padding mode.
The examples explain the data format, expected results and the difference between this API and nearby cryptographic operations.
What It Does
The operation is intended for: openssl_private_decrypt recovers a short RSA encrypted block created using the matching public key and padding mode.
The OpenSSL extension must be enabled.
Syntax and Return Value
openssl_private_decrypt(string $data, $decrypted_data, $private_key, int $padding = ...): bool| Parameter | Purpose |
|---|---|
| $data (string) | The input data bytes. Use the exact original bytes when verifying. |
| $decrypted_data (mixed) | Use the PHP signature above to determine the exact expected input type; validate untrusted inputs before calling. |
| $private_key (mixed) | The corresponding private key; never expose or log its PEM data. |
| $padding (int) | Use the PHP signature above to determine the exact expected input type; validate untrusted inputs before calling. |
The declared return type is shown above. Errors can include false results or exceptions depending on this API: RSA block operations have strict padding and message-size limits. Do not use private_encrypt/public_decrypt as a replacement for standard signature APIs.
Example 1: Basic Operation
This is low-level RSA on short messages, not a complete secure encryption or signature protocol.
<?php
$private = openssl_pkey_new(['private_key_type' => OPENSSL_KEYTYPE_RSA, 'private_key_bits' => 2048]);
if ($private === false) { throw new RuntimeException('Key generation failed'); }
$details = openssl_pkey_get_details($private);
$public = $details['key'];
$csr = openssl_csr_new(['commonName' => 'test.example'], $private, ['digest_alg' => 'sha256']);
if ($csr === false) { throw new RuntimeException('CSR creation failed'); }
$cert = openssl_csr_sign($csr, null, $private, 1, ['digest_alg' => 'sha256']);
if ($cert === false) { throw new RuntimeException('Certificate creation failed'); }
openssl_public_encrypt("annual report", $encoded, $public, OPENSSL_PKCS1_OAEP_PADDING);
var_dump(openssl_private_decrypt($encoded, $plain, $private, OPENSSL_PKCS1_OAEP_PADDING) && $plain === "annual report");Example 2: A Different Use Case
This is low-level RSA on short messages, not a complete secure encryption or signature protocol.
<?php
// Check the alternative case.
$private = openssl_pkey_new(['private_key_type' => OPENSSL_KEYTYPE_RSA, 'private_key_bits' => 2048]);
if ($private === false) { throw new RuntimeException('Key generation failed'); }
$details = openssl_pkey_get_details($private);
$public = $details['key'];
$csr = openssl_csr_new(['commonName' => 'test.example'], $private, ['digest_alg' => 'sha256']);
if ($csr === false) { throw new RuntimeException('CSR creation failed'); }
$cert = openssl_csr_sign($csr, null, $private, 1, ['digest_alg' => 'sha256']);
if ($cert === false) { throw new RuntimeException('Certificate creation failed'); }
openssl_public_encrypt("invoice 42", $encoded, $public, OPENSSL_PKCS1_OAEP_PADDING);
var_dump(openssl_private_decrypt($encoded, $plain, $private, OPENSSL_PKCS1_OAEP_PADDING) && $plain === "invoice 42");Practical Example: Checking the Result
This is low-level RSA on short messages, not a complete secure encryption or signature protocol.
<?php
// Verify the expected behavior before using results.
$private = openssl_pkey_new(['private_key_type' => OPENSSL_KEYTYPE_RSA, 'private_key_bits' => 2048]);
if ($private === false) { throw new RuntimeException('Key generation failed'); }
$details = openssl_pkey_get_details($private);
$public = $details['key'];
$csr = openssl_csr_new(['commonName' => 'test.example'], $private, ['digest_alg' => 'sha256']);
if ($csr === false) { throw new RuntimeException('CSR creation failed'); }
$cert = openssl_csr_sign($csr, null, $private, 1, ['digest_alg' => 'sha256']);
if ($cert === false) { throw new RuntimeException('Certificate creation failed'); }
openssl_public_encrypt("signed event", $encoded, $public, OPENSSL_PKCS1_OAEP_PADDING);
var_dump(openssl_private_decrypt($encoded, $plain, $private, OPENSSL_PKCS1_OAEP_PADDING) && $plain === "signed event");Important Behavior and Edge Cases
RSA block operations have strict padding and message-size limits. Do not use private_encrypt/public_decrypt as a replacement for standard signature APIs.
RSA block operations have strict padding and message-size limits. Do not use private_encrypt/public_decrypt as a replacement for standard signature APIs.
Comparison with Related Functions
| Approach | Key distinction |
|---|---|
| openssl_private_decrypt | openssl_private_decrypt recovers a short RSA encrypted block created using the matching public key and padding mode. |
| Related technique | Prefer openssl_sign/openssl_verify for signatures and hybrid encryption for large payloads. |
Common Beginner Mistakes
| Mistake | Correct approach |
|---|---|
| Confusing this operation with a neighboring cryptographic or security mechanism | Prefer openssl_sign/openssl_verify for signatures and hybrid encryption for large payloads. |
| Ignoring a security prerequisite or failure case | RSA block operations have strict padding and message-size limits. Do not use private_encrypt/public_decrypt as a replacement for standard signature APIs. |
Key Takeaways
- openssl_private_decrypt recovers a short RSA encrypted block created using the matching public key and padding mode.
- RSA block operations have strict padding and message-size limits. Do not use private_encrypt/public_decrypt as a replacement for standard signature APIs.
- Prefer openssl_sign/openssl_verify for signatures and hybrid encryption for large payloads.
Apply this behavior to a real application only after confirming the required extension, configuration and failure handling on the deployment runtime.