openssl_public_decrypt processes a legacy block produced by RSA private-key encryption; use openssl_verify for real signatures.
The examples explain the data format, expected results and the difference between this API and nearby cryptographic operations.
What It Does
The operation is intended for: openssl_public_decrypt processes a legacy block produced by RSA private-key encryption; use openssl_verify for real signatures.
The OpenSSL extension must be enabled.
Syntax and Return Value
openssl_public_decrypt(string $data, $decrypted_data, $public_key, int $padding = ...): bool| Parameter | Purpose |
|---|---|
| $data (string) | The input data bytes. Use the exact original bytes when verifying. |
| $decrypted_data (mixed) | Use the PHP signature above to determine the exact expected input type; validate untrusted inputs before calling. |
| $public_key (mixed) | A public key that belongs to the intended, verified peer. |
| $padding (int) | Use the PHP signature above to determine the exact expected input type; validate untrusted inputs before calling. |
The declared return type is shown above. Errors can include false results or exceptions depending on this API: RSA block operations have strict padding and message-size limits. Do not use private_encrypt/public_decrypt as a replacement for standard signature APIs.
Example 1: Basic Operation
This is low-level RSA on short messages, not a complete secure encryption or signature protocol.
<?php
$private = openssl_pkey_new(['private_key_type' => OPENSSL_KEYTYPE_RSA, 'private_key_bits' => 2048]);
if ($private === false) { throw new RuntimeException('Key generation failed'); }
$details = openssl_pkey_get_details($private);
$public = $details['key'];
$csr = openssl_csr_new(['commonName' => 'test.example'], $private, ['digest_alg' => 'sha256']);
if ($csr === false) { throw new RuntimeException('CSR creation failed'); }
$cert = openssl_csr_sign($csr, null, $private, 1, ['digest_alg' => 'sha256']);
if ($cert === false) { throw new RuntimeException('Certificate creation failed'); }
openssl_private_encrypt("annual report", $encoded, $private);
var_dump(openssl_public_decrypt($encoded, $plain, $public) && $plain === "annual report");Example 2: A Different Use Case
This is low-level RSA on short messages, not a complete secure encryption or signature protocol.
<?php
// Check the alternative case.
$private = openssl_pkey_new(['private_key_type' => OPENSSL_KEYTYPE_RSA, 'private_key_bits' => 2048]);
if ($private === false) { throw new RuntimeException('Key generation failed'); }
$details = openssl_pkey_get_details($private);
$public = $details['key'];
$csr = openssl_csr_new(['commonName' => 'test.example'], $private, ['digest_alg' => 'sha256']);
if ($csr === false) { throw new RuntimeException('CSR creation failed'); }
$cert = openssl_csr_sign($csr, null, $private, 1, ['digest_alg' => 'sha256']);
if ($cert === false) { throw new RuntimeException('Certificate creation failed'); }
openssl_private_encrypt("invoice 42", $encoded, $private);
var_dump(openssl_public_decrypt($encoded, $plain, $public) && $plain === "invoice 42");Practical Example: Checking the Result
This is low-level RSA on short messages, not a complete secure encryption or signature protocol.
<?php
// Verify the expected behavior before using results.
$private = openssl_pkey_new(['private_key_type' => OPENSSL_KEYTYPE_RSA, 'private_key_bits' => 2048]);
if ($private === false) { throw new RuntimeException('Key generation failed'); }
$details = openssl_pkey_get_details($private);
$public = $details['key'];
$csr = openssl_csr_new(['commonName' => 'test.example'], $private, ['digest_alg' => 'sha256']);
if ($csr === false) { throw new RuntimeException('CSR creation failed'); }
$cert = openssl_csr_sign($csr, null, $private, 1, ['digest_alg' => 'sha256']);
if ($cert === false) { throw new RuntimeException('Certificate creation failed'); }
openssl_private_encrypt("signed event", $encoded, $private);
var_dump(openssl_public_decrypt($encoded, $plain, $public) && $plain === "signed event");Important Behavior and Edge Cases
RSA block operations have strict padding and message-size limits. Do not use private_encrypt/public_decrypt as a replacement for standard signature APIs.
RSA block operations have strict padding and message-size limits. Do not use private_encrypt/public_decrypt as a replacement for standard signature APIs.
Comparison with Related Functions
| Approach | Key distinction |
|---|---|
| openssl_public_decrypt | openssl_public_decrypt processes a legacy block produced by RSA private-key encryption; use openssl_verify for real signatures. |
| Related technique | Prefer openssl_sign/openssl_verify for signatures and hybrid encryption for large payloads. |
Common Beginner Mistakes
| Mistake | Correct approach |
|---|---|
| Confusing this operation with a neighboring cryptographic or security mechanism | Prefer openssl_sign/openssl_verify for signatures and hybrid encryption for large payloads. |
| Ignoring a security prerequisite or failure case | RSA block operations have strict padding and message-size limits. Do not use private_encrypt/public_decrypt as a replacement for standard signature APIs. |
Key Takeaways
- openssl_public_decrypt processes a legacy block produced by RSA private-key encryption; use openssl_verify for real signatures.
- RSA block operations have strict padding and message-size limits. Do not use private_encrypt/public_decrypt as a replacement for standard signature APIs.
- Prefer openssl_sign/openssl_verify for signatures and hybrid encryption for large payloads.
Apply this behavior to a real application only after confirming the required extension, configuration and failure handling on the deployment runtime.