openssl_public_encrypt encrypts a short byte string using an RSA public key with an explicitly chosen padding mode.
The examples explain the data format, expected results and the difference between this API and nearby cryptographic operations.
What It Does
The operation is intended for: openssl_public_encrypt encrypts a short byte string using an RSA public key with an explicitly chosen padding mode.
The OpenSSL extension must be enabled.
Syntax and Return Value
openssl_public_encrypt(string $data, $encrypted_data, $public_key, int $padding = ...): bool| Parameter | Purpose |
|---|---|
| $data (string) | The input data bytes. Use the exact original bytes when verifying. |
| $encrypted_data (mixed) | Use the PHP signature above to determine the exact expected input type; validate untrusted inputs before calling. |
| $public_key (mixed) | A public key that belongs to the intended, verified peer. |
| $padding (int) | Use the PHP signature above to determine the exact expected input type; validate untrusted inputs before calling. |
The declared return type is shown above. Errors can include false results or exceptions depending on this API: RSA block operations have strict padding and message-size limits. Do not use private_encrypt/public_decrypt as a replacement for standard signature APIs.
Example 1: Basic Operation
This is low-level RSA on short messages, not a complete secure encryption or signature protocol.
<?php
$private = openssl_pkey_new(['private_key_type' => OPENSSL_KEYTYPE_RSA, 'private_key_bits' => 2048]);
if ($private === false) { throw new RuntimeException('Key generation failed'); }
$details = openssl_pkey_get_details($private);
$public = $details['key'];
$csr = openssl_csr_new(['commonName' => 'test.example'], $private, ['digest_alg' => 'sha256']);
if ($csr === false) { throw new RuntimeException('CSR creation failed'); }
$cert = openssl_csr_sign($csr, null, $private, 1, ['digest_alg' => 'sha256']);
if ($cert === false) { throw new RuntimeException('Certificate creation failed'); }
openssl_public_encrypt("annual report", $encoded, $public, OPENSSL_PKCS1_OAEP_PADDING);
echo strlen($encoded);Example 2: A Different Use Case
This is low-level RSA on short messages, not a complete secure encryption or signature protocol.
<?php
// Check the alternative case.
$private = openssl_pkey_new(['private_key_type' => OPENSSL_KEYTYPE_RSA, 'private_key_bits' => 2048]);
if ($private === false) { throw new RuntimeException('Key generation failed'); }
$details = openssl_pkey_get_details($private);
$public = $details['key'];
$csr = openssl_csr_new(['commonName' => 'test.example'], $private, ['digest_alg' => 'sha256']);
if ($csr === false) { throw new RuntimeException('CSR creation failed'); }
$cert = openssl_csr_sign($csr, null, $private, 1, ['digest_alg' => 'sha256']);
if ($cert === false) { throw new RuntimeException('Certificate creation failed'); }
openssl_public_encrypt("invoice 42", $encoded, $public, OPENSSL_PKCS1_OAEP_PADDING);
echo strlen($encoded);Practical Example: Checking the Result
This is low-level RSA on short messages, not a complete secure encryption or signature protocol.
<?php
// Verify the expected behavior before using results.
$private = openssl_pkey_new(['private_key_type' => OPENSSL_KEYTYPE_RSA, 'private_key_bits' => 2048]);
if ($private === false) { throw new RuntimeException('Key generation failed'); }
$details = openssl_pkey_get_details($private);
$public = $details['key'];
$csr = openssl_csr_new(['commonName' => 'test.example'], $private, ['digest_alg' => 'sha256']);
if ($csr === false) { throw new RuntimeException('CSR creation failed'); }
$cert = openssl_csr_sign($csr, null, $private, 1, ['digest_alg' => 'sha256']);
if ($cert === false) { throw new RuntimeException('Certificate creation failed'); }
openssl_public_encrypt("signed event", $encoded, $public, OPENSSL_PKCS1_OAEP_PADDING);
echo strlen($encoded);Important Behavior and Edge Cases
RSA block operations have strict padding and message-size limits. Do not use private_encrypt/public_decrypt as a replacement for standard signature APIs.
RSA block operations have strict padding and message-size limits. Do not use private_encrypt/public_decrypt as a replacement for standard signature APIs.
Comparison with Related Functions
| Approach | Key distinction |
|---|---|
| openssl_public_encrypt | openssl_public_encrypt encrypts a short byte string using an RSA public key with an explicitly chosen padding mode. |
| Related technique | Prefer openssl_sign/openssl_verify for signatures and hybrid encryption for large payloads. |
Common Beginner Mistakes
| Mistake | Correct approach |
|---|---|
| Confusing this operation with a neighboring cryptographic or security mechanism | Prefer openssl_sign/openssl_verify for signatures and hybrid encryption for large payloads. |
| Ignoring a security prerequisite or failure case | RSA block operations have strict padding and message-size limits. Do not use private_encrypt/public_decrypt as a replacement for standard signature APIs. |
Key Takeaways
- openssl_public_encrypt encrypts a short byte string using an RSA public key with an explicitly chosen padding mode.
- RSA block operations have strict padding and message-size limits. Do not use private_encrypt/public_decrypt as a replacement for standard signature APIs.
- Prefer openssl_sign/openssl_verify for signatures and hybrid encryption for large payloads.
Apply this behavior to a real application only after confirming the required extension, configuration and failure handling on the deployment runtime.