openssl_seal encrypts data with a symmetric session key and wraps that key for one or more public-key recipients.
The examples explain the data format, expected results and the difference between this API and nearby cryptographic operations.
What It Does
The operation is intended for: openssl_seal encrypts data with a symmetric session key and wraps that key for one or more public-key recipients.
The OpenSSL extension must be enabled.
Syntax and Return Value
openssl_seal(string $data, $sealed_data, $encrypted_keys, array $public_key, string $cipher_algo, $iv = ...): int|false| Parameter | Purpose |
|---|---|
| $data (string) | The input data bytes. Use the exact original bytes when verifying. |
| $sealed_data (mixed) | Use the PHP signature above to determine the exact expected input type; validate untrusted inputs before calling. |
| $encrypted_keys (mixed) | Use the PHP signature above to determine the exact expected input type; validate untrusted inputs before calling. |
| $public_key (array) | A public key that belongs to the intended, verified peer. |
| $cipher_algo (string) | Cipher algorithm choice; keep matched between encryption and decryption. |
| $iv (mixed) | Initialization vector or nonce whose length must match the selected cipher. |
The declared return type is shown above. Errors can include false results or exceptions depending on this API: Store the IV, cipher name and recipient encrypted session key. Envelopes must still have authenticated integrity protection.
Example 1: Basic Operation
This older envelope example lacks built-in ciphertext authentication. Prefer an authenticated encryption scheme for new systems.
<?php
$private = openssl_pkey_new(['private_key_type' => OPENSSL_KEYTYPE_RSA, 'private_key_bits' => 2048]);
if ($private === false) { throw new RuntimeException('Key generation failed'); }
$details = openssl_pkey_get_details($private);
$public = $details['key'];
$csr = openssl_csr_new(['commonName' => 'test.example'], $private, ['digest_alg' => 'sha256']);
if ($csr === false) { throw new RuntimeException('CSR creation failed'); }
$cert = openssl_csr_sign($csr, null, $private, 1, ['digest_alg' => 'sha256']);
if ($cert === false) { throw new RuntimeException('Certificate creation failed'); }
$text = "annual report";
$iv = random_bytes(openssl_cipher_iv_length("aes-256-cbc"));
$length = openssl_seal($text, $sealed, $keys, [$public], "aes-256-cbc", $iv);
var_dump($length !== false && count($keys) === 1);Example 2: A Different Use Case
This older envelope example lacks built-in ciphertext authentication. Prefer an authenticated encryption scheme for new systems.
<?php
// Check the alternative case.
$private = openssl_pkey_new(['private_key_type' => OPENSSL_KEYTYPE_RSA, 'private_key_bits' => 2048]);
if ($private === false) { throw new RuntimeException('Key generation failed'); }
$details = openssl_pkey_get_details($private);
$public = $details['key'];
$csr = openssl_csr_new(['commonName' => 'test.example'], $private, ['digest_alg' => 'sha256']);
if ($csr === false) { throw new RuntimeException('CSR creation failed'); }
$cert = openssl_csr_sign($csr, null, $private, 1, ['digest_alg' => 'sha256']);
if ($cert === false) { throw new RuntimeException('Certificate creation failed'); }
$text = "invoice 42";
$iv = random_bytes(openssl_cipher_iv_length("aes-256-cbc"));
$length = openssl_seal($text, $sealed, $keys, [$public], "aes-256-cbc", $iv);
var_dump($length !== false && count($keys) === 1);Practical Example: Checking the Result
This older envelope example lacks built-in ciphertext authentication. Prefer an authenticated encryption scheme for new systems.
<?php
// Verify the expected behavior before using results.
$private = openssl_pkey_new(['private_key_type' => OPENSSL_KEYTYPE_RSA, 'private_key_bits' => 2048]);
if ($private === false) { throw new RuntimeException('Key generation failed'); }
$details = openssl_pkey_get_details($private);
$public = $details['key'];
$csr = openssl_csr_new(['commonName' => 'test.example'], $private, ['digest_alg' => 'sha256']);
if ($csr === false) { throw new RuntimeException('CSR creation failed'); }
$cert = openssl_csr_sign($csr, null, $private, 1, ['digest_alg' => 'sha256']);
if ($cert === false) { throw new RuntimeException('Certificate creation failed'); }
$text = "signed event";
$iv = random_bytes(openssl_cipher_iv_length("aes-256-cbc"));
$length = openssl_seal($text, $sealed, $keys, [$public], "aes-256-cbc", $iv);
var_dump($length !== false && count($keys) === 1);Important Behavior and Edge Cases
Store the IV, cipher name and recipient encrypted session key. Envelopes must still have authenticated integrity protection.
Store the IV, cipher name and recipient encrypted session key. Envelopes must still have authenticated integrity protection.
Comparison with Related Functions
| Approach | Key distinction |
|---|---|
| openssl_seal | openssl_seal encrypts data with a symmetric session key and wraps that key for one or more public-key recipients. |
| Related technique | Authenticated encryption plus explicit key wrapping gives greater control than older envelope modes. |
Common Beginner Mistakes
| Mistake | Correct approach |
|---|---|
| Confusing this operation with a neighboring cryptographic or security mechanism | Authenticated encryption plus explicit key wrapping gives greater control than older envelope modes. |
| Ignoring a security prerequisite or failure case | Store the IV, cipher name and recipient encrypted session key. Envelopes must still have authenticated integrity protection. |
Key Takeaways
- openssl_seal encrypts data with a symmetric session key and wraps that key for one or more public-key recipients.
- Store the IV, cipher name and recipient encrypted session key. Envelopes must still have authenticated integrity protection.
- Authenticated encryption plus explicit key wrapping gives greater control than older envelope modes.
Apply this behavior to a real application only after confirming the required extension, configuration and failure handling on the deployment runtime.