Data models

Quick maps of the most-touched OpenSSL types and how they relate. These are not exhaustive class diagrams — just enough for a reader to navigate without paging through 80 KB headers.

Library context, providers, methods

classDiagram
    class OSSL_LIB_CTX {
        +Provider list
        +Namemap
        +Per-op Method stores
        +Default property
        +Per-context data slots
    }
    class OSSL_PROVIDER {
        +name
        +OSSL_DISPATCH from-provider
        +activation refcount
    }
    class OSSL_NAMEMAP {
        +bidirectional name<->id
    }
    class OSSL_METHOD_STORE {
        +per (op, name, props) cache
    }
    class OSSL_ALGORITHM {
        +names
        +property def
        +OSSL_DISPATCH
        +description
    }
    OSSL_LIB_CTX *-- OSSL_PROVIDER
    OSSL_LIB_CTX *-- OSSL_NAMEMAP
    OSSL_LIB_CTX *-- OSSL_METHOD_STORE
    OSSL_PROVIDER --> OSSL_ALGORITHM : exposes

EVP

classDiagram
    class EVP_MD {
        +OSSL_DISPATCH
        +size, block_size
        +provider
    }
    class EVP_CIPHER {
        +OSSL_DISPATCH
        +iv_len, key_len, block_size, flags
    }
    class EVP_MD_CTX {
        +EVP_MD*
        +provider state
        +PKEY_CTX (for sign)
    }
    class EVP_CIPHER_CTX {
        +EVP_CIPHER*
        +provider state
    }
    class EVP_PKEY {
        +EVP_KEYMGMT*
        +keydata
        +legacy union (RSA*, EC_KEY*, ...)
    }
    class EVP_PKEY_CTX {
        +EVP_PKEY*
        +operation (SIGN, VERIFY, DERIVE, ENCAPSULATE, DECAPSULATE, ENCRYPT, DECRYPT, KEYGEN, PARAMGEN)
        +per-op provider state
    }
    class EVP_KEYMGMT {
        +OSSL_DISPATCH
    }
    class EVP_SIGNATURE
    class EVP_KEYEXCH
    class EVP_KEM
    class EVP_ASYM_CIPHER
    EVP_MD_CTX --> EVP_MD
    EVP_CIPHER_CTX --> EVP_CIPHER
    EVP_PKEY --> EVP_KEYMGMT
    EVP_PKEY_CTX --> EVP_PKEY
    EVP_PKEY_CTX --> EVP_SIGNATURE
    EVP_PKEY_CTX --> EVP_KEYEXCH
    EVP_PKEY_CTX --> EVP_KEM
    EVP_PKEY_CTX --> EVP_ASYM_CIPHER

TLS

classDiagram
    class SSL_CTX {
        +SSL_METHOD*
        +cert chain, key
        +ciphersuites
        +cipherlist
        +session cache
        +verify settings
        +extensions hooks
    }
    class SSL {
        +SSL_CTX*
        +state machine cursor
        +rbio, wbio
        +session
        +derived keys
        +OSSL_RECORD_METHOD*
        +per-extension state
    }
    class SSL_METHOD {
        +protocol version
        +role (client/server)
        +SSL_new, SSL_clear, ...
    }
    class SSL_SESSION {
        +master secret / ticket
        +ciphersuite
        +peer cert chain
    }
    class SSL_CIPHER {
        +IANA id
        +name aliases
        +ALG_kEX, ALG_aAUTH, ALG_ENC, ALG_MAC
        +version mask
        +strength bits
    }
    class OSSL_RECORD_METHOD {
        +per-version record encrypt/decrypt
    }
    SSL_CTX --> SSL_METHOD
    SSL --> SSL_CTX
    SSL --> SSL_SESSION
    SSL_CTX --> SSL_CIPHER
    SSL --> OSSL_RECORD_METHOD

QUIC

classDiagram
    class QUIC_DOMAIN {
        +listeners
        +reactor
    }
    class QUIC_LISTENER {
        +UDP socket BIO
        +port
    }
    class QUIC_PORT {
        +DCID demuxer
    }
    class QUIC_CHANNEL {
        +TLS state
        +ackm
        +txp
        +stream map
        +flow control
        +loss detection
    }
    class QUIC_STREAM {
        +stream id
        +sstream / rstream buffers
    }
    class SSL {
        +polymorphic kind: TLS-SSL / QUIC-CONN / QUIC-STREAM / QUIC-LISTENER / QUIC-DOMAIN
    }
    QUIC_DOMAIN o-- QUIC_LISTENER
    QUIC_LISTENER --> QUIC_PORT
    QUIC_PORT *-- QUIC_CHANNEL
    QUIC_CHANNEL *-- QUIC_STREAM
    SSL ..> QUIC_DOMAIN
    SSL ..> QUIC_LISTENER
    SSL ..> QUIC_CHANNEL
    SSL ..> QUIC_STREAM

X.509

classDiagram
    class X509 {
        +tbsCertificate
        +signatureAlgorithm
        +signatureValue
        +cached EXFLAG_*
    }
    class X509_NAME {
        +RDNs
        +canonical encoding cache
    }
    class X509_EXTENSION {
        +OID
        +critical
        +value (DER)
    }
    class X509_PUBKEY {
        +AlgorithmIdentifier
        +SubjectPublicKey
        +cached EVP_PKEY
    }
    class X509_STORE {
        +trust anchors
        +CRLs
        +X509_LOOKUP backends
        +callbacks
    }
    class X509_STORE_CTX {
        +leaf
        +untrusted chain
        +X509_VERIFY_PARAM
        +verify callback
        +error state
    }
    class X509_VERIFY_PARAM {
        +flags
        +depth
        +purpose, trust
        +host, ip, email
        +policies
    }
    class X509_CRL {
        +revoked entries
        +signature
    }
    X509 o-- X509_NAME : subject, issuer
    X509 o-- X509_EXTENSION
    X509 o-- X509_PUBKEY
    X509_STORE_CTX --> X509_STORE
    X509_STORE_CTX --> X509_VERIFY_PARAM
    X509_STORE o-- X509_CRL

CMS

classDiagram
    class CMS_ContentInfo {
        +contentType (signed-data / enveloped-data / digested-data / encrypted-data / authenticated-enveloped-data / compressed-data)
        +content (one-of below)
    }
    class CMS_SignedData {
        +digest algorithms
        +EncapsulatedContentInfo
        +certificates
        +CRLs
        +SignerInfos
    }
    class CMS_EnvelopedData {
        +RecipientInfos
        +EncryptedContentInfo
        +unprotected attributes
    }
    class CMS_RecipientInfo {
        <<one-of>>
        KeyTransRecipientInfo
        KeyAgreeRecipientInfo
        KEKRecipientInfo
        PasswordRecipientInfo
        OtherRecipientInfo
    }
    class CMS_SignerInfo {
        +SignerIdentifier
        +digestAlgorithm
        +signedAttrs
        +signatureAlgorithm
        +signature
        +unsignedAttrs
    }
    CMS_ContentInfo *-- CMS_SignedData
    CMS_ContentInfo *-- CMS_EnvelopedData
    CMS_SignedData *-- CMS_SignerInfo
    CMS_EnvelopedData *-- CMS_RecipientInfo

BIO

classDiagram
    class BIO {
        +BIO_METHOD*
        +next_bio (chain link)
        +flags, retry
        +references
        +callback
    }
    class BIO_METHOD {
        +type id
        +write_ex
        +read_ex
        +ctrl
        +create / destroy
        +callback_ctrl
    }
    BIO --> BIO_METHOD
    BIO --> BIO : next_bio

Error stack

classDiagram
    class ERR_STATE {
        +ring buffer of ERR_STATE_DATA
        +marks (for ERR_set_mark / ERR_pop_to_mark)
    }
    class ERR_STATE_DATA {
        +library id
        +reason
        +file
        +line
        +function
        +data string
        +flags
    }
    ERR_STATE *-- ERR_STATE_DATA

Header map

Public header	What's in it
openssl/core.h	OSSL_DISPATCH, OSSL_ALGORITHM, OSSL_PARAM, OSSL_provider_init signature, OSSL_FUNC_* ids.
openssl/core_dispatch.h	The OSSL_OP_* and OSSL_FUNC_* numeric constants.
openssl/core_names.h (.in)	Standard parameter / property keys.
openssl/core_object.h	Object types for store loaders.
openssl/types.h	Forward declarations for every public type (X509, EVP_PKEY, SSL, …).
openssl/crypto.h (.in)	OSSL_LIB_CTX, OPENSSL_init_crypto, OPENSSL_malloc, CRYPTO_THREAD_*.
openssl/evp.h	The whole EVP API (cipher, digest, MAC, KDF, RAND, KEM, SIGNATURE, EXCHANGE, ASYM_CIPHER, KEYMGMT, PKEY).
openssl/ssl.h (.in)	SSL, SSL_CTX, SSL_METHOD, ciphersuite ids.
openssl/quic.h	QUIC method, listener, domain.
openssl/x509.h	X509, X509_NAME, X509_EXTENSION, X509_PUBKEY, X509_REQ, X509_CRL.
openssl/x509v3.h (.in)	Per-extension types and X509V3_EXT_METHOD.
openssl/cms.h	CMS_ContentInfo and operations.
openssl/cmp.h, crmf.h	CMP / CRMF.
openssl/store.h	OSSL_STORE_*.
openssl/encoder.h, decoder.h	OSSL_ENCODER, OSSL_DECODER.
openssl/bio.h (.in)	BIO API.
openssl/err.h (.in)	Error stack and ERR_LIB_* ids.
openssl/rand.h	RAND_*.
openssl/asn1.h (.in) and asn1t.h	ASN.1 type system + template DSL.
openssl/obj_mac.h	Generated NID enum.