doc: clarify raw RSA migration

RSA_private_encrypt() and RSA_public_decrypt() support both PKCS#1 v1.5
and no padding, but the migration guide currently describes their EVP
replacements as using no padding only.

Document direct mappings to EVP_PKEY_sign() and
EVP_PKEY_verify_recover(), and explain that compatibility requires no
signature digest and the same legacy padding mode, RSA_PKCS1_PADDING or
RSA_NO_PADDING.

Reviewed-by: Jakub Zelenka <jakub.zelenka@openssl.foundation>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Mon Jul 27 07:54:00 2026
(Merged from https://github.com/openssl/openssl/pull/31996)

diff --git a/doc/man7/ossl-guide-migration.pod b/doc/man7/ossl-guide-migration.pod
index bf5c57d617ae919319cf2434cbda9135ca599807..55a50a43765a1d5dbe4afb257a8de0e7202983b5 100644 (file)
--- a/doc/man7/ossl-guide-migration.pod
+++ b/doc/man7/ossl-guide-migration.pod
@@ -2428,8 +2428,11 @@ See L</Deprecated low-level encryption functions>
 
 RSA_private_encrypt(), RSA_public_decrypt()
 
-This is equivalent to doing sign and verify recover operations (with a padding
-mode of none). See L</Deprecated low-level signing functions>.
+These are equivalent to L<EVP_PKEY_sign(3)> and
+L<EVP_PKEY_verify_recover(3)> operations, respectively. For compatibility
+with the legacy low-level operations, do not configure a signature digest and
+use the same padding mode as the legacy call (B<RSA_PKCS1_PADDING> or
+B<RSA_NO_PADDING>). See L</Deprecated low-level signing functions>.
 
 =item *