Encap/decap in pkeyutl - documentation

doc/man1/openssl-pkeyutl.pod.in

@@ -13,6 +13,7 @@ B<openssl> B<pkeyutl>
 [B<-rawin>]
 [B<-digest> I<algorithm>]
 [B<-out> I<file>]
+[B<-secret> I<file>]
 [B<-sigfile> I<file>]
 [B<-inkey> I<filename>|I<uri>]
 [B<-keyform> B<DER>|B<PEM>|B<P12>|B<ENGINE>]
@@ -28,8 +29,11 @@ B<openssl> B<pkeyutl>
 [B<-encrypt>]
 [B<-decrypt>]
 [B<-derive>]
+[B<-encap>]
+[B<-decap>]
 [B<-kdf> I<algorithm>]
 [B<-kdflen> I<length>]
+[B<-kemop> I<operation>]
 [B<-pkeyopt> I<opt>:I<value>]
 [B<-pkeyopt_passin> I<opt>[:I<passarg>]]
 [B<-hexdump>]
@@ -79,6 +83,10 @@ then the B<-rawin> option must be also specified.
 Specifies the output filename to write to or standard output by
 default.
 
+=item B<-secret> I<filename>
+
+Specifies the output filename to write the secret to on I<-encap>.
+
 =item B<-sigfile> I<file>
 
 Signature file, required for B<-verify> operations only
@@ -147,6 +155,19 @@ Decrypt the input data using a private key.
 
 Derive a shared secret using the peer key.
 
+=item B<-encap>
+
+Encapsulate the secret using a public key. I<-secret> is required.
+
+=item B<-decap>
+
+Decapsulate the secret using a private key.
+
+=item B<-kemop> I<operation>
+
+KEM operation, specific for the key algorithm. See L<EVP_PKEY_CTX_set_kem_op(3)>
+and algorithm-specific KEM documentation.
+
 =item B<-kdf> I<algorithm>
 
 Use key derivation function I<algorithm>.  The supported algorithms are