EVP_CIPHER_CTX_INIT(3)

💖 EVP_CIPHER_CTX_INIT(3) 💖

okay so bestie, gather round — this is a page about three obsolete EVP cipher functions from libcrypto, and honestly the whole thing is giving "found in grandma's attic" energy. It's part of the Library Functions Manual, and yes, we're going to read it together. 🫶

---

✨ NAME ✨

EVP_CIPHER_CTX_init, EVP_CIPHER_CTX_cleanup, EVP_Cipher — the obsolete EVP cipher functions. like, these are the legacy girlies. 👑

---

🌸 SYNOPSIS 🌸

First things first, you gotta pull in the header, and this all lives in the libcrypto library:

#include <openssl/evp.h>

int
EVP_CIPHER_CTX_init(EVP_CIPHER_CTX *ctx);

int
EVP_CIPHER_CTX_cleanup(EVP_CIPHER_CTX *ctx);

int
EVP_Cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
    const unsigned char *in, unsigned int in_len);

---

🦋 DESCRIPTION 🦋

💅 EVP_CIPHER_CTX_init()

So this one is deprecated, okay? periodt. Back in the day — before EVP_CIPHER_CTX was made opaque — you could use it to clear a cipher context that was sitting on the stack. but the way that era is over.

• Calling it on a cipher context that was just returned from EVP_CIPHER_CTX_new(3)? literally has no effect. nothing. zero. 💀
• Calling it on a cipher context that was already used? may leak memory with older versions of the library. not the vibe. 😭

Instead, bestie, use EVP_CIPHER_CTX_reset(3) or EVP_CIPHER_CTX_free(3). those are the main characters now. 👑

🎀 EVP_CIPHER_CTX_cleanup()

This is a deprecated alias for EVP_CIPHER_CTX_reset(3). It clears all information from ctx and frees all allocated memory associated with it — except the ctx object itself, which stays. she's still there, just emotionally reset. ✨

🔥 EVP_Cipher()

okay this function is highkey a jumpscare: it exposes implementation details of EVP_CipherUpdate(3) and EVP_CipherFinal(3) that should never have become part of the public API. not me exposing my internals on main. 🙈

Here's how the behaviour goes down:

• If the flag EVP_CIPH_FLAG_CUSTOM_CIPHER is set for the cipher used by ctx, behaviour depends on in:
  • If that argument is NULL and in_len is 0, behaviour is similar to EVP_CipherFinal(3).
  • If in_len is not 0, behaviour is undefined. 🚨 (yes, undefined. we don't do that.)
  • If in is not NULL, behaviour is similar to EVP_CipherUpdate(3).
  • In both cases, the exceptions to the similarity are that arguments and return values differ. iykyk.
• If the flag EVP_CIPH_FLAG_CUSTOM_CIPHER is not set for the cipher used by ctx, it encrypts or decrypts aligned blocks of data whose lengths match the cipher block size. Requirements:
  • the previous encryption or decryption operation using the same ctx, if there was any, must have ended exactly on a block boundary, and
  • in_len must be an integer multiple of the cipher block size.

⚠️ If either of these conditions is violated, EVP_Cipher() silently produces incorrect results. silently!! incorrect!! results!! 💀💀💀

For that reason, using EVP_CipherUpdate(3) instead is strongly recommended. She can safely handle partial blocks, and even if in_len actually is a multiple of the cipher block size for all calls, the overhead incurred by using EVP_CipherUpdate(3) is minimal. so like… just use her. slay. 🌈

---

⭐ RETURN VALUES ⭐

• EVP_CIPHER_CTX_init() — always returns 1. every time. no notes. 🎀
• EVP_CIPHER_CTX_cleanup() — returns 1 for success or 0 for failure.
• EVP_Cipher():
  • With EVP_CIPH_FLAG_CUSTOM_CIPHER: returns the number of bytes written to out for success, or -1 for failure.
  • Without EVP_CIPH_FLAG_CUSTOM_CIPHER: returns 1 for success or 0 for failure.

---

🧚 SEE ALSO 🧚

• evp(3)
• EVP_EncryptInit(3)

---

👑 HISTORY 👑

• EVP_Cipher() first appeared in SSLeay 0.6.5. ⭐
• EVP_CIPHER_CTX_cleanup() first appeared in SSLeay 0.8.0. 🌸
• EVP_CIPHER_CTX_init() first appeared in SSLeay 0.9.0. 🦋
• All these functions have been available since OpenBSD 2.4. iconic longevity fr fr.

---

💀 CAVEATS 💀

Checking the return value of EVP_Cipher() requires unusual caution: zero signals success if EVP_CIPH_FLAG_CUSTOM_CIPHER is set, or failure otherwise. yes bestie, 0 means two completely different things depending on a flag. that's the trap. do not get got. 🚨

---

mwah, that's the whole page — brought to you by the Debian build of this manual, dated June 8, 2025. go forth, use EVP_CIPHER_CTX_reset(3), and stay hydrated 💜✨