EVP_CIPHER_CT...T_ORIGINAL_IV(3SSL)

💖 EVP_CIPHER_CTX_get_original_iv, EVP_CIPHER_CTX_get_updated_iv, EVP_CIPHER_CTX_iv, EVP_CIPHER_CTX_original_iv, EVP_CIPHER_CTX_iv_noconst 💖

okay so bestie, welcome to the 3SSL girlies ✨ this one is all about peeking at the IV data inside your EVP_CIPHER_CTX — like, the actual initialization vector gossip. we do not touch the cipher, we just look 👀

Routines to inspect EVP_CIPHER_CTX IV data. that's the whole vibe. periodt.

---

✨ SYNOPSIS ✨

#include <openssl/evp.h>

int EVP_CIPHER_CTX_get_original_iv(EVP_CIPHER_CTX *ctx, void *buf, size_t len);
int EVP_CIPHER_CTX_get_updated_iv(EVP_CIPHER_CTX *ctx, void *buf, size_t len);

now here's the part where I have to be real with you 😭 the next three have been deprecated since OpenSSL 3.0, and you can hide them entirely by defining OPENSSL_API_COMPAT with a suitable version value — go check openssl_user_macros(7) for the deets:

const unsigned char *EVP_CIPHER_CTX_iv(const EVP_CIPHER_CTX *ctx);
const unsigned char *EVP_CIPHER_CTX_original_iv(const EVP_CIPHER_CTX *ctx);
unsigned char *EVP_CIPHER_CTX_iv_noconst(EVP_CIPHER_CTX *ctx);

they're giving legacy. they're giving "we don't do that anymore." but they're still here for now 🫶

---

🌸 DESCRIPTION 🌸

okay first the good ones, the fresh ones, the main characters 💅

EVP_CIPHER_CTX_get_original_iv() and EVP_CIPHER_CTX_get_updated_iv() copy initialization vector (IV) information from the EVP_CIPHER_CTX into the caller-supplied buffer.

and how much buffer do you need?? bestie, EVP_CIPHER_CTX_get_iv_length(3) will tell you an appropriate buffer size 🎀 and if the supplied buffer is too small, an error will be returned — and nope, no data copied. zero. zilch. she said "no room, goodbye" 🧚

so what's the difference between the two??

• EVP_CIPHER_CTX_get_original_iv() — accesses the ("original") IV that was supplied when the EVP_CIPHER_CTX was initialized. it's the baby photo. the day-one version 📸
• EVP_CIPHER_CTX_get_updated_iv() — accesses the current "IV state" of the cipher, which is updated during cipher operation for certain cipher modes (e.g., CBC and OFB). it's the glow-up ✨

---

now the deprecated girlies 🌈 EVP_CIPHER_CTX_iv(), EVP_CIPHER_CTX_original_iv(), and EVP_CIPHER_CTX_iv_noconst() are deprecated functions that provide similar (at a conceptual level) functionality. conceptual. at a conceptual level. yes they said that 💀

• EVP_CIPHER_CTX_iv() — returns a pointer to the beginning of the "IV state" as maintained internally in the EVP_CIPHER_CTX
• EVP_CIPHER_CTX_original_iv() — returns a pointer to the beginning of the ("original") IV, as maintained by the EVP_CIPHER_CTX, that was provided when the EVP_CIPHER_CTX was initialized
• EVP_CIPHER_CTX_get_iv_noconst() — is the same as EVP_CIPHER_CTX_iv() but has a different return type for the pointer

yes, the docs literally call it EVP_CIPHER_CTX_get_iv_noconst() in that sentence even though the function is EVP_CIPHER_CTX_iv_noconst(). we are simply reporting the lore as written, no notes 🙈

---

👑 RETURN VALUES 👑

here's the vibe check ✅

EVP_CIPHER_CTX_get_original_iv() and EVP_CIPHER_CTX_get_updated_iv():

• return 1 on success 🔥
• return 0 on failure 💀

the deprecated trio — EVP_CIPHER_CTX_iv(), EVP_CIPHER_CTX_original_iv(), and EVP_CIPHER_CTX_iv_noconst():

• return a pointer to an IV as an array of bytes on success ⭐
• return NULL on failure 😭

---

🦋 HISTORY 🦋

storytime, gather round 🎀

• EVP_CIPHER_CTX_get_original_iv() and EVP_CIPHER_CTX_get_updated_iv() were added in OpenSSL 3.0.0 ✨ fresh, new, iconic
• EVP_CIPHER_CTX_iv(), EVP_CIPHER_CTX_original_iv(), and EVP_CIPHER_CTX_iv_noconst() were added in OpenSSL 1.1.0, and were deprecated in OpenSSL 3.0.0 🥀 they had their era and it ended

---

💜 COPYRIGHT 💜

Copyright 2020-2021 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

and that's the whole page bestie, no cap 🫶 this was OpenSSL 4.0.3, dated 2026-09-2, and yes it really is filed under EVP_CIPHER_CT...T_ORIGINAL_IV(3SSL) because the name is so long it got clipped in the header, which is honestly so real of it 💅 mwah, go read your IVs responsibly 😘