LIFE_CYCLE-PKEY(7ossl)
💖 NAME
life_cycle-pkey — the PKEY algorithm life-cycle. This is the OpenSSL manual page, section 7ossl, and it's literally all about how a PKEY object moves through its stages. 🫶
✨ DESCRIPTION ✨
Okay so bestie, all public keys (PKEYs) go through a number of stages in their life-cycle, and the way that works is iconic. Here's the full rundown, no cap:
- start — this state is the PKEY before it has been allocated. It's the starting state for any life-cycle transitions. 💫
- newed — this state is the PKEY after it has been allocated. Fresh out the box, basically.
- decapsulate — this state is the PKEY when it's ready to perform a private key decapsulation operation. 🔐
- decrypt — this state is the PKEY when it's ready to decrypt some ciphertext. Secret message tea.
- derive — this state is the PKEY when it's ready to derive a shared secret. 🤝
- digest sign — this state is the PKEY when it's ready to perform a private key signature operation. Signing off, but cryptographically.
- encapsulate — this state is the PKEY when it's ready to perform a public key encapsulation operation. ✨
- encrypt — this state is the PKEY when it's ready to encrypt some plaintext. Lock it up.
- key generation — this state is the PKEY when it's ready to generate a new public/private key. New key, who dis? 👑
- parameter generation — this state is the PKEY when it's ready to generate key parameters. The lore before the key.
- verify — this state is the PKEY when it's ready to verify a public key signature. Vibe check, but for signatures. ✅
- verify recover — this state is the PKEY when it's ready to recover a public key signature data. Detective mode. 🔍
- freed — this state is entered when the PKEY is freed. It's the terminal state for all life-cycle transitions. RIP, PKEY. 💀
🌈 State Transition Diagram 🌈
The usual life-cycle of a PKEY object is illustrated here in all its wide-terminal glory. Scroll sideways if your terminal is being extra:
+-------------+
| |
| start |
| |
EVP_PKEY_derive +-------------+
+-------------+ EVP_PKEY_derive_set_peer |
+-------------+
| |----------------------------+ |
+----------------------------| |
| derive | | |
| EVP_PKEY_verify | verify |
| |<---------------------------+ |
+--------------------------->| |
+-------------+ |
+-------------+
^ |
^
| EVP_PKEY_derive_init |
EVP_PKEY_verify_init |
+---------------------------------------+ |
+---------------------------------------+
| | |
+-------------+ | | |
+-------------+
| |----------------------------+ | | |
+----------------------------| |
| digest sign | EVP_PKEY_sign | | | |
| EVP_PKEY_verify_recover | verify |
| |<---------------------------+ | | |
+--------------------------->| recover |
+-------------+ | | |
+-------------+
^ | | |
^
| EVP_PKEY_sign_init | | |
EVP_PKEY_verify_recover_init |
+---------------------------------+ | | |
+---------------------------------+
| | | | |
+-------------+ | | | | |
+-------------+
| |----------------------------+ | | | | |
+----------------------------| |
| decapsulate | EVP_PKEY_decapsulate | | | | | |
| EVP_PKEY_decrypt | decrypt |
| |<---------------------------+ | | v | |
+--------------------------->| |
+-------------+ | +-------------+ |
+-------------+
^ +---| |---+
^
| EVP_PKEY_decapsulate_init | |
EVP_PKEY_decrypt_init |
+-------------------------------------| newed
|-------------------------------------+
| |
+---| |---+
+-------------+ | +-------------+ |
+-------------+
| |----------------------------+ | | | |
+----------------------------| |
| encapsulate | EVP_PKEY_encapsulate | | | | |
| EVP_PKEY_encrypt | encrypt |
| |<---------------------------+ | | | |
+--------------------------->| |
+-------------+ | | | |
+-------------+
^ | | | |
^
| EVP_PKEY_encapsulate_init | | | |
EVP_PKEY_encrypt_init |
+---------------------------------+ | |
+---------------------------------+
| |
+---------------------------------------+
+---------------------------------------+
| EVP_PKEY_paramgen_init
EVP_PKEY_keygen_init |
v
v
+-------------+
+-------------+
| |----------------------------+
+----------------------------| |
| parameter | |
| | key |
| generation |<---------------------------+
+--------------------------->| generation |
+-------------+ EVP_PKEY_paramgen
EVP_PKEY_keygen +-------------+
EVP_PKEY_gen
EVP_PKEY_gen
+ - - - - - +
+-----------+
' ' EVP_PKEY_CTX_free |
|
' any state '------------------->|
freed |
' ' |
|
+ - - - - - +
+-----------+🎀 Formal State Transitions 🎀
OK bestie, this is the receipts section. Everything below is the canonical list of every legal glow-up a PKEY can go through — no improvising, no vibes-based transitions, this is it. The table's got Function Call down one side and Current State across the top, and the cells are where you end up. She's giving spreadsheet realness, and yes, the wrapping is cursed. Not my fault, that's just how she printed. 💅
Function Call
----------------------------------------------------------------------
Current State
----------------------------------------------------------------------
start newed digest verify
verify encrypt decrypt derive encapsulate
decapsulate parameter key freed
sign
recover
generation generation
EVP_PKEY_CTX_new newed
EVP_PKEY_CTX_new_id newed
EVP_PKEY_CTX_new_from_name newed
EVP_PKEY_CTX_new_from_pkey newed
EVP_PKEY_sign_init digest digest digest
digest digest digest digest digest digest
digest digest
sign sign sign
sign sign sign sign sign sign
sign sign
EVP_PKEY_sign digest
sign
EVP_PKEY_verify_init verify verify verify
verify verify verify verify verify verify
verify verify
EVP_PKEY_verify verify
EVP_PKEY_verify_recover_init verify verify verify
verify verify verify verify verify verify
verify verify
recover recover recover
recover recover recover recover recover recover
recover recover
EVP_PKEY_verify_recover
verify
recover
EVP_PKEY_encrypt_init encrypt encrypt encrypt
encrypt encrypt encrypt encrypt encrypt encrypt
encrypt encrypt
EVP_PKEY_encrypt
encrypt
EVP_PKEY_decrypt_init decrypt decrypt decrypt
decrypt decrypt decrypt decrypt decrypt decrypt
decrypt decrypt
EVP_PKEY_decrypt
decrypt
EVP_PKEY_derive_init derive derive derive
derive derive derive derive derive derive
derive derive
EVP_PKEY_derive_set_peer
derive
EVP_PKEY_derive
derive
EVP_PKEY_encapsulate_init encapsulate encapsulate
encapsulate encapsulate encapsulate encapsulate encapsulate
encapsulate encapsulate encapsulate encapsulate
EVP_PKEY_encapsulate
encapsulate
EVP_PKEY_decapsulate_init decapsulate decapsulate
decapsulate decapsulate decapsulate decapsulate decapsulate
decapsulate decapsulate decapsulate decapsulate
EVP_PKEY_decapsulate
decapsulate
EVP_PKEY_paramgen_init parameter parameter
parameter parameter parameter parameter parameter
parameter parameter parameter parameter
generation generation
generation generation generation generation generation
generation generation generation generation
EVP_PKEY_paramgen
parameter
generation
EVP_PKEY_keygen_init key key key
key key key key key key
key key
generation generation
generation generation generation generation generation
generation generation generation generation
EVP_PKEY_keygen
key
generation
EVP_PKEY_gen
parameter key
generation
generation
EVP_PKEY_CTX_get_params newed digest verify
verify encrypt decrypt derive encapsulate
decapsulate parameter key
sign
recover
generation generation
EVP_PKEY_CTX_set_params newed digest verify
verify encrypt decrypt derive encapsulate
decapsulate parameter key
sign
recover
generation generation
EVP_PKEY_CTX_gettable_params newed digest verify
verify encrypt decrypt derive encapsulate
decapsulate parameter key
sign
recover
generation generation
EVP_PKEY_CTX_settable_params newed digest verify
verify encrypt decrypt derive encapsulate
decapsulate parameter key
sign
recover
generation generation
EVP_PKEY_CTX_free freed freed freed freed
freed freed freed freed freed freed
freed freedThe tea on this table, iykyk ☕:
- All four constructors —
EVP_PKEY_CTX_new,EVP_PKEY_CTX_new_id,EVP_PKEY_CTX_new_from_name,EVP_PKEY_CTX_new_from_pkey— drop you straight intonewed. Every single time. Iconic, consistent, no notes. ✨ - The
*_initgirlies each park you in their own little lane:EVP_PKEY_sign_initgives youdigestthensign,EVP_PKEY_verify_initgives youverify,EVP_PKEY_verify_recover_initgives yourecover,EVP_PKEY_encrypt_initgives youencrypt,EVP_PKEY_decrypt_initgives youdecrypt,EVP_PKEY_derive_initgives youderive,EVP_PKEY_encapsulate_initgives youencapsulate,EVP_PKEY_decapsulate_initgives youdecapsulate. Main character energy, each in her own lane 🦋 EVP_PKEY_paramgen_initandEVP_PKEY_paramgentake you toparameter generation.EVP_PKEY_keygen_initandEVP_PKEY_keygentake you tokey generation. Two different generations, don't get it twisted 🫶EVP_PKEY_genis the multitasker fr fr — she can land you inparameter generationorkey generationdepending on where you're at.EVP_PKEY_CTX_get_params,EVP_PKEY_CTX_set_params,EVP_PKEY_CTX_gettable_params, andEVP_PKEY_CTX_settable_paramsare the social butterflies — they're listed as valid fromnewed,digest,verify,encrypt,decrypt,derive,encapsulate,decapsulate,parameter,key,sign,recover, and bothgenerationstates. Everyone's invited to that party 💖- And
EVP_PKEY_CTX_free? She's the closer.freedfrom every state on the board, no fear, no hesitation. Respect. 💀
📝 NOTES
So like — at some point the EVP layer is gonna start actually enforcing all these transitions described up in here. No cap. Right now it's giving "guidelines," later it's giving "rules." Be so serious about it. 👀
👀 SEE ALSO
Go read these, bestie, they're the whole friend group:
EVP_PKEY_new(3)EVP_PKEY_decapsulate(3)EVP_PKEY_decrypt(3)EVP_PKEY_encapsulate(3)EVP_PKEY_encrypt(3)EVP_PKEY_derive(3)EVP_PKEY_keygen(3)EVP_PKEY_sign(3)EVP_PKEY_verify(3)EVP_PKEY_verify_recover(3)
🕰️ HISTORY
The provider PKEY interface? Born in OpenSSL 3.0. A whole era. 🌈
©️ COPYRIGHT
Copyright 2021-2022 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.
Okay that's the whole page, we did it 💜 this was LIFE_CYCLE-PKEY(7ossl) from the 3.5.6 drop, dated 2026-04-07 — go forth and transition legally, my love. 🎀✨🦋
📦 where this page comes from
- freebsd 15.1: base 15.1
- 💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash-1017 on : a language model's rewrite of the original, under its terms