LIFE_CYCLE-PKEY(7ossl)
🎀 life_cycle-pkey(7ossl) 🎀
okay so this is the life_cycle-pkey(7ossl) page, and we’re about to make the PKEY life-cycle lore make sense. bestie, it’s giving “public keys have eras,” and honestly? iconic.
🌸 NAME 🌸
life_cycle-pkey — The PKEY algorithm life-cycle ✨
💖 DESCRIPTION 💖
All public keys (PKEYs) go through a number of stages in their life-cycle, fr fr:
start— this is the state before the PKEY has been allocated. It’s the starting state for any life-cycle transitions. 🌱newed— this is the state after the PKEY has been allocated. 🫶decapsulate— this is the state when the PKEY is ready to perform a private key decapsulation operation. 💅decrypt— this is the state when the PKEY is ready to decrypt some ciphertext. 🔐derive— this is the state when the PKEY is ready to derive a shared secret. 🤝digest sign— this is the state when the PKEY is ready to perform a private key signature operation. ✍️encapsulate— this is the state when the PKEY is ready to perform a public key encapsulation operation. 🎁encrypt— this is the state when the PKEY is ready to encrypt some plaintext. 🔒key generation— this is the state when the PKEY is ready to generate a new public/private key. 🔑parameter generation— this is the state when the PKEY is ready to generate key parameters. 📐verify— this is the state when the PKEY is ready to verify a public key signature. ✅verify recover— this is the state when the PKEY is ready to recover a public key signature data. 🕵️freed— this state is entered when the PKEY is freed. It is the terminal state for all life-cycle transitions. 🪦
✨ State Transition Diagram ✨
The usual life-cycle of a PKEY object is illustrated, and yes it’s a whole map — stay with me:
+-------------+
| |
| start |
| |
EVP_PKEY_derive +-------------+
+-------------+ EVP_PKEY_derive_set_peer |
+-------------+
| |----------------------------+ |
+----------------------------| |
| derive | | |
| EVP_PKEY_verify | verify |
| |<---------------------------+ |
+--------------------------->| |
+-------------+ |
+-------------+
^ |
^
| EVP_PKEY_derive_init |
EVP_PKEY_verify_init |
+---------------------------------------+ |
+---------------------------------------+
| | |
+-------------+ | | |
+-------------+
| |----------------------------+ | | |
+----------------------------| |
| digest sign | EVP_PKEY_sign | | | |
| EVP_PKEY_verify_recover | verify |
| |<---------------------------+ | | |
+--------------------------->| recover |
+-------------+ | | |
+-------------+
^ | | |
^
| EVP_PKEY_sign_init | | |
EVP_PKEY_verify_recover_init |
+---------------------------------+ | | |
+---------------------------------+
| | | | |
+-------------+ | | | | |
+-------------+
| |----------------------------+ | | | | |
+----------------------------| |
| decapsulate | EVP_PKEY_decapsulate | | | | | |
| EVP_PKEY_decrypt | decrypt |
| |<---------------------------+ | | v | |
+--------------------------->| |
+-------------+ | +-------------+ |
+-------------+
^ +---| |---+
^
| EVP_PKEY_decapsulate_init | |
EVP_PKEY_decrypt_init |
+-------------------------------------| newed
|-------------------------------------+
| |
+---| |---+
+-------------+ | +-------------+ |
+-------------+
| |----------------------------+ | | | |
+----------------------------| |
| encapsulate | EVP_PKEY_encapsulate | | | | |
| EVP_PKEY_encrypt | encrypt |
| |<---------------------------+ | | | |
+--------------------------->| |
+-------------+ | | | |
+-------------+
^ | | | |
^
| EVP_PKEY_encapsulate_init | | | |
EVP_PKEY_encrypt_init |
+---------------------------------+ | |
+---------------------------------+
| |
+---------------------------------------+ |
+---------------------------------------+
| EVP_PKEY_paramgen_init
EVP_PKEY_keygen_init |
v
v
+-------------+
+-------------+
| |----------------------------+
+----------------------------| |
| parameter | |
| | key |
| generation |<---------------------------+
+--------------------------->| generation |
+-------------+ EVP_PKEY_paramgen
EVP_PKEY_keygen +-------------+
EVP_PKEY_gen
EVP_PKEY_gen
+ - - - - - +
+-----------+
' ' EVP_PKEY_CTX_free |
|
' any state '------------------->|
freed |
' ' |
|
+ - - - - - +
+-----------+✨ Formal State Transitions ✨
okay so this is the section — the receipts, the canonical list, the "no cap, these are all the legal moves" grid 💅 if you've ever sat there like "wait can I even call that from here??" — bestie, this is the vibe check for state transitions. This section defines all of the legal state transitions, and it is the canonical list. Not a suggestion, not a mood board. The list.
The left side is the function call, and the entries across the row are the state(s) you land in. Heads up: the spacing in the source is doing... a lot (it's giving abstract art 🎨), but every token below is exactly what's published — I did not touch a single one:
Function Call
----------------------------------------------------------------------
Current State
----------------------------------------------------------------------
start newed digest verify
verify encrypt decrypt derive encapsulate
decapsulate parameter key freed
sign
recover
generation generation
EVP_PKEY_CTX_new newed
EVP_PKEY_CTX_new_id newed
EVP_PKEY_CTX_new_from_name newed
EVP_PKEY_CTX_new_from_pkey newed
EVP_PKEY_sign_init digest digest digest
digest digest digest digest digest digest
digest digest
sign sign sign
sign sign sign sign sign sign
sign sign
EVP_PKEY_sign digest
sign
EVP_PKEY_verify_init verify verify verify
verify verify verify verify verify verify
verify verify
EVP_PKEY_verify verify
EVP_PKEY_verify_recover_init verify verify verify
verify verify verify verify verify verify
verify verify
recover recover recover
recover recover recover recover recover recover
recover recover
EVP_PKEY_verify_recover
verify
recover
EVP_PKEY_encrypt_init encrypt encrypt encrypt
encrypt encrypt encrypt encrypt encrypt encrypt
encrypt encrypt
EVP_PKEY_encrypt
encrypt
EVP_PKEY_decrypt_init decrypt decrypt decrypt
decrypt decrypt decrypt decrypt decrypt decrypt
decrypt decrypt
EVP_PKEY_decrypt
decrypt
EVP_PKEY_derive_init derive derive derive
derive derive derive derive derive derive
derive derive
EVP_PKEY_derive_set_peer
derive
EVP_PKEY_derive
derive
EVP_PKEY_encapsulate_init encapsulate encapsulate
encapsulate encapsulate encapsulate encapsulate encapsulate
encapsulate encapsulate encapsulate encapsulate
EVP_PKEY_encapsulate
encapsulate
EVP_PKEY_decapsulate_init decapsulate decapsulate
decapsulate decapsulate decapsulate decapsulate decapsulate
decapsulate decapsulate decapsulate decapsulate
EVP_PKEY_decapsulate
decapsulate
EVP_PKEY_paramgen_init parameter parameter
parameter parameter parameter parameter parameter
parameter parameter parameter parameter
generation generation
generation generation generation generation generation
generation generation generation generation
EVP_PKEY_paramgen
parameter
generation
EVP_PKEY_keygen_init key key key
key key key key key key
key key
generation generation
generation generation generation generation generation
generation generation generation generation
EVP_PKEY_keygen
key
generation
EVP_PKEY_gen
parameter key
generation
generation
EVP_PKEY_CTX_get_params newed digest verify
verify encrypt decrypt derive encapsulate
decapsulate parameter key
sign
recover
generation generation
EVP_PKEY_CTX_set_params newed digest verify
verify encrypt decrypt derive encapsulate
decapsulate parameter key
sign
recover
generation generation
EVP_PKEY_CTX_gettable_params newed digest verify
verify encrypt decrypt derive encapsulate
decapsulate parameter key
sign
recover
generation generation
EVP_PKEY_CTX_settable_params newed digest verify
verify encrypt decrypt derive encapsulate
decapsulate parameter key
sign
recover
generation generation
EVP_PKEY_CTX_free freed freed freed freed
freed freed freed freed freed freed
freed freed🎀 a lil highlight reel so you're not squinting
- the four constructors —
EVP_PKEY_CTX_new,EVP_PKEY_CTX_new_id,EVP_PKEY_CTX_new_from_name,EVP_PKEY_CTX_new_from_pkey— all drop you straight intonewed. simple, clean, iconic, no notes ✨ EVP_PKEY_CTX_freetakes you tofreedfrom literally every single column. she's the great equalizer 💀 every state, one exit,freedfreedfreedall the way down.EVP_PKEY_CTX_get_params,EVP_PKEY_CTX_set_params,EVP_PKEY_CTX_gettable_paramsandEVP_PKEY_CTX_settable_paramsare the social butterflies of this table 🦋 — they show up as legal fromnewed,digest,verify,encrypt,decrypt,derive,encapsulate,decapsulate,parameter,key,sign,recover,parameter generationandkey generation.EVP_PKEY_genis the multitasker bestie:parameter,key,generation,generation🫶EVP_PKEY_sign,EVP_PKEY_verify,EVP_PKEY_verify_recover,EVP_PKEY_encrypt,EVP_PKEY_decrypt,EVP_PKEY_encapsulate,EVP_PKEY_decapsulate,EVP_PKEY_paramgenandEVP_PKEY_keygenall hang out in the far-right lanes, so please actually read the grid before you @ them 🙈
📌 NOTES
so rn this table is kind of a guidelines situation 😭 — at some point the EVP layer will begin enforcing the transitions described herein. translation: do not build your entire personality on breaking these, because the enforcement era is coming. ⏳
👀 SEE ALSO
go read these, they're all interconnected, iykyk:
EVP_PKEY_new(3)EVP_PKEY_decapsulate(3)EVP_PKEY_decrypt(3)EVP_PKEY_encapsulate(3)EVP_PKEY_encrypt(3)EVP_PKEY_derive(3)EVP_PKEY_keygen(3)EVP_PKEY_sign(3)EVP_PKEY_verify(3)EVP_PKEY_verify_recover(3)
🕰️ HISTORY
The provider PKEY interface was introduced in OpenSSL 3.0. so like... she's not ancient, she's a modern queen 👑 🌸
©️ COPYRIGHT
Copyright 2021-2022 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.
okay that's the whole page bestie, you made it to the end 🏁🫶 this was LIFE_CYCLE-PKEY(7ossl), version 3.5.0, dated 2026-09-25 — go forth and transition legally, mwah 💜✨
📦 where this page comes from
- opensuse-leap 16.0: openssl-3 3.5.0-160000.11.1 · Apache-2.0
- opensuse-leap 16.0: openssl-3 3.5.0-160000.11.1 · Apache-2.0
- opensuse-leap 16.0: openssl-3 3.5.0-160000.11.1 · Apache-2.0
- opensuse-leap 16.0: openssl-3 3.5.0-160000.11.1 · Apache-2.0
- 💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash-1017 on : a language model's rewrite of the original, under its terms