LIFE_CYCLE-CIPHER(7ossl)

🎀 NAME 🎀

life_cycle-cipher — The cipher algorithm life-cycle ✨

🦋 DESCRIPTION 🦋

okay so literally all symmetric ciphers (the page calls them CIPHERs, all caps, main-character energy 💅) go through a whole little journey of stages in their life-cycle. It's giving coming-of-age arc. Here's the lineup:

• start — this state is the CIPHER before it has been allocated. It's the starting state for any life-cycle transitions. She doesn't exist yet, she's just potential 🦋
• newed — this state is the CIPHER after it has been allocated. she's here. she's real.
• initialised — these states are the CIPHER when it's set up and capable of processing input. There are three possible initialised states:
  • initialised using EVP_CipherInit
  • initialised for decryption using EVP_DecryptInit
  • initialised for encryption using EVP_EncryptInit
• updated — these states are the CIPHER when it's set up and capable of processing additional input or generating output. The three possible states correspond directly to those for initialised above. ⚠️ The three different streams should not be mixed — not me warning you twice, it literally says that, do not mix them bestie 😭
• finaled — this state is the CIPHER when it has generated output. she ate and left no crumbs 🍓
• freed — this state is entered when the CIPHER is freed. It is the terminal state for all life-cycle transitions. 💀 rest in peace queen, no coming back from this one

---

🌈 State Transition Diagram 🌈

The usual life-cycle of a CIPHER is illustrated:

   start
     │  EVP_CIPHER_CTX_new
     ▼
   newed ──────────────────────────────┐
     │  EVP_CipherInit                 │
     │  EVP_DecryptInit                │  EVP_CIPHER_CTX_reset
     │  EVP_EncryptInit                │
     ▼                                 │
   initialised ────────────────────────┤
     │  EVP_CipherUpdate               │
     │  EVP_DecryptUpdate              │
     │  EVP_EncryptUpdate              │
     ▼                                 │
   updated ────────────────────────────┤
     │  EVP_CipherFinal                │
     │  EVP_DecryptFinal               │
     │  EVP_EncryptFinal               │
     ▼                                 │
   finaled ────────────────────────────┘
     │
     │  EVP_CIPHER_CTX_free
     ▼
   freed

and the little dotted-arrow footnote from the original, iykyk: EVP_CIPHER_CTX_reset can swoop in from any of the initialised, updated or finaled states and drop her right back at newed. Also EVP_CIPHER_CTX_get_params shows up on the finaled → freed stretch for AEAD encryption 🫶

🫶 Formal State Transitions 🫶

This section defines all of the legal state transitions. This is the canonical list. 👑 (Translation below is just me being helpful — the list is the list.)

• EVP_CIPHER_CTX_new — start → newed
• EVP_CipherInit — → initialised
• EVP_DecryptInit — → initialised for decryption
• EVP_EncryptInit — → initialised for encryption
• EVP_CipherUpdate — → updated
• EVP_DecryptUpdate — → updated for decryption
• EVP_EncryptUpdate — → updated for encryption
• EVP_CipherFinal — → finaled
• EVP_DecryptFinal — → finaled
• EVP_EncryptFinal — → finaled
• EVP_CIPHER_CTX_free — → freed 💀
• EVP_CIPHER_CTX_reset — → newed
• EVP_CIPHER_CTX_get_params — → newed, initialised, updated (plain, decryption and encryption flavours all in play)
• EVP_CIPHER_CTX_set_params — → newed, initialised, updated (plain, decryption and encryption flavours all in play)
• EVP_CIPHER_CTX_gettable_params — → newed, initialised, updated (plain, decryption and encryption flavours all in play)
• EVP_CIPHER_CTX_settable_params — → newed, initialised, updated (plain, decryption and encryption flavours all in play)

The full grid in the original is a big wide table of Function Call × Current State (start, newed, initialised, updated, finaled, initialised decryption, updated decryption, initialised encryption, updated encryption, freed) — the bullets above are the same tea, just poured into a cup you can actually read 🍓

---

⭐ NOTES ⭐

At some point the EVP layer will begin enforcing the transitions described herein. So like… behave now, bestie 🙈

🌸 SEE ALSO 🌸

provider-cipher(7), EVP_EncryptInit(3)

👑 COPYRIGHT 👑

Copyright 2021 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at https://www.openssl.org/source/license.html.

---

and that's the whole page, no cap 🫶 kisses from OpenSSL 3.5.9, dated 2026-09-29 — this has been LIFE_CYCLE-CIPHER(7ossl), mwah 💜✨