LIFE_CYCLE-MAC(7ossl)

📦
version 3.5.9 · 8 versions
, in alpine 3.23, alpine 3.24

💅 LIFE_CYCLE-MAC(7ossl) — the MAC algorithm life-cycle, explained

okay bestie, so this page is from the OpenSSL manual set (the 7ossl one, yes), and it's basically the ✨ character arc ✨ of a MAC. Not the makeup kind — we're talking message authentication codes here. Every single MAC goes through a whole little journey of stages, and this is the map. 🗺️

🌸 DESCRIPTION 🌸

Every message authentication code (a MAC, for short) lives through a bunch of stages in its life-cycle. Let's meet the cast:

  • start — the MAC before it's been allocated. Like, it doesn't exist yet. This is the starting state for any life-cycle transitions. 💫
  • newed — the MAC right after it's been allocated. It exists now! Baby's first state.
  • initialised — the MAC is all set up and capable of processing input. Ready, set… 🎀
  • updated — it's set up and capable of processing additional input or generating output. It's in the zone.
  • finaled — it has generated output. It did the thing! 👑
  • freed — the MAC is freed. This is the terminal state for all life-cycle transitions. RIP little guy, we hardly knew ye 💀

🦋 State Transition Diagram 🦋

The usual life-cycle of a MAC, pictured:

                        +-------------------+
                        |       start       |
                        +-------------------+
                          |
                          | EVP_MAC_CTX_new
                          v
                        +-------------------+
                        |       newed       |
                        +-------------------+
                          |
                          | EVP_MAC_init
                          v
                        +-------------------+
                     +> |    initialised    | <+
                     |  +-------------------+  |
                     |    |                    |
                     |    | EVP_MAC_update     | EVP_MAC_init
                     |    v                    |
        EVP_MAC_init |  +-------------------+  |
                     |  |      updated      | -+
                     |  +-------------------+
                     |    |               |
                     |    | EVP_MAC_final | EVP_MAC_finalXOF
                     |    v               v
                     |  +-------------------+
                     +- |      finaled      |
                        +-------------------+
                          |
                          | EVP_MAC_CTX_free
                          v
                        +-------------------+
                        |       freed       |
                        +-------------------+

Look at those loops, it's giving main character energy tbh 🔥

🧚 Formal State Transitions 🧚

This section defines all of the legal state transitions. This right here is the canonical list — no vibes-based guessing, this is the source of truth. The states are start, newed, initialised, updated, finaled, and freed, so here's each function call and where it takes you:

  • EVP_MAC_CTX_new — start → newed
  • EVP_MAC_init — newed, initialised, updated, or finaled → initialised
  • EVP_MAC_update — initialised or updated → updated
  • EVP_MAC_final — updated → finaled
  • EVP_MAC_finalXOF — updated → finaled
  • EVP_MAC_CTX_free — start, newed, initialised, updated, or finaled → freed
  • EVP_MAC_CTX_get_params — allowed from newed, initialised, or updated
  • EVP_MAC_CTX_set_params — allowed from newed, initialised, or updated
  • EVP_MAC_CTX_gettable_params — allowed from newed, initialised, or updated
  • EVP_MAC_CTX_settable_params — allowed from newed, initialised, or updated

(and yeah, start isn't listed in that original table's column header row for the very first entry in a super obvious way, but EVP_MAC_CTX_new is the thing that moves you out of start. iykyk 🫶)

⭐ NOTES ⭐

Lowkey important: at some point the EVP layer will begin enforcing the transitions described herein. So don't be out here doing illegal transitions, bestie, they're gonna start checking. 🚨

fr fr, treat the state machine as law, not a suggestion.

🌈 SEE ALSO 🌈

🎀 HISTORY 🎀

The provider MAC interface was introduced in OpenSSL 3.0. So it's not even that old, she's fresh. ✨

Copyright 2021 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

okay that's the whole page, and yes you read it right: this was OpenSSL 3.5.9, dated 2026-09-29, and the manual page is LIFE_CYCLE-MAC(7ossl). slay, go forth and MAC responsibly 💅💖🦋

📦 where this page comes from