LIFE_CYCLE-PKEY(7ossl)
🎀 NAME 🎀
life_cycle-pkey(7ossl) — the full life-cycle of the PKEY algorithm, explained like we're texting in the group chat 💅✨
🌸 DESCRIPTION 🌸
okay so bestie, here's the vibe: all public keys (PKEYs) go through a bunch of stages in their life-cycle, and each one is a whole little era 💖
start— this is the PKEY before it has been allocated. it's the starting state for any life-cycle transitions, like the blank slate era 🫶newed— this is the PKEY after it has been allocated. congrats, it exists now ✨decapsulate— this is the PKEY when it's ready to perform a private key decapsulation operation 💅decrypt— this is the PKEY when it's ready to decrypt some ciphertext 🔐derive— this is the PKEY when it's ready to derive a shared secret 🤝digest sign— this is the PKEY when it's ready to perform a private key signature operation ✍️encapsulate— this is the PKEY when it's ready to perform a public key encapsulation operation 🎁encrypt— this is the PKEY when it's ready to encrypt some plaintext 🔒key generation— this is the PKEY when it's ready to generate a new public/private key 👑parameter generation— this is the PKEY when it's ready to generate key parameters 🧚verify— this is the PKEY when it's ready to verify a public key signature ✅verify recover— this is the PKEY when it's ready to recover a public key signature data 🙈freed— this state is entered when the PKEY is freed. it is the terminal state for all life-cycle transitions, periodt 💀
🦋 State Transition Diagram 🦋
the usual life-cycle of a PKEY object is illustrated below, in all its ASCII-art glory — don't come for the spacing, it's canon 😭💖
+-------------+
| |
| start |
| |
EVP_PKEY_derive +-------------+
+-------------+ EVP_PKEY_derive_set_peer |
+-------------+
| |----------------------------+ |
+----------------------------| |
| derive | | |
| EVP_PKEY_verify | verify |
| |<---------------------------+ |
+--------------------------->| |
+-------------+ |
+-------------+
^ |
^
| EVP_PKEY_derive_init |
EVP_PKEY_verify_init |
+---------------------------------------+ |
+---------------------------------------+
| | |
+-------------+ | | |
+-------------+
| |----------------------------+ | | |
+----------------------------| |
| digest sign | EVP_PKEY_sign | | | |
| EVP_PKEY_verify_recover | verify |
| |<---------------------------+ | | |
+--------------------------->| recover |
+-------------+ | | |
+-------------+
^ | | |
^
| EVP_PKEY_sign_init | | |
EVP_PKEY_verify_recover_init |
+---------------------------------+ | | |
+---------------------------------+
| | | | |
+-------------+ | | | | |
+-------------+
| |----------------------------+ | | | | |
+----------------------------| |
| decapsulate | EVP_PKEY_decapsulate | | | | | |
| EVP_PKEY_decrypt | decrypt |
| |<---------------------------+ | | v | |
+--------------------------->| |
+-------------+ | +-------------+ |
+-------------+
^ +---| |---+
^
| EVP_PKEY_decapsulate_init | |
EVP_PKEY_decrypt_init |
+-------------------------------------| newed
|-------------------------------------+
| |
+---| |---+
+-------------+ | +-------------+ |
+-------------+
| |----------------------------+ | | | |
+----------------------------| |
| encapsulate | EVP_PKEY_encapsulate | | | | |
| EVP_PKEY_encrypt | encrypt |
| |<---------------------------+ | | | |
+--------------------------->| |
+-------------+ | | | |
+-------------+
^ | | | |
^
| EVP_PKEY_encapsulate_init | | | |
EVP_PKEY_encrypt_init |
+---------------------------------+ | |
+---------------------------------+
| |
+---------------------------------------+
+---------------------------------------+
| EVP_PKEY_paramgen_init
EVP_PKEY_keygen_init |
v
v
+-------------+
+-------------+
| |----------------------------+
+----------------------------| |
| parameter | |
| | key |
| generation |<---------------------------+
+--------------------------->| generation |
+-------------+ EVP_PKEY_paramgen
EVP_PKEY_keygen +-------------+
EVP_PKEY_gen
EVP_PKEY_gen
+ - - - - - +
+-----------+
' ' EVP_PKEY_CTX_free |
|
' any state '------------------->|
freed |
' ' |
|
+ - - - - - +
+-----------+✨ Formal State Transitions ✨
Okay so this is the canonical list — the section that defines all of the legal state transitions, no exceptions, no vibes-based shortcuts. The source says it straight and I'm saying it with glitter: this is the whole legal pipeline, bestie. 💅
I'm dropping the grid exactly as printed, because this is one of those places where one shifted cell would ruin the whole fit. Do not perceive the spacing, just respect it. 😭
Function Call
----------------------------------------------------------------------
Current State
----------------------------------------------------------------------
start newed digest verify
verify encrypt decrypt derive encapsulate
decapsulate parameter key freed
sign
recover
generation generation
EVP_PKEY_CTX_new newed
EVP_PKEY_CTX_new_id newed
EVP_PKEY_CTX_new_from_name newed
EVP_PKEY_CTX_new_from_pkey newed
EVP_PKEY_sign_init digest digest digest
digest digest digest digest digest digest
digest digest
sign sign sign
sign sign sign sign sign sign
sign sign
EVP_PKEY_sign digest
sign
EVP_PKEY_verify_init verify verify verify
verify verify verify verify verify verify
verify verify
EVP_PKEY_verify verify
EVP_PKEY_verify_recover_init verify verify verify
verify verify verify verify verify verify
verify verify
recover recover recover
recover recover recover recover recover recover
recover recover
EVP_PKEY_verify_recover
verify
recover
EVP_PKEY_encrypt_init encrypt encrypt encrypt
encrypt encrypt encrypt encrypt encrypt encrypt
encrypt encrypt
EVP_PKEY_encrypt
encrypt
EVP_PKEY_decrypt_init decrypt decrypt decrypt
decrypt decrypt decrypt decrypt decrypt decrypt
decrypt decrypt
EVP_PKEY_decrypt
decrypt
EVP_PKEY_derive_init derive derive derive
derive derive derive derive derive derive
derive derive
EVP_PKEY_derive_set_peer
derive
EVP_PKEY_derive
derive
EVP_PKEY_encapsulate_init encapsulate encapsulate
encapsulate encapsulate encapsulate encapsulate encapsulate
encapsulate encapsulate encapsulate encapsulate
EVP_PKEY_encapsulate
encapsulate
EVP_PKEY_decapsulate_init decapsulate decapsulate
decapsulate decapsulate decapsulate decapsulate decapsulate
decapsulate decapsulate decapsulate decapsulate
EVP_PKEY_decapsulate
decapsulate
EVP_PKEY_paramgen_init parameter parameter
parameter parameter parameter parameter parameter
parameter parameter parameter parameter
generation generation
generation generation generation generation generation
generation generation generation generation
EVP_PKEY_paramgen
parameter
generation
EVP_PKEY_keygen_init key key key
key key key key key key
key key
generation generation
generation generation generation generation generation
generation generation generation generation
EVP_PKEY_keygen
key
generation
EVP_PKEY_gen
parameter key
generation
generation
EVP_PKEY_CTX_get_params newed digest verify
verify encrypt decrypt derive encapsulate
decapsulate parameter key
sign
recover
generation generation
EVP_PKEY_CTX_set_params newed digest verify
verify encrypt decrypt derive encapsulate
decapsulate parameter key
sign
recover
generation generation
EVP_PKEY_CTX_gettable_params newed digest verify
verify encrypt decrypt derive encapsulate
decapsulate parameter key
sign
recover
generation generation
EVP_PKEY_CTX_settable_params newed digest verify
verify encrypt decrypt derive encapsulate
decapsulate parameter key
sign
recover
generation generation
EVP_PKEY_CTX_free freed freed freed freed
freed freed freed freed freed freed
freed freedIt's giving "grid that survived a terminal accident," butFunction Callis down one side,Current Stateis across the top, and every function and state is present and accounted for. 🫶
📝 NOTES
So here's the tea, and it's lowkey important: at some point the EVP layer will begin enforcing the transitions described herein. That's the whole note. Future-you has been warned, and she is grateful. 💜
👀 SEE ALSO
Go read these next — they're the supporting cast and they all ate, fr fr:
EVP_PKEY_new(3)EVP_PKEY_decapsulate(3)EVP_PKEY_decrypt(3)EVP_PKEY_encapsulate(3)EVP_PKEY_encrypt(3)EVP_PKEY_derive(3)EVP_PKEY_keygen(3)EVP_PKEY_sign(3)EVP_PKEY_verify(3)EVP_PKEY_verify_recover(3)
🕰️ HISTORY
The provider PKEY interface was introduced in OpenSSL 3.0. That's it, that's the lore. 🌸
©️ COPYRIGHT
Copyright 2021-2022 The OpenSSL Project Authors. All Rights Reserved.
Okay, legal bit, and I'm keeping this word-for-word because lawyers do not play:
Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at https://www.openssl.org/source/license.html.
This iconic page is LIFE_CYCLE-PKEY(7ossl), served fresh from OpenSSL 3.5.9, dated 2026-09-29. Now go transition responsibly, bestie — mwah! 💖🎀✨
📦 where this page comes from
- alpine 3.23: openssl-doc 3.5.9-r0 · Apache-2.0
- alpine 3.24: openssl-doc 3.5.9-r0 · Apache-2.0
- 💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash-1017 on : a language model's rewrite of the original, under its terms