LIFE_CYCLE-CIPHER(7SSL)
🦋 NAME 🦋
okay bestie, welcome to life_cycle-cipher — it's the manpage all about the cipher algorithm life-cycle. And yes, it lives in the 7SSL section of the OpenSSL docs, we're fancy like that. 💅
✨ DESCRIPTION ✨
so here's the tea: every symmetric cipher (they call them CIPHERs) goes through a whole arc in its life-cycle. Character development, honestly. Here are all the stages:
start— this is the CIPHER before it's been allocated. It's the starting state for any life-cycle transitions. The "no thoughts, head empty" era. 🌱newed— this is the CIPHER after it's been allocated. Freshly newed, born anew, glowing. ✨initialised— these states are the CIPHER when it's all set up and capable of processing input. And there are three possible initialised states, not one:- initialised using
EVP_CipherInit - initialised for decryption using
EVP_DecryptInit - initialised for encryption using
EVP_EncryptInit
- initialised using
updated— these states are the CIPHER when it's set up and capable of processing additional input or generating output. The three possible states line up directly with the three initialised ones above. And 🚨 heads up: the three different streams should not be mixed. Do not mix them. Not even a little. 🙅♀️finaled— the CIPHER has generated output. It did the thing, it ate, it left no crumbs. 🎀freed— this is the state you enter when the CIPHER is freed. It's the terminal state for all life-cycle transitions. Say goodbye, it served its purpose. 👑
📊 State Transition Diagram 📊
the usual life-cycle of a CIPHER goes a little something like this — fair warning, the ASCII art got lowkey ate by the terminal width so it's doing its own thing, but every arrow and label is in there fr fr:
+---------------------------+
| |
| start |
| |
+---------------------------+ + - - -
- - - - - - - - - - +
| ' any
of the initialised '
| EVP_CIPHER_CTX_new '
updated or finaled states '
v '
'
+---------------------------+ + - - -
- - - - - - - - - - +
| | |
| newed | |
EVP_CIPHER_CTX_reset
| | <----+
+---------------------------+
| | |
+---------+ | +---------+
EVP_DecryptInit | | EVP_CipherInit |
EVP_EncryptInit
v v v
+---------------------------+ +---------------------------+ +---------------------------+
| | | | |
| initialised | | initialised | | initialised |
| for decryption | | | | for encryption |
+---------------------------+ +---------------------------+ +---------------------------+
| | |
| EVP_DecryptUpdate | EVP_CipherUpdate | EVP_EncryptUpdate |
| v |
| +---------------------------+ |
| | | |
| | updated | |
| | | |
| +---------------------------+ |
v v
+---------------------------+ | +---------------------------+
| |---------------------+ | | |
| updated | EVP_DecryptUpdate | | | updated |------+
| for decryption | <-------------------+ | | for encryption | |
+---------------------------+ | +---------------------------+ |
| EVP_CipherFinal | | |
+-------+ | +--------+ |
EVP_DecryptFinal | | | EVP_EncryptFinal +-------------------+
v v v
+---------------------------+
| |-----------------------------+
| finaled | |
| | <---------------------------+
+---------------------------+ EVP_CIPHER_CTX_get_params
| (AEAD encryption)
| EVP_CIPHER_CTX_free
v
+---------------------------+
| |
| freed |
| |
+---------------------------+so like: start gets EVP_CIPHER_CTX_new'd into newed, then you init into one of the three initialised flavours, update your way into the matching updated state, final into finaled, and eventually EVP_CIPHER_CTX_free takes you to freed. There's also an EVP_CIPHER_CTX_reset path back to newed from newed, and the whole "any of the initialised / updated or finaled states" thing loops back on itself because AEAD encryption hits EVP_CIPHER_CTX_get_params after finaled. 🔁
📜 Formal State Transitions 📜
this section defines all of the legal state transitions. This is the canonical list, so no improvising, bestie. Here it is, exactly as the manpage lays it out:
Function Call
---------------------------------------------- Current State
-----------------------------------------------
start newed initialised updated
finaled initialised updated initialised updated freed
decryption
decryption encryption encryption
EVP_CIPHER_CTX_new newed
EVP_CipherInit initialised initialised initialised
initialised initialised initialised initialised initialised
EVP_DecryptInit initialised initialised initialised
initialised initialised initialised initialised initialised
decryption decryption decryption
decryption decryption decryption decryption decryption
EVP_EncryptInit initialised initialised initialised
initialised initialised initialised initialised initialised
encryption encryption encryption
encryption encryption encryption encryption encryption
EVP_CipherUpdate updated updated
EVP_DecryptUpdate
updated updated
decryption
decryption
EVP_EncryptUpdate
updated updated
encryption
encryption
EVP_CipherFinal finaled
EVP_DecryptFinal
finaled
EVP_EncryptFinal
finaled
EVP_CIPHER_CTX_free freed freed freed freed
freed freed freed freed freed
EVP_CIPHER_CTX_reset newed newed newed
newed newed newed newed newed
EVP_CIPHER_CTX_get_params newed initialised updated
initialised updated initialised updated
decryption
decryption encryption encryption
EVP_CIPHER_CTX_set_params newed initialised updated
initialised updated initialised updated
decryption
decryption encryption encryption
EVP_CIPHER_CTX_gettable_params newed initialised updated
initialised updated initialised updated
decryption
decryption encryption encryption
EVP_CIPHER_CTX_settable_params newed initialised updated
initialised updated initialised updated
decryption
decryption encryption encryptionok so the function calls that show up in this table (the canonical roster, no substitutions 💅) are:
EVP_CIPHER_CTX_newEVP_CipherInitEVP_DecryptInitEVP_EncryptInitEVP_CipherUpdateEVP_DecryptUpdateEVP_EncryptUpdateEVP_CipherFinalEVP_DecryptFinalEVP_EncryptFinalEVP_CIPHER_CTX_freeEVP_CIPHER_CTX_resetEVP_CIPHER_CTX_get_paramsEVP_CIPHER_CTX_set_paramsEVP_CIPHER_CTX_gettable_paramsEVP_CIPHER_CTX_settable_params
and the states across the top of that table are start, newed, initialised, updated, finaled, plus the three initialised flavours and three updated flavours (initialised/updated decryption and initialised/updated encryption), and freed. Read it row by row: each function tells you which state you land in depending on which state you're currently in. 🧚
📝 NOTES 📝
At some point the EVP layer will begin enforcing the transitions described herein.
so like… right now some of this is vibes and good manners, but the EVP layer is gonna start actually enforcing these transitions. Behave now so you're not caught slipping later. 💀
👀 SEE ALSO 👀
go read those too, they're part of the lore. 🫶
©️ COPYRIGHT ©️
Copyright 2021 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.
ok that's the whole page bestie, you ate it, you understood it, iconic behavior honestly 💖✨ this was version 4.0.3 dated 2026-09-29, from the LIFE_CYCLE-CIPHER(7SSL) page, and yes I'm obsessed with you for reading the whole thing. periodt. 🎀🦋💅
📦 where this page comes from
- ubuntu stonking: openssl 4.0.3-1ubuntu1
- 💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash on : a language model's rewrite of the original, under its terms