LIFE\_CYCLE-CIPHER(7ossl) OpenSSL LIFE\_CYCLE-CIPHER(7ossl)

# [NAME](#NAME)

life\_cycle-cipher - The cipher algorithm life-cycle

# [DESCRIPTION](#DESCRIPTION)

All symmetric ciphers (CIPHERs) go through a number of stages in their life-cycle:

[start](#start)

This state represents the CIPHER before it has been allocated. It is the starting state for any life-cycle transitions.

[newed](#newed)

This state represents the CIPHER after it has been allocated.

[initialised](#initialised)

These states represent the CIPHER when it is set up and capable of processing input. There are three possible initialised states:

initialised using EVP\_CipherInit

initialised for decryption using EVP\_DecryptInit

initialised for encryption using EVP\_EncryptInit

[updated](#updated)

These states represent the CIPHER when it is set up and capable of processing additional input or generating output. The three possible states directly correspond to those for initialised above. The three different streams should not be mixed.

[finaled](#finaled)

This state represents the CIPHER when it has generated output.

[freed](#freed)

This state is entered when the CIPHER is freed. It is the terminal state for all life-cycle transitions.

## [State Transition Diagram](#State_Transition_Diagram)

The usual life-cycle of a CIPHER is illustrated:  
+---------------------------+  
| |  
| start |  
| |  
+---------------------------+ + - - - - - - - - - - - - - +  
| ' any of the initialised '  
| EVP\_CIPHER\_CTX\_new ' updated or finaled states '  
v ' '  
+---------------------------+ + - - - - - - - - - - - - - +  
| | |  
| newed | | EVP\_CIPHER\_CTX\_reset  
| | <----+  
+---------------------------+  
| | |  
+---------+ | +---------+  
EVP\_DecryptInit | | EVP\_CipherInit | EVP\_EncryptInit  
v v v  
+---------------------------+ +---------------------------+ +---------------------------+  
| | | | | |  
| initialised | | initialised | | initialised |  
| for decryption | | | | for encryption |  
+---------------------------+ +---------------------------+ +---------------------------+  
| | |  
| EVP\_DecryptUpdate | EVP\_CipherUpdate EVP\_EncryptUpdate |  
| v |  
| +---------------------------+ |  
| | |--------------------+ |  
| | updated | EVP\_CipherUpdate | |  
| | | <------------------+ |  
v +---------------------------+ v  
+---------------------------+ | +---------------------------+  
| |---------------------+ | | |  
| updated | EVP\_DecryptUpdate | | | updated |------+  
| for decryption | <-------------------+ | | for encryption | |  
+---------------------------+ | +---------------------------+ |  
| EVP\_CipherFinal | | ^ |  
+-------+ | +--------+ | |  
EVP\_DecryptFinal | | | EVP\_EncryptFinal +-------------------+  
v v v EVP\_EncryptUpdate  
+---------------------------+  
| |-----------------------------+  
| finaled | |  
| | <---------------------------+  
+---------------------------+ EVP\_CIPHER\_CTX\_get\_params  
| (AEAD encryption)  
| EVP\_CIPHER\_CTX\_free  
v  
+---------------------------+  
| |  
| freed |  
| |  
+---------------------------+

## [Formal State Transitions](#Formal_State_Transitions)

This section defines all of the legal state transitions. This is the canonical list.  
Function Call ---------------------------------------------- Current State -----------------------------------------------  
start newed initialised updated finaled initialised updated initialised updated freed  
decryption decryption encryption encryption  
EVP\_CIPHER\_CTX\_new newed  
EVP\_CipherInit initialised initialised initialised initialised initialised initialised initialised initialised  
EVP\_DecryptInit initialised initialised initialised initialised initialised initialised initialised initialised  
decryption decryption decryption decryption decryption decryption decryption decryption  
EVP\_EncryptInit initialised initialised initialised initialised initialised initialised initialised initialised  
encryption encryption encryption encryption encryption encryption encryption encryption  
EVP\_CipherUpdate updated updated  
EVP\_DecryptUpdate updated updated  
decryption decryption  
EVP\_EncryptUpdate updated updated  
encryption encryption  
EVP\_CipherFinal finaled  
EVP\_DecryptFinal finaled  
EVP\_EncryptFinal finaled  
EVP\_CIPHER\_CTX\_free freed freed freed freed freed freed freed freed freed  
EVP\_CIPHER\_CTX\_reset newed newed newed newed newed newed newed newed  
EVP\_CIPHER\_CTX\_get\_params newed initialised updated initialised updated initialised updated  
decryption decryption encryption encryption  
EVP\_CIPHER\_CTX\_set\_params newed initialised updated initialised updated initialised updated  
decryption decryption encryption encryption  
EVP\_CIPHER\_CTX\_gettable\_params newed initialised updated initialised updated initialised updated  
decryption decryption encryption encryption  
EVP\_CIPHER\_CTX\_settable\_params newed initialised updated initialised updated initialised updated  
decryption decryption encryption encryption

# [NOTES](#NOTES)

At some point the EVP layer will begin enforcing the transitions described herein.

# [SEE ALSO](#SEE_ALSO)

[**provider-cipher**(7)](/man/os/openssl-4.0/provider-cipher.7), [**EVP\_EncryptInit**(3)](/man/os/openssl-4.0/EVP_EncryptInit.3)

# [COPYRIGHT](#COPYRIGHT)

Copyright 2021 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

2026-09-29 4.0.3

---

Document: life_cycle-cipher(7ossl) from openssl-4.0 4.0.3-r6 (Chainguard OS)