LIFE\_CYCLE-PKEY(7ossl) OpenSSL LIFE\_CYCLE-PKEY(7ossl) # [NAME](#NAME) life\_cycle-pkey - The PKEY algorithm life-cycle # [DESCRIPTION](#DESCRIPTION) All public keys (PKEYs) go through a number of stages in their life-cycle: [start](#start) This state represents the PKEY before it has been allocated. It is the starting state for any life-cycle transitions. [newed](#newed) This state represents the PKEY after it has been allocated. [decapsulate](#decapsulate) This state represents the PKEY when it is ready to perform a private key decapsulation operation. [decrypt](#decrypt) This state represents the PKEY when it is ready to decrypt some ciphertext. [derive](#derive) This state represents the PKEY when it is ready to derive a shared secret. [digest sign](#digest) This state represents the PKEY when it is ready to perform a private key signature operation. [encapsulate](#encapsulate) This state represents the PKEY when it is ready to perform a public key encapsulation operation. [encrypt](#encrypt) This state represents the PKEY when it is ready to encrypt some plaintext. [key generation](#key) This state represents the PKEY when it is ready to generate a new public/private key. [parameter generation](#parameter) This state represents the PKEY when it is ready to generate key parameters. [verify](#verify) This state represents the PKEY when it is ready to verify a public key signature. verify recover This state represents the PKEY when it is ready to recover a public key signature data. [freed](#freed) This state is entered when the PKEY is freed. It is the terminal state for all life-cycle transitions. ## [State Transition Diagram](#State_Transition_Diagram) The usual life-cycle of a PKEY object is illustrated: +-------------+ | | | start | | | EVP\_PKEY\_derive +-------------+ +-------------+ EVP\_PKEY\_derive\_set\_peer | +-------------+ | |----------------------------+ | +----------------------------| | | derive | | | | EVP\_PKEY\_verify | verify | | |<---------------------------+ | +--------------------------->| | +-------------+ | +-------------+ ^ | ^ | EVP\_PKEY\_derive\_init | EVP\_PKEY\_verify\_init | +---------------------------------------+ | +---------------------------------------+ | | | +-------------+ | | | +-------------+ | |----------------------------+ | | | +----------------------------| | | digest sign | EVP\_PKEY\_sign | | | | | EVP\_PKEY\_verify\_recover | verify | | |<---------------------------+ | | | +--------------------------->| recover | +-------------+ | | | +-------------+ ^ | | | ^ | EVP\_PKEY\_sign\_init | | | EVP\_PKEY\_verify\_recover\_init | +---------------------------------+ | | | +---------------------------------+ | | | | | +-------------+ | | | | | +-------------+ | |----------------------------+ | | | | | +----------------------------| | | decapsulate | EVP\_PKEY\_decapsulate | | | | | | | EVP\_PKEY\_decrypt | decrypt | | |<---------------------------+ | | v | | +--------------------------->| | +-------------+ | +-------------+ | +-------------+ ^ +---| |---+ ^ | EVP\_PKEY\_decapsulate\_init | | EVP\_PKEY\_decrypt\_init | +-------------------------------------| newed |-------------------------------------+ | | +---| |---+ +-------------+ | +-------------+ | +-------------+ | |----------------------------+ | | | | +----------------------------| | | encapsulate | EVP\_PKEY\_encapsulate | | | | | | EVP\_PKEY\_encrypt | encrypt | | |<---------------------------+ | | | | +--------------------------->| | +-------------+ | | | | +-------------+ ^ | | | | ^ | EVP\_PKEY\_encapsulate\_init | | | | EVP\_PKEY\_encrypt\_init | +---------------------------------+ | | +---------------------------------+ | | +---------------------------------------+ +---------------------------------------+ | EVP\_PKEY\_paramgen\_init EVP\_PKEY\_keygen\_init | v v +-------------+ +-------------+ | |----------------------------+ +----------------------------| | | parameter | | | | key | | generation |<---------------------------+ +--------------------------->| generation | +-------------+ EVP\_PKEY\_paramgen EVP\_PKEY\_keygen +-------------+ EVP\_PKEY\_gen EVP\_PKEY\_gen \+ - - - - - + +-----------+ ' ' EVP\_PKEY\_CTX\_free | | ' any state '------------------->| freed | ' ' | | \+ - - - - - + +-----------+ ## [Formal State Transitions](#Formal_State_Transitions) This section defines all of the legal state transitions. This is the canonical list. Function Call ---------------------------------------------------------------------- Current State ---------------------------------------------------------------------- start newed digest verify verify encrypt decrypt derive encapsulate decapsulate parameter key freed sign recover generation generation EVP\_PKEY\_CTX\_new newed EVP\_PKEY\_CTX\_new\_id newed EVP\_PKEY\_CTX\_new\_from\_name newed EVP\_PKEY\_CTX\_new\_from\_pkey newed EVP\_PKEY\_sign\_init digest digest digest digest digest digest digest digest digest digest digest sign sign sign sign sign sign sign sign sign sign sign EVP\_PKEY\_sign digest sign EVP\_PKEY\_verify\_init verify verify verify verify verify verify verify verify verify verify verify EVP\_PKEY\_verify verify EVP\_PKEY\_verify\_recover\_init verify verify verify verify verify verify verify verify verify verify verify recover recover recover recover recover recover recover recover recover recover recover EVP\_PKEY\_verify\_recover verify recover EVP\_PKEY\_encrypt\_init encrypt encrypt encrypt encrypt encrypt encrypt encrypt encrypt encrypt encrypt encrypt EVP\_PKEY\_encrypt encrypt EVP\_PKEY\_decrypt\_init decrypt decrypt decrypt decrypt decrypt decrypt decrypt decrypt decrypt decrypt decrypt EVP\_PKEY\_decrypt decrypt EVP\_PKEY\_derive\_init derive derive derive derive derive derive derive derive derive derive derive EVP\_PKEY\_derive\_set\_peer derive EVP\_PKEY\_derive derive EVP\_PKEY\_encapsulate\_init encapsulate encapsulate encapsulate encapsulate encapsulate encapsulate encapsulate encapsulate encapsulate encapsulate encapsulate EVP\_PKEY\_encapsulate encapsulate EVP\_PKEY\_decapsulate\_init decapsulate decapsulate decapsulate decapsulate decapsulate decapsulate decapsulate decapsulate decapsulate decapsulate decapsulate EVP\_PKEY\_decapsulate decapsulate EVP\_PKEY\_paramgen\_init parameter parameter parameter parameter parameter parameter parameter parameter parameter parameter parameter generation generation generation generation generation generation generation generation generation generation generation EVP\_PKEY\_paramgen parameter generation EVP\_PKEY\_keygen\_init key key key key key key key key key key key generation generation generation generation generation generation generation generation generation generation generation EVP\_PKEY\_keygen key generation EVP\_PKEY\_gen parameter key generation generation EVP\_PKEY\_CTX\_get\_params newed digest verify verify encrypt decrypt derive encapsulate decapsulate parameter key sign recover generation generation EVP\_PKEY\_CTX\_set\_params newed digest verify verify encrypt decrypt derive encapsulate decapsulate parameter key sign recover generation generation EVP\_PKEY\_CTX\_gettable\_params newed digest verify verify encrypt decrypt derive encapsulate decapsulate parameter key sign recover generation generation EVP\_PKEY\_CTX\_settable\_params newed digest verify verify encrypt decrypt derive encapsulate decapsulate parameter key sign recover generation generation EVP\_PKEY\_CTX\_free freed freed freed freed freed freed freed freed freed freed freed freed # [NOTES](#NOTES) At some point the EVP layer will begin enforcing the transitions described herein. # [SEE ALSO](#SEE_ALSO) [**EVP\_PKEY\_new**(3)](/man/os/openssl/EVP_PKEY_new.3), [**EVP\_PKEY\_decapsulate**(3)](/man/os/openssl/EVP_PKEY_decapsulate.3), [**EVP\_PKEY\_decrypt**(3)](/man/os/openssl/EVP_PKEY_decrypt.3), [**EVP\_PKEY\_encapsulate**(3)](/man/os/openssl/EVP_PKEY_encapsulate.3), [**EVP\_PKEY\_encrypt**(3)](/man/os/openssl/EVP_PKEY_encrypt.3), [**EVP\_PKEY\_derive**(3)](/man/os/openssl/EVP_PKEY_derive.3), [**EVP\_PKEY\_keygen**(3)](/man/os/openssl/EVP_PKEY_keygen.3), [**EVP\_PKEY\_sign**(3)](/man/os/openssl/EVP_PKEY_sign.3), [**EVP\_PKEY\_verify**(3)](/man/os/openssl/EVP_PKEY_verify.3), [**EVP\_PKEY\_verify\_recover**(3)](/man/os/openssl/EVP_PKEY_verify_recover.3) # [HISTORY](#HISTORY) The provider PKEY interface was introduced in OpenSSL 3.0. # [COPYRIGHT](#COPYRIGHT) Copyright 2021-2022 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>. 2026-09-29 3.6.5 --- Document: life_cycle-pkey(7ossl) from openssl 3.6.5-r5 (Chainguard OS) Source: https://github.com/openssl/openssl