---
name: "libressl-EVP_CIPHER_CTX_init"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-EVP_CIPHER_CTX_init"
---

# libressl-EVP\_CIPHER\_CTX\_init(3)

obsolete EVP cipher functions

## NAME

**EVP\_CIPHER\_CTX\_init**, **EVP\_CIPHER\_CTX\_cleanup**, **EVP\_Cipher** – obsolete EVP cipher functions

## SYNOPSIS

Crypto Library (libcrypto, -lcrypto)

**#include \<openssl/evp.h\>**

*int*\

**EVP\_CIPHER\_CTX\_init**(*EVP\_CIPHER\_CTX \*ctx*);

*int*\

**EVP\_CIPHER\_CTX\_cleanup**(*EVP\_CIPHER\_CTX \*ctx*);

*int*\

**EVP\_Cipher**(*EVP\_CIPHER\_CTX \*ctx*, *unsigned char \*out*, *const unsigned char \*in*, *unsigned int in\_len*);

## DESCRIPTION

**EVP\_CIPHER\_CTX\_init**() is a deprecated function that could be used to clear a cipher context on the stack before *EVP\_CIPHER\_CTX* was made opaque. Calling it on a cipher context just returned from EVP\_CIPHER\_CTX\_new(3) has no effect. Calling it on a cipher context that was already used may leak memory with older versions of the library. Instead, use EVP\_CIPHER\_CTX\_reset(3) or EVP\_CIPHER\_CTX\_free(3).

**EVP\_CIPHER\_CTX\_cleanup**() is a deprecated alias for EVP\_CIPHER\_CTX\_reset(3). It clears all information from *ctx* and frees all allocated memory associated with it, except the *ctx* object itself.

**EVP\_Cipher**() exposes implementation details of the functions EVP\_CipherUpdate(3) and EVP\_CipherFinal(3) that should never have become part of the public API.

If the flag EVP\_CIPH\_FLAG\_CUSTOM\_CIPHER is set for the cipher used by *ctx*, behaviour depends on *in*. If that argument is NULL and *in\_len* is 0, behaviour is similar to EVP\_CipherFinal(3); if *in\_len* is not 0, behaviour is undefined. If *in* is not NULL, behaviour is similar to EVP\_CipherUpdate(3). In both cases, the exceptions to the similarity are that arguments and return values differ.

If the flag EVP\_CIPH\_FLAG\_CUSTOM\_CIPHER is not set for the cipher used by *ctx*, it encrypts or decrypts aligned blocks of data whose lengths match the cipher block size. It requires that the previous encryption or decryption operation using the same *ctx*, if there was any, ended exactly on a block boundary and that *in\_len* is an integer multiple of the cipher block size. If either of these conditions is violated, **EVP\_Cipher**() silently produces incorrect results. For that reason, using the function EVP\_CipherUpdate(3) instead is strongly recommended. The latter can safely handle partial blocks, and even if *in\_len* actually is a multiple of the cipher block size for all calls, the overhead incurred by using EVP\_CipherUpdate(3) is minimal.

## RETURN VALUES

**EVP\_CIPHER\_CTX\_init**() always returns 1.

**EVP\_CIPHER\_CTX\_cleanup**() returns 1 for success or 0 for failure.

With EVP\_CIPH\_FLAG\_CUSTOM\_CIPHER, **EVP\_Cipher**() returns the number of bytes written to *out* for success or -1 for failure. Without EVP\_CIPH\_FLAG\_CUSTOM\_CIPHER, it returns 1 for success or 0 for failure.

## SEE ALSO

evp(3), EVP\_EncryptInit(3)

## HISTORY

**EVP\_Cipher**() first appeared in SSLeay 0.6.5. **EVP\_CIPHER\_CTX\_cleanup**() first appeared in SSLeay 0.8.0. **EVP\_CIPHER\_CTX\_init**() first appeared in SSLeay 0.9.0. All these functions have been available since OpenBSD 2.4.

## CAVEATS

Checking the return value of **EVP\_Cipher**() requires unusual caution: zero signals success if EVP\_CIPH\_FLAG\_CUSTOM\_CIPHER is set or failure otherwise.