Correct, the OpenSSL API requires that you init the context without the key or IV, set the key length, then add the key/IV (but don't pass the EVP_CIPHER).

This is also how you have to do it when using ```EVP_CIPHER_CTX_ctrl``` for AEAD stuff.