OPENSSL-KDF(1SSL)

📦
version 4.0.3 · 13 versions
, in ubuntu stonking

💫 openssl-kdf — the openssl KDF page, but make it cute ✨

okay bestie, welcome to OPENSSL-KDF(1SSL) from the OpenSSL fam — this is the vibe where we do Key Derivation Function stuff. Locking in 🫶

🌸 NAME 🌸

openssl-kdf — bestie, we're out here performing Key Derivation Function operations. that's the whole job. periodt 💅

🎀 SYNOPSIS 🎀

openssl kdf [-help] [-cipher] [-digest] [-mac] [-kdfopt nm:v] [-keylen
num] [-out filename] [-binary] [-provider name] [-provider-path path]
[-provparam [name:]key=value] [-propquery propq] kdf_name

✨ DESCRIPTION ✨

so like. the key derivation functions take a secret or a password and generate a derived key from it. that's the whole thing. it's giving "cook a new key out of the ingredients you already have" 🔥

👑 OPTIONS 👑

  • -help — prints a usage message for u. that's it. that's the whole job. 🎀
  • -keylen num — the output size of the derived key. this field is required, bestie, no skipping it, it's not optional at all. 😤
  • -out filename — the filename you wanna output to. if you don't say anything, it just goes to standard output. default behavior, iconic.
  • -binary — outputs the derived key in binary form. if you don't pass this, it uses hexadecimal text format instead. so pick ur fighter 💅
  • -cipher name — specify the cipher the KDF is gonna use. not all KDFs require a cipher, and using this option in those cases is literally an error. so know ur KDF, iykyk. 🙈
  • -digest name — specify the digest the KDF is gonna use. again, not all KDFs require a digest, and using this option when they don't is an error. to see the list of supported digests, run openssl list -digest-commands. super handy, no cap. ⭐
  • -mac name — specify the MAC the KDF is gonna use. and yeah, not all KDFs require a MAC, and using this option in those cases is an error. the theme of this page is "read ur KDF's requirements first," fr fr. 💀
  • -kdfopt nm:v — passes options to the KDF algorithm. a comprehensive list of parameters lives in "PARAMETERS" in EVP_KDF(3). the common parameter names used by EVP_KDF_CTX_set_params() are:
    • key:string — specifies the secret key as an alphanumeric string (use this if the key contains printable characters only). the string length must conform to any restrictions of the KDF algorithm. a key must be specified for most KDF algorithms. so most of the time, ur bringing a key to the function. 🔑
    • hexkey:string — alternative to the key: option, where the secret key gets specified in hexadecimal form (two hex digits per byte).
    • pass:string — specifies the password as an alphanumeric string (use if the password contains printable characters only). the password must be specified for PBKDF2 and scrypt. those two are not playing around. 🍓
    • hexpass:string — alternative to the pass: option, where the password gets specified in hexadecimal form (two hex digits per byte).
    • salt:string — specifies a non-secret unique cryptographic salt as an alphanumeric string (use if it contains printable characters only). the length must conform to any restrictions of the KDF algorithm. a salt parameter is required for several KDF algorithms, such as EVP_KDF-PBKDF2(7). salty but make it cryptographic 🧂
    • hexsalt:string — alternative to the salt: option, where the salt gets specified in hexadecimal form (two hex digits per byte).
    • info:string — some KDF implementations, such as EVP_KDF-HKDF(7), take an 'info' parameter for binding the derived key material to application- and context-specific information. specifies the info, fixed info, other info or shared info argument as an alphanumeric string (use if it contains printable characters only). the length must conform to any restrictions of the KDF algorithm. it's giving "context, but make it a parameter" ✨
    • hexinfo:string — alternative to the info: option, where the info gets specified in hexadecimal form (two hex digits per byte).
    • digest:string — this option is identical to the -digest option. twins fr. 👯
    • cipher:string — this option is identical to the -cipher option.
    • mac:string — this option is identical to the -mac option.
  • -provider name
  • -provider-path path
  • -provparam [name:]key=value
  • -propquery propq — see "Provider Options" in openssl(1), provider(7), and property(7). that's where the provider lore lives 📚
  • kdf_name — specifies the name of a supported KDF algorithm that's gonna be used. the supported algorithm names include TLS1-PRF, HKDF, SSKDF, PBKDF2, SNMPKDF, SRTPKDF, SSHKDF, X942KDF-ASN1, X942KDF-CONCAT, X963KDF and SCRYPT. pick ur main character 💖

🌈 EXAMPLES 🌈

Use TLS1-PRF to create a hex-encoded derived key from a secret key and seed:

openssl kdf -keylen 16 -kdfopt digest:SHA2-256 -kdfopt key:secret \
            -kdfopt seed:seed TLS1-PRF

Use HKDF to create a hex-encoded derived key from a secret key, salt and info:

openssl kdf -keylen 10 -kdfopt digest:SHA2-256 -kdfopt key:secret \
            -kdfopt salt:salt -kdfopt info:label HKDF

Use SSKDF with KMAC to create a hex-encoded derived key from a secret key, salt and info:

openssl kdf -keylen 64 -kdfopt mac:KMAC-128 -kdfopt maclen:20 \
            -kdfopt hexkey:b74a149a161545 -kdfopt hexinfo:348a37a2 \
            -kdfopt hexsalt:3638271ccd68a2 SSKDF

Use SSKDF with HMAC to create a hex-encoded derived key from a secret key, salt and info:

openssl kdf -keylen 16 -kdfopt mac:HMAC -kdfopt digest:SHA2-256 \
            -kdfopt hexkey:b74a149a -kdfopt hexinfo:348a37a2 \
            -kdfopt hexsalt:3638271c SSKDF

Use SSKDF with Hash to create a hex-encoded derived key from a secret key, salt and info:

openssl kdf -keylen 14 -kdfopt digest:SHA2-256 \
            -kdfopt hexkey:6dbdc23f045488 \
            -kdfopt hexinfo:a1b2c3d4 SSKDF

Use SNMPKDF to create a hex-encoded derived key from an engine ID, hash and password:

openssl kdf -keylen 20 -kdfopt digest:SHA1 \
            -kdfopt pass:IFUcNbMl \
            -kdfopt hexeid:800002b805123456789abcdef0123456789abcdef0123456789abcdef0123456 SNMPKDF

Use SRTPKDF to create a SRTP authentication derived key from a cipher, mkey, msalt, kdr, index and label:

openssl kdf -keylen 20 -kdfopt cipher:AES-128-CTR \
            -kdfopt key:E1F97A0D3E018BE0D64FA32C06DE4139 \
            -kdfopt salt:0EC675AD498AFEEBB6960B3AABE6 \
            -kdfopt index:000000000000 -kdfopt label:1 SRTPKDF

Use SSHKDF to create a hex-encoded derived key from a secret key, hash and session_id:

openssl kdf -keylen 16 -kdfopt digest:SHA2-256 \
            -kdfopt hexkey:0102030405 \
            -kdfopt hexxcghash:06090A \
            -kdfopt hexsession_id:01020304 \
            -kdfopt type:A SSHKDF

Use PBKDF2 to create a hex-encoded derived key from a password and salt:

openssl kdf -keylen 32 -kdfopt digest:SHA256 -kdfopt pass:password \
            -kdfopt salt:salt -kdfopt iter:2 PBKDF2

Use scrypt to create a hex-encoded derived key from a password and salt:

openssl kdf -keylen 64 -kdfopt pass:password -kdfopt salt:NaCl \
            -kdfopt n:1024 -kdfopt r:8 -kdfopt p:16 \
            -kdfopt maxmem_bytes:10485760 SCRYPT

📝 NOTES 📝

the KDF mechanisms that are available will depend on the options used when building OpenSSL. so like, ur build choices decide ur destiny 💀

🦋 SEE ALSO 🦋

openssl(1), openssl-pkeyutl(1), EVP_KDF(3), EVP_KDF-SCRYPT(7), EVP_KDF-TLS1_PRF(7), EVP_KDF-PBKDF2(7), EVP_KDF-HKDF(7), EVP_KDF-SNMPKDF(7), EVP_KDF-SRTPKDF(7), EVP_KDF-SS(7), EVP_KDF-SSHKDF(7), EVP_KDF-X942-ASN1(7), EVP_KDF-X942-CONCAT(7), EVP_KDF-X963(7)

💜 HISTORY 💜

added in OpenSSL 3.0 — so it's not even ancient lore, it's modern. ate. 🔥

Copyright 2019-2026 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

okay that's the whole page, bestie 🫶 shoutout to version 4.0.3 and date 2026-09-29 — that's the source/date lore, and also the OPENSSL-KDF(1SSL) page title if u were wondering. now go derive some keys, slay 💅✨

📦 where this page comes from