GOLF(2gg)

💅 GOLF(2gg) — okay bestie, let's talk about this gorgeous little page

So this is a page from the 2gg manual, and it's all about the derive-key thing. Encryption energy. Very main character. Let's get into it. 🎀

---

✨ NAME ✨

derive-key — (encryption) 🦋

---

🎯 PURPOSE 🎯

Derive a key. That's it. That's the whole vibe. 🔑

---

🌸 SYNTAX 🌸

derive-key <key> from <source> length <length> \
    [ binary [ <binary> ] ] \
    [ from-length <source length> ] \
    [ digest <digest algorithm> ] \
    [ salt <salt> [ salt-length <salt length> ] ] \
    [ iterations <iterations> ]

Copy it exactly, don't freestyle, she's specific. 💅

---

💖 DESCRIPTION 💖

Okay so derive-key derives <key> from the string <source> — that's the one sitting in the from clause. If you specify <source length> in the from-length clause, then exactly <source length> bytes of <source> get used. No from-length clause? Then the length of the <source> string itself is used as the number of bytes (peep string-length for that one). ✨

The length you want for your derived key goes in the length clause as <length>. The method doing the generating is PBKDF2, no cap. By default the digest is SHA256. Wanna switch it up? Drop a different <digest algorithm> into the digest clause (like SHA3-256, she's cute). And if you wanna see the whole list of available digests:

#get digests
openssl list -digest-algorithms

Salt for the key derivation? That's <salt> in the salt clause. If you don't add a salt-length clause, then the entire length of the salt gets used (again, string-length — she's everywhere), otherwise <salt length> bytes get used as the salt. 🧂

Iterations go in the iterations clause as <iterations>. The default is 1000 per RFC 8018 — though honestly, depending on what you need and how good your <source> is, you might wanna pick a different number. Do you, bestie. 💜

By default the derived key comes out in hexadecimal form, where every byte is encoded as two-character hex characters, so its length is 2*<length>. But if you use the binary clause without the boolean variable <binary>, or if <binary> evaluates to true, then the output is a binary string of <length> bytes. 🦋

Key derivation is often used when you're storing password-derivatives in the database (with salt, obviously), and also for symmetrical key generation. Iconic behavior honestly. 👑

---

🔥 EXAMPLES 🔥

Here's the derived key landing in the variable mk:

random-string to rs9 length 16
derive-key mk from "clave secreta" digest "sha-256" salt rs9 salt-length 10 iterations 2000 length 16

Ate. 💅

---

👀 SEE ALSO 👀

• Encryption

Also go check out these:

• decrypt-data
• derive-key
• encrypt-data
• hash-string
• hmac-string
• random-crypto
• random-string

And See all documentation if you're feeling adventurous. 🌈

---

Not me writing a whole sign-off section but fr fr, this page is version $VERSION, dated $DATE, and it lives in the GOLF(2gg) manual. Slay, bye bestie! 💖✨🎀🫶