KCAPI_KDF_CTR(3)

💖 KCAPI_KDF_CTR 💖

okay bestie, welcome to kcapi_kdf_ctr from the Programming Interface section of the libkcapi manual (that's section 3, the library-calls girlies 🫶). it's literally the Counter Mode Key Derivation Function and it's here to turn your input into a key. no cap.

---

✨ NAME ✨

kcapi_kdf_ctr — Counter Mode Key Derivation Function

---

🌸 SYNOPSIS 🌸

ssize_t kcapi_kdf_ctr(struct kcapi_handle * handle, const uint8_t * src,
                      size_t slen, uint8_t * dst, size_t dlen);

---

🎀 ARGUMENTS 🎀

• handle — [in] the cipher handle that you, the caller, allocated. 💅 and listen: this handle must be allocated with kcapi_md_init. and if you're the kind of main character who wants a KDF using a keyed message digest, you should also call kcapi_md_setkey before you invoke this function. yes ma'am, order matters.
• src — [in] the input data that's getting transformed into a key (more on that down below 👇).
• slen — [in] length of the src input data.
• dst — [out] the buffer where the generated key goes. she's the output, she's the moment. ✨
• dlen — [in] length of the dst buffer. and this is the important part: this value defines the number of bytes generated by the KDF. so like, you decide how much key you get. iconic.

---

🦋 DESCRIPTION 🦋

so this function is an implementation of the KDF in counter mode according to SP800-108 section 5.1, AND ALSO SP800-56A section 5.8.1 (that's the Single-step KDF). two standards, one function, she's versatile. 💅

SP800-108: the caller must provide Label || 0x00 || Context in src. and honestly? that src pointer may also be NULL if you're the kind of caller who wishes not to provide anything. no thoughts, no context, just vibes. 🍓

SP800-56A: if a keyed MAC is used, the key shall NOT be the shared secret from the DH operation — it has to be an independently generated key. like, do not do that. seriously. and the src pointer here is defined as Z || other info, where Z is the shared secret from DH and other info is an arbitrary string (see SP800-56A section 5.8.1.2 for the receipts 📜).

return 0 upon success; a negative errno-style error code if an error occurred. so like, zero is the slay, negative is the 😭.

---

👑 AUTHOR 👑

Stephan Mueller <smueller@chronox.de> — Author. periodt. 💜

---

🌈 COPYRIGHT 🌈

that's the whole page bestie, go derive some keys responsibly 🧚✨

libkcapi Manual 1.5.0 — July 2025 — KCAPI_KDF_CTR(3)

mwah 💋 go forth and be cryptographic.