EVP_PKEY_CTX_SET_SCRYPT_N(3ossl)

📦 version 3.5.0, in opensuse-leap 16.0

💜 EVP_PKEY_CTX_SET_SCRYPT_N(3ossl) — the scrypt KDF glow-up 🎀

okay so bestie, this is an OpenSSL manual page (that's the 3ossl part, iykyk) and it's literally all about getting the scrypt KDF set up and ready to slay. grab a snack, we're going in 🍓

✨ NAME ✨

EVP_PKEY_CTX_set1_scrypt_salt, EVP_PKEY_CTX_set_scrypt_N, EVP_PKEY_CTX_set_scrypt_r, EVP_PKEY_CTX_set_scrypt_p, EVP_PKEY_CTX_set_scrypt_maxmem_bytes — the whole EVP_PKEY scrypt KDF support function squad 👑

🌈 SYNOPSIS 🌈

like, this is the important code part, no cap:

#include <openssl/kdf.h>

int EVP_PKEY_CTX_set1_scrypt_salt(EVP_PKEY_CTX *pctx, unsigned char *salt,
                                  int saltlen);

int EVP_PKEY_CTX_set_scrypt_N(EVP_PKEY_CTX *pctx, uint64_t N);

int EVP_PKEY_CTX_set_scrypt_r(EVP_PKEY_CTX *pctx, uint64_t r);

int EVP_PKEY_CTX_set_scrypt_p(EVP_PKEY_CTX *pctx, uint64_t p);

int EVP_PKEY_CTX_set_scrypt_maxmem_bytes(EVP_PKEY_CTX *pctx,
                                         uint64_t maxmem);

copy it exactly, bestie, don't be creative with the types 💅

🦋 DESCRIPTION 🦋

so these functions are the little setup crew 🫶 — they go and arrange all the necessary data you need before you can actually use the scrypt KDF. if you want the full lore on scrypt itself, go read EVP_KDF-SCRYPT(7), it's giving required reading ✨

  • EVP_PKEY_CTX_set1_scrypt_salt() — sets the salt value, and that salt is exactly saltlen bytes long. that's the whole vibe 🌸
  • EVP_PKEY_CTX_set_scrypt_N(), EVP_PKEY_CTX_set_scrypt_r() and EVP_PKEY_CTX_set_scrypt_p() — these three configure the work factors N, r and p. yes, all three, they're a package deal 💖
  • EVP_PKEY_CTX_set_scrypt_maxmem_bytes() — sets the max amount of RAM (in bytes, fr fr) that key derivation is allowed to use. and listen — if the RAM budget gets blown because the load factors are chosen too high, the key derivation straight up fails 😭 no warning, just fail. so like, maybe don't be greedy with those load factors 🙈

🎀 STRING CTRLS 🎀

plot twist: scrypt also supports string based control operations, via EVP_PKEY_CTX_ctrl_str(3). iconic versatility honestly ✨

so for the salt, you've got two options:

  • pass it with the type parameter "salt" — the normal way 💅
  • or hex-encode it and use the "hexsalt" parameter 🌸

and the work factors N, r and p, plus maxmem_bytes? those get set through the parameters "N", "r", "p" and "maxmem_bytes" respectively. yeah, the names are that obvious, love that for us 👑

⭐ NOTES ⭐

  • there's a newer generic API for KDFs — EVP_KDF(3) — and it's preferred over the whole EVP_PKEY method. so like, the EVP_PKEY way still works, but the new one is the main character now 👑
  • heads up: the scrypt KDF also pulls in EVP_PKEY_CTX_set1_pbe_pass() and the value from the string controls "pass" and "hexpass". go check EVP_PKEY_CTX_set1_pbe_pass(3) for the details, bestie 🫶

💀 RETURN VALUES 💀

all of these return 1 for success, and 0 or a negative value when things go wrong. but here's the specific one you need to know:

a return value of -2 means the operation is not supported by the public key algorithm. that's the specific error, not a general fail 💅

🌟 SEE ALSO 🌟

go read those too, they're the supportive besties of this page 🦋

🌸 HISTORY 🌸

fun fact: all the functions described here were converted from macros to functions in OpenSSL 3.0. glow-up era ✨

Copyright 2017-2020 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

okay that's the whole page, mwah 😘 this was OpenSSL 3.5.0, dated 2026-09-25 — go forth and scrypt responsibly, bestie 🧚💜

📦 where this page comes from