OSSL_CRMF_PBMP_NEW(3ossl)

💖 OSSL_CRMF_PBMP_NEW 💖

okay bestie, so this is the man page for the OSSL_CRMF_PBMP_NEW functions in OpenSSL — yes, that whole 3ossl thing just means it lives in the OpenSSL section of your manual, no biggie. We're doing Password-Based MACs today and honestly? It's giving cryptography main character energy. 🎀

---

✨ NAME ✨

OSSL_CRMF_pbm_new, OSSL_CRMF_pbmp_new — the functions that produce a Password-Based MAC (aka PBM, aka the vibe check your secret has to pass 💅).

---

✨ SYNOPSIS ✨

#include <openssl/crmf.h>

int OSSL_CRMF_pbm_new(OSSL_LIB_CTX *libctx, const char *propq,
                      const OSSL_CRMF_PBMPARAMETER *pbmp,
                      const unsigned char *msg, size_t msglen,
                      const unsigned char *sec, size_t seclen,
                      unsigned char **mac, size_t *maclen);

OSSL_CRMF_PBMPARAMETER *OSSL_CRMF_pbmp_new(OSSL_LIB_CTX *libctx, size_t saltlen,
                                           int owfnid, size_t itercnt,
                                           int macnid);

---

✨ DESCRIPTION ✨

🫶 OSSL_CRMF_pbm_new()

So this one generates a PBM (Password-Based MAC, keep up bestie) based on the given PBM parameters pbmp, the message msg, and the secret sec — plus their respective lengths msglen and seclen, because C is like that and always wants to know how long everything is. 🙈

The optional library context libctx and propq parameters may be used to influence the selection of the MAC algorithm that's referenced in the pbmp. Want the deets? Go read "ALGORITHM FETCHING" in crypto(7), it's all laid out there. 📚

On success it writes the address of the newly allocated MAC through the mac reference parameter, and writes the length through the maclen reference parameter — unless maclen is NULL, in which case it just... doesn't. Slay, we love a graceful little exception. 💀

🌸 OSSL_CRMF_pbmp_new()

This one initializes and returns a brand new PBMParameter structure, fully kitted out with:

• a new random salt of length saltlen ✨
• the OWF (one-way function) NID owfnid
• the OWF iteration count itercnt
• and the MAC NID macnid

The libctx library context parameter may be used to pick the provider for the random number generation (that's the DRBG btw), and it may be NULL for the default. No pressure. 🦋

---

✨ NOTES ✨

okay here's the tea ☕

The algorithms for the OWF (one-way function) and for the MAC (message authentication code) can be any that have a NID defined in <openssl/objects.h>. But for backward compatibility with RFC 4210, these should include NID_hmac_sha1. Don't be the person who breaks RFC 4210. 😭

RFC 4210 recommended that the salt SHOULD be at least 8 bytes (64 bits) long, where 16 bytes is common. That's the standard, bestie. Follow it. 🌈

The iteration count must be at least 100, as stipulated by RFC 4211, and is limited to at most 100000 to avoid DoS through manipulated or otherwise malformed input. Yeah — someone out there is absolutely trying to hand you cursed input to make your machine suffer, so we cap it. 🛑

If you want currently suggested values, go check out RFC 9045. It's the updated homework. 📝

---

✨ RETURN VALUES ✨

• OSSL_CRMF_pbm_new() — returns 1 on success, 0 on error. Binary. Iconic. Simple. 👑
• OSSL_CRMF_pbmp_new() — returns a new and initialized OSSL_CRMF_PBMPARAMETER structure, or NULL on error. 💔

---

✨ EXAMPLES ✨

here's how it actually looks in the wild, copy it, love it, live it:

OSSL_CRMF_PBMPARAMETER *pbm = NULL;
unsigned char *msg = "Hello";
unsigned char *sec = "SeCrEt";
unsigned char *mac = NULL;
size_t maclen;

if ((pbm = OSSL_CRMF_pbmp_new(16, NID_sha256, 500, NID_hmac_sha1) == NULL))
    goto err;
if (!OSSL_CRMF_pbm_new(pbm, msg, 5, sec, 6, &mac, &maclen))
    goto err;

---

✨ SEE ALSO ✨

• RFC 4211 section 4.4 — go read it, it's short, i promise 🫶

---

✨ HISTORY ✨

The OpenSSL CRMF support was added in OpenSSL 3.0. It's not ancient, it's just well-adjusted. 💜

---

✨ COPYRIGHT ✨

Copyright 2007-2021 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

⚠️ fr fr, read the license before you do anything spicy with this. Legal girlies stay winning. 💅

---

and that's the whole page bestie!! 🎀 this was version 3.5.9, dated 2026-09-29, and it's the OSSL_CRMF_PBMP_NEW(3ossl) page from OpenSSL. mwah, go forth and MAC responsibly. 💖✨🦋