EVP_KDF-TLS1_PRF(7ossl)

📦
version 15.1 · 3 versions
, in freebsd 15.1

💖 EVP_KDF-TLS1_PRF — the TLS1 PRF glow-up (OpenSSL, 7ossl manual) 💖

okay so bestie, this is the EVP_KDF-TLS1_PRF page from the OpenSSL docs, and it's lowkey one of the most iconic little KDFs in the whole set. let's get into it ✨

🌸 NAME 🌸

EVP_KDF-TLS1_PRF — literally the TLS1 PRF EVP_KDF implementation. that's her. that's the whole vibe 🎀

🦋 DESCRIPTION 🦋

so this is the support for computing the TLS1 PRF through the EVP_KDF API. the EVP_KDF-TLS1_PRF algorithm implements the PRF used by TLS versions up to and including TLS 1.2 — yes, we're in legacy-adjacent territory, and yes, she still eats 💅

the output is considered to be keying material. like, that's what you get, that's the product, that's the whole point 🔥

👑 Identity 👑

"TLS1-PRF" is the name for this implementation; it can be used with the EVP_KDF_fetch() function. memorise it, it's your new favorite string 🫶

✨ Supported parameters ✨

the supported parameters are:

  • "properties" (OSSL_KDF_PARAM_PROPERTIES) <UTF8 string> — works exactly as described in "PARAMETERS" in EVP_KDF(3). no notes, she's a classic 🎀
  • "digest" (OSSL_KDF_PARAM_DIGEST) <UTF8 string> — also works as described in "PARAMETERS" in EVP_KDF(3), but here's the tea: the OSSL_KDF_PARAM_DIGEST parameter is used to set the message digest associated with the TLS PRF. and EVP_md5_sha1() is treated as a special case which uses the PRF algorithm using both MD5 and SHA1 as used in TLS 1.0 and 1.1. she's giving dual-threat main character energy 😭
  • "secret" (OSSL_KDF_PARAM_SECRET) <octet string> — this parameter sets the secret value of the TLS PRF. any existing secret value is replaced. new secret, who dis 💅
  • "seed" (OSSL_KDF_PARAM_SEED) <octet string> — this parameter sets the context seed. important detail: the length of the context seed cannot exceed 1024 bytes; this should be more than enough for any normal use of the TLS PRF. don't be extra, bestie 🌈

the OpenSSL FIPS provider also supports the following parameters:

  • "fips-indicator" (OSSL_KDF_PARAM_FIPS_APPROVED_INDICATOR) <integer> — a getter that returns 1 if the operation is FIPS approved, or 0 otherwise. this may be used after calling EVP_KDF_derive. it returns 0 if any "***-check" related parameter is set to 0 and the check fails. so it's basically the vibe check for compliance 👀
  • "ems_check" (OSSL_KDF_PARAM_FIPS_EMS_CHECK) <integer> — the default value of 1 causes an error during EVP_KDF_derive() if "master secret" is used instead of "extended master secret". setting this to zero will ignore the error and set the approved "fips-indicator" to 0. this option breaks FIPS compliance if it causes the approved "fips-indicator" to return 0. like, that's the tradeoff, be aware 🙈
  • "digest-check" (OSSL_KDF_PARAM_FIPS_DIGEST_CHECK) <integer> — the default value of 1 causes an error during EVP_KDF_CTX_set_params() if used digest is not approved. setting this to zero will ignore the error and set the approved "fips-indicator" to 0. this option breaks FIPS compliance if it causes the approved "fips-indicator" to return 0. also, per SP 800-135r1, the following are approved digest algorithms: SHA2-256, SHA2-384, SHA2-512. those three, no substitutions ⭐
  • "key-check" (OSSL_KDF_PARAM_FIPS_KEY_CHECK) <integer> — the default value of 1 causes an error during EVP_KDF_CTX_set_params() if the length of used key-derivation key (OSSL_KDF_PARAM_SECRET) is shorter than 112 bits. setting this to zero will ignore the error and set the approved "fips-indicator" to 0. this option breaks FIPS compliance if it causes the approved "fips-indicator" to return 0. 112 bits minimum or she's not approving it, periodt 💀

🧚 NOTES 🧚

a context for the TLS PRF can be obtained by calling:

EVP_KDF *kdf = EVP_KDF_fetch(NULL, "TLS1-PRF", NULL);
EVP_KDF_CTX *kctx = EVP_KDF_CTX_new(kdf);

the digest, secret value and seed must be set before a key is derived — otherwise an error will occur. no skipping steps, bestie, the order matters 😤

the output length of the PRF is specified by the keylen parameter to the EVP_KDF_derive() function. you choose the size, she delivers 🫶

🌟 EXAMPLES 🌟

this example derives 10 bytes using SHA-256 with the secret key "secret" and seed value "seed" — yes those are the actual strings, iconic choice:

EVP_KDF *kdf;
EVP_KDF_CTX *kctx;
unsigned char out[10];
OSSL_PARAM params[4], *p = params;

kdf = EVP_KDF_fetch(NULL, "TLS1-PRF", NULL);
kctx = EVP_KDF_CTX_new(kdf);
EVP_KDF_free(kdf);

*p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
                                        SN_sha256, strlen(SN_sha256));
*p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SECRET,
                                         "secret", (size_t)6);
*p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SEED,
                                         "seed", (size_t)4);
*p = OSSL_PARAM_construct_end();
if (EVP_KDF_derive(kctx, out, sizeof(out), params) <= 0) {
    error("EVP_KDF_derive");
}
EVP_KDF_CTX_free(kctx);

🌈 CONFORMING TO 🌈

RFC 2246, RFC 5246 and NIST SP 800-135 r1. she's certified, she's documented, she's referenced 📜✨

🍓 SEE ALSO 🍓

EVP_KDF(3), EVP_KDF_CTX_new(3), EVP_KDF_CTX_free(3), EVP_KDF_CTX_set_params(3), EVP_KDF_derive(3), "PARAMETERS" in EVP_KDF(3). go read those next, iykyk 💜

💜 HISTORY 💜

this functionality was added in OpenSSL 3.0. a modern queen 👑

Copyright 2018-2024 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

and that's the page, bestie 🫶 this was OpenSSL 3.5.6, dated 2026-04-07, manual page EVP_KDF-TLS1_PRF(7ossl) — slay, go derive some keying material responsibly 💅✨

📦 where this page comes from