LIFE_CYCLE-KDF(7ossl)

📦
version 15.1 · 3 versions
, in freebsd 15.1

💅 life_cycle-kdf — the KDF algorithm life-cycle (that's 7ossl to you, bestie)

Okay so picture this: every single key derivation function (KDF) and pseudo random function (PRF) out there goes through a whole journey in its life-cycle. Character development, if you will. Here's the cast:

start This is the KDF/PRF before it's been allocated. Baby. Fresh. Unwritten. It's the starting state for literally any life-cycle transition ever.

newed This is the state after the KDF/PRF has been allocated. It exists now. Iconic.

deriving This is when the KDF/PRF is all set up and capable of generating output. Main character energy fr fr.

freed This is when the KDF/PRF gets freed. It's the terminal state for all life-cycle transitions — no coming back from this one 💀

🦋 State Transition Diagram

The usual life-cycle of a KDF/PRF is giving:

                     +-------------------+
                     |       start       |
                     +-------------------+
                       |
                       | EVP_KDF_CTX_new
                       v
                     +-------------------+
                     |       newed       | <+
                     +-------------------+  |
                       |                    |
                       | EVP_KDF_derive     |
                       v                    | EVP_KDF_CTX_reset
    EVP_KDF_derive   +-------------------+  |
  + - - - - - - - -  |                   |  |
  '                  |     deriving      |  |
  + - - - - - - - -> |                   | -+
                     +-------------------+
                       |
                       | EVP_KDF_CTX_free
                       v
                     +-------------------+
                     |       freed       |
                     +-------------------+

📋 Formal State Transitions

This section defines all of the legal state transitions. It's the canonical list, no cap.

 Function Call                   ------------- Current State
-------------                    start       newed       deriving
freed
 EVP_KDF_CTX_new                 newed
 EVP_KDF_derive                             deriving     deriving
 EVP_KDF_CTX_free                freed       freed        freed
 EVP_KDF_CTX_reset                           newed        newed
 EVP_KDF_CTX_get_params                      newed       deriving
 EVP_KDF_CTX_set_params                      newed       deriving
 EVP_KDF_CTX_gettable_params                 newed       deriving
 EVP_KDF_CTX_settable_params                 newed       deriving

🌸 NOTES 🌸

At some point the EVP layer will begin enforcing the transitions described herein. Like, actually policing them. So don't get cute.

👀 SEE ALSO 👀

provider-kdf(7), EVP_KDF(3).

🎀 HISTORY 🎀

The provider KDF interface was introduced in OpenSSL 3.0. Vintage-ish. Nostalgic.

Copyright 2021 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

Alright bestie, that's the whole page, every last detail intact 🫶 This was LIFE_CYCLE-KDF(7ossl) from OpenSSL 3.5.6, dated 2026-04-07 — mwah, slay, periodt ✨💅

📦 where this page comes from