EVP_KDF-HMAC-DRBG(7ossl)

💖 EVP_KDF-HMAC-DRBG 💖

okay bestie, welcome to the EVP_KDF-HMAC-DRBG page — this is an ossl manpage, so settle in 💅

✨ NAME ✨

EVP_KDF-HMAC-DRBG — the HMAC DRBG DETERMINISTIC EVP_KDF implementation. yes, all caps DETERMINISTIC, it's that serious 🎀

🌸 DESCRIPTION 🌸

so here's the vibe: this gives you support for a deterministic HMAC DRBG using the EVP_KDF API 🦋

it's similar to EVP_RAND-HMAC-DRBG(7), but — and this is the main character detail — it uses fixed values for its entropy and nonce values 🔥

what's it for? generating the deterministic nonce value that ECDSA and DSA need (as defined in RFC 6979). periodt 👑

🌈 Identity 🌈

"HMAC-DRBG-KDF" is the name for this implementation — that's the string you feed to the EVP_KDF_fetch() function, iykyk ✨

🎀 Supported parameters 🎀

the supported parameters are:

• "digest" (OSSL_DRBG_PARAM_DIGEST) <UTF8 string>
• "properties" (OSSL_DRBG_PARAM_PROPERTIES) <UTF8 string>

these parameters work as described in "PARAMETERS" in EVP_KDF(3). literally just go read that section bestie 📖

• "entropy" (OSSL_KDF_PARAM_HMACDRBG_ENTROPY) <octet string>

sets the entropy bytes supplied to the HMAC-DRBG 🔐

• "nonce" (OSSL_KDF_PARAM_HMACDRBG_NONCE) <octet string>

sets the nonce bytes supplied to the HMAC-DRBG 🌸

💜 NOTES 💜

you can get a context for KDF HMAC DRBG by calling this, copy it exactly bestie:

EVP_KDF *kdf = EVP_KDF_fetch(NULL, "HMAC-DRBG-KDF", NULL);
EVP_KDF_CTX *kdf_ctx = EVP_KDF_CTX_new(kdf, NULL);

it's giving "two lines and you're done" 😭💖

🦋 CONFORMING TO 🦋

RFC 6979 — that's the one, no cap 📜

⭐ SEE ALSO ⭐

EVP_KDF(3), "PARAMETERS" in EVP_KDF(3) — go click those, they're the supporting cast 🫶

👑 HISTORY 👑

the EVP_KDF-HMAC-DRBG functionality was added in OpenSSL 3.2. so if you're on something older, that's why it's not vibing 😭

💀 COPYRIGHT 💀

Copyright 2022-2023 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

fr fr read the license before you do anything, it's not optional 🙈

---

and that's the whole page, bestie 🎀 this was version 3.5.0, dated 2026-09-25 — screenshot it, cite it, slay it 💅✨🦋