EVP_KDF-HMAC-DRBG(7ossl)

📦
version 3.5.9 · 8 versions
, in alpine 3.23, alpine 3.24

💅 EVP_KDF-HMAC-DRBG

okay so bestie, welcome to EVP_KDF-HMAC-DRBG — this is the HMAC DRBG DETERMINISTIC EVP_KDF implementation, and it's from the OpenSSL 7ossl manual section, so you know it's the real deal ✨

🎀 NAME

EVP_KDF-HMAC-DRBG — the HMAC DRBG DETERMINISTIC EVP_KDF implementation. literally what it says on the tin, no cap 💅

🌸 DESCRIPTION

So here's the vibe: this gives you support for a deterministic HMAC DRBG through the EVP_KDF API. Super similar to EVP_RAND-HMAC-DRBG(7)… except (and this is the main character detail) it uses fixed values for its entropy and nonce values. 😭

Why do we care? Because this is what you use to generate the deterministic nonce value that ECDSA and DSA need — as defined in RFC 6979. periodt. 🔥

🦋 Identity

"HMAC-DRBG-KDF" is the name for this implementation, bestie. That's the string you feed to the EVP_KDF_fetch() function. iykyk ✨

💜 Supported parameters

These are the params she supports, and yes we're listing every single one 🫶

  • "digest" (OSSL_DRBG_PARAM_DIGEST) <UTF8 string>
  • "properties" (OSSL_DRBG_PARAM_PROPERTIES) <UTF8 string>

These two work exactly as described in "PARAMETERS" in EVP_KDF(3). no notes, slay 💖

  • "entropy" (OSSL_KDF_PARAM_HMACDRBG_ENTROPY) <octet string> — sets the entropy bytes supplied to the HMAC-DRBG.
  • "nonce" (OSSL_KDF_PARAM_HMACDRBG_NONCE) <octet string> — sets the nonce bytes supplied to the HMAC-DRBG.
🩷 reminder: these are the options you pass in — the digest one is a <UTF8 string>, and the entropy + nonce ones are <octet string>s. keep your types right, bestie 💀

⭐ NOTES

you get a context for KDF HMAC DRBG by calling this, and honestly it's giving iconic:

EVP_KDF *kdf = EVP_KDF_fetch(NULL, "HMAC-DRBG-KDF", NULL);
EVP_KDF_CTX *kdf_ctx = EVP_KDF_CTX_new(kdf, NULL);

look at her go 🧚💫

🌈 CONFORMING TO

RFC 6979 — that's the one, that's the standard 🔥

👑 SEE ALSO

🍓 HISTORY

The EVP_KDF-HMAC-DRBG functionality was added in OpenSSL 3.2. so if you're on something older… bestie, upgrade 🙈

Copyright 2022-2023 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

like please actually read the license, it's not optional 🫶

okay that's the whole page, mwah 💋 — sent with love from the OpenSSL 3.5.9 manual, dated 2026-09-29, in EVP_KDF-HMAC-DRBG(7ossl) 💖✨🎀

📦 where this page comes from