EVP_KDF-KB(7ossl)

📦

version 3.5.9 · 8 versions

3.5.9 · alpine 3.23, alpine 3.24 (latest)
3.5.9 · centos-stream 9
3.5.9 · centos-stream 10
3.5.9 · alpine 3.22
3.5.8 · fedora 43
3.5.1 · fedora 43
3.5.9 · fedora 43, fedora 44
3.5.5 · fedora 44

💅 EVP_KDF-KB — the Key-Based EVP_KDF implementation (7ossl, bestie)

okay so this is the manpage for EVP_KDF-KB, from the OpenSSL 7ossl manual set, and it's genuinely one of the cuter ones. grab a strawberry drink 🍓 and let's get into it.

✨ NAME ✨

EVP_KDF-KB — the Key-Based EVP_KDF implementation. that's it, that's the name, no cap.

🦋 DESCRIPTION 🦋

The EVP_KDF-KB algorithm implements the Key-Based key derivation function (KBKDF). KBKDF derives a key from repeated application of a keyed MAC to an input secret (and other optional values). literally just MAC-ing your secret over and over until you have a key, iconic behavior tbh 👑

The output is considered to be keying material. periodt.

🎀 Identity 🎀

"KBKDF" is the name for this implementation; it can be used with the EVP_KDF_fetch() function. that's your lookup string, bestie, don't fumble it.

🌸 Supported parameters 🌸

The supported parameters are:

"mode" (OSSL_KDF_PARAM_MODE) <UTF8 string> — this one determines which flavor of KBKDF you're getting. currently the choices are "counter" and "feedback". "counter" is the default, and will be used if unspecified. so if you say nothing, you get counter mode. she's the main character default 💅
"mac" (OSSL_KDF_PARAM_MAC) <UTF8 string> — the value is either CMAC, HMAC, KMAC128 or KMAC256. pick your fighter.
"digest" (OSSL_KDF_PARAM_DIGEST) <UTF8 string>
"cipher" (OSSL_KDF_PARAM_CIPHER) <UTF8 string>
"properties" (OSSL_KDF_PARAM_PROPERTIES) <UTF8 string>
"key" (OSSL_KDF_PARAM_KEY) <octet string>
"salt" (OSSL_KDF_PARAM_SALT) <octet string>
"info (OSSL_KDF_PARAM_INFO) <octet string> — (yes that quote situation is exactly how it's written in the source, don't come for me 🙈)
"seed" (OSSL_KDF_PARAM_SEED) <octet string> — the seed parameter is unused in counter mode. counter mode said "not my business", and honestly? valid.
"use-l" (OSSL_KDF_PARAM_KBKDF_USE_L) <integer> — set to 0 to disable use of the optional Fixed Input data 'L' (see SP800-108). the default value of 1 will be used if unspecified. so L is on unless you say otherwise ✨
"use-separator" (OSSL_KDF_PARAM_KBKDF_USE_SEPARATOR) <integer> — set to 0 to disable use of the optional Fixed Input data 'zero separator' (see SP800-108) that is placed between the Label and Context. the default value of 1 will be used if unspecified. separator stays winning by default 🫶
"r" (OSSL_KDF_PARAM_KBKDF_R) <integer> — set the fixed value 'r', indicating the length of the counter in bits.

supported values are 8, 16, 24, and 32. the default value of 32 will be used if unspecified. only those four, bestie, don't try to be creative 🔥

The OpenSSL FIPS provider also supports the following parameters:

"fips-indicator" (OSSL_KDF_PARAM_FIPS_APPROVED_INDICATOR) <integer> — a getter that returns 1 if the operation is FIPS approved, or 0 otherwise. this may be used after calling EVP_KDF_derive. it returns 0 if "key-check" is set to 0 and the check fails. read-only energy 👑
"key-check" (OSSL_KDF_PARAM_FIPS_KEY_CHECK) <integer> — the default value of 1 causes an error during EVP_KDF_CTX_set_params() if the length of used key-derivation key (OSSL_KDF_PARAM_KEY) is shorter than 112 bits. setting this to zero will ignore the error and set the approved "fips-indicator" to 0.

⚠️ heads up babes: this option breaks FIPS compliance if it causes the approved "fips-indicator" to return 0. like, it's an option, but it's a choice, and the compliance girlies will notice 💀

Depending on whether mac is CMAC or HMAC, either digest or cipher is required (respectively) and the other is unused. They are unused for KMAC128 and KMAC256. so match them up correctly, iykyk.

The parameters key, salt, info, and seed correspond to KI, Label, Context, and IV (respectively) in SP800-108. As in that document, salt, info, and seed are optional and may be omitted. omitting them is allowed, not a crime 🌈

"mac", "digest", cipher" and "properties"are described in **"PARAMETERS" inEVP_KDF(3)`**. go read the parent page if you want the full lore.

💜 NOTES 💜

A context for KBKDF can be obtained by calling:

EVP_KDF *kdf = EVP_KDF_fetch(NULL, "KBKDF", NULL);
EVP_KDF_CTX *kctx = EVP_KDF_CTX_new(kdf);

The output length of an KBKDF is specified via the "keylen" parameter to the EVP_KDF_derive(3) function. so you're not getting a random length, you're getting the length you asked for, slay.

Note that currently OpenSSL only implements counter and feedback modes. Other variants may be supported in the future. not yet, bestie, patience 🧚

🔥 EXAMPLES 🔥

This example derives 10 bytes using COUNTER-HMAC-SHA256, with KI "secret", Label "label", and Context "context".

EVP_KDF *kdf;
EVP_KDF_CTX *kctx;
unsigned char out[10];
OSSL_PARAM params[6], *p = params;

kdf = EVP_KDF_fetch(NULL, "KBKDF", NULL);
kctx = EVP_KDF_CTX_new(kdf);
EVP_KDF_free(kdf);

*p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
                                        "SHA2-256", 0);
*p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_MAC,
                                        "HMAC", 0);
*p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY,
                                         "secret", strlen("secret"));
*p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SALT,
                                         "label", strlen("label"));
*p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_INFO,
                                         "context", strlen("context"));
*p = OSSL_PARAM_construct_end();
if (EVP_KDF_derive(kctx, out, sizeof(out), params) <= 0)
    error("EVP_KDF_derive");

EVP_KDF_CTX_free(kctx);

This example derives 10 bytes using FEEDBACK-CMAC-AES256, with KI "secret", Label "label", and IV "sixteen bytes iv".

EVP_KDF *kdf;
EVP_KDF_CTX *kctx;
unsigned char out[10];
OSSL_PARAM params[8], *p = params;
unsigned char *iv = "sixteen bytes iv";

kdf = EVP_KDF_fetch(NULL, "KBKDF", NULL);
kctx = EVP_KDF_CTX_new(kdf);
EVP_KDF_free(kdf);

*p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_CIPHER, "AES256", 0);
*p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_MAC, "CMAC", 0);
*p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_MODE, "FEEDBACK", 0);
*p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY,
                                         "secret", strlen("secret"));
*p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SALT,
                                         "label", strlen("label"));
*p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_INFO,
                                         "context", strlen("context"));
*p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SEED,
                                         iv, strlen(iv));
*p = OSSL_PARAM_construct_end();
if (EVP_KDF_derive(kctx, out, sizeof(out), params) <= 0)
    error("EVP_KDF_derive");

EVP_KDF_CTX_free(kctx);

see? not scary. copy-paste her and go 🫶

👑 CONFORMING TO 👑

NIST SP800-108, IETF RFC 6803, IETF RFC 8009. she's certified, she's standards-compliant, she's that girl.

🌈 SEE ALSO 🌈

EVP_KDF(3), EVP_KDF_CTX_free(3), EVP_KDF_CTX_get_kdf_size(3), EVP_KDF_derive(3), "PARAMETERS" in EVP_KDF(3). go click through, it's giving linked-list of knowledge 💖

⭐ HISTORY ⭐

This functionality was added in OpenSSL 3.0.

Support for KMAC was added in OpenSSL 3.1.

so if you're on something ancient, that's between you and your package manager 💀

💅 COPYRIGHT 💅

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

okay that's the whole page, you made it 🎀 this was EVP_KDF-KB(7ossl) from OpenSSL 3.5.9, dated 2026-09-29 — written by the OpenSSL girlies, read by you, bestie. mwah 💜✨

📦 where this page comes from

alpine 3.23: openssl-doc 3.5.9-r0 · Apache-2.0
alpine 3.24: openssl-doc 3.5.9-r0 · Apache-2.0
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash-1017 on 2026-11-04: a language model's rewrite of the original, under its terms