EVP_KDF-PBKDF1(7ossl)

📦
version 3.5.9 · 8 versions
, in alpine 3.23, alpine 3.24

💅 EVP_KDF-PBKDF1 — the PBKDF1 glow-up, explained

okay so bestie, welcome to the EVP_KDF-PBKDF1 page from the OpenSSL 7ossl manual — no cap, this is the whole thing, just with better vibes. 🎀

✨ NAME ✨

EVP_KDF-PBKDF1 — literally the PBKDF1 EVP_KDF implementation, that's her, that's the whole name 🫶

🌸 DESCRIPTION 🌸

So this page is all about support for computing the PBKDF1 password-based KDF through the EVP_KDF API. Slay.

The EVP_KDF-PBKDF1 algorithm implements the PBKDF1 password-based key derivation function, as described in RFC 8018; it derives a key from a password using a salt and iteration count. Iconic behaviour, honestly. 🔥

💖 Identity 💖

"PBKDF1" is the name for this implementation — that's her government name, iykyk — and it can be used with the EVP_KDF_fetch() function. 💅

🦋 Supported parameters 🦋

The supported parameters are, in order, bestie:

  • "pass" (OSSL_KDF_PARAM_PASSWORD) <octet string> — the password, as an octet string.
  • "salt" (OSSL_KDF_PARAM_SALT) <octet string> — the salt, also an octet string.
  • "iter" (OSSL_KDF_PARAM_ITER) <unsigned integer> — the iteration count. This parameter has a default value of 0 and should be set. Not me leaving it at 0, please set it. 😭
  • "properties" (OSSL_KDF_PARAM_PROPERTIES) <UTF8 string> — works as described in "PARAMETERS" in EVP_KDF(3).
  • "digest" (OSSL_KDF_PARAM_DIGEST) <UTF8 string> — also works as described in "PARAMETERS" in EVP_KDF(3).

⭐ NOTES ⭐

A typical application of this algorithm is to derive keying material for an encryption algorithm from a password in "pass", a salt in "salt", and an iteration count. Classic combo, honestly. 🧚

Increasing the "iter" parameter slows down the algorithm, which makes it harder for an attacker to perform a brute force attack using a large number of candidate passwords. So like… more iterations = more main character energy for your security, less for the attackers. 💀

No assumption is made regarding the given password; it is simply treated as a byte sequence. She's not judging your password, she's just reading bytes. 🙈

🚨 Heads up bestie: the legacy provider needs to be available in order to access this algorithm. No legacy provider, no PBKDF1. Periodt.

🌈 CONFORMING TO 🌈

RFC 8018 — that's the standard, and she ate. 👑

🍓 SEE ALSO 🍓

🕰️ HISTORY 🕰️

This functionality was added in OpenSSL 3.0. She's been iconic since day one. ⭐

Copyright 2021 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

okay that's the whole page, nothing skipped, bestie 🫶 — this was OpenSSL 3.5.9, dated 2026-09-29, signing off from the EVP_KDF-PBKDF1(7ossl) manual. mwah 💋🎀

📦 where this page comes from