EVP_MAC-HMAC(7ossl)

📦
version 3.5.9 · 8 versions
, in alpine 3.23, alpine 3.24

💖 NAME 💖

EVP_MAC-HMAC — bestie, this is the HMAC implementation for the EVP_MAC API. That's it, that's the whole vibe. (We're in the OpenSSL man pages, section 7ossl — welcome to the group chat.)

✨ DESCRIPTION ✨

So basically: this is the support for computing HMAC MACs through the EVP_MAC API. Lowkey iconic, no cap.

Under the hood, this implementation uses EVP_MD functions to get access to the underlying digest. That's the whole trick, and it slays.

🎀 Identity 🎀

This implementation is identified with this name and these properties, to be used with EVP_MAC_fetch():

"HMAC", "provider=default" or "provider=fips"

Like, that's its whole government name. Use it with EVP_MAC_fetch() and you're good.

💅 Supported parameters 💅

The general description of these parameters lives in "PARAMETERS" in EVP_MAC(3) — go read that if you want the big picture, bestie.

The following parameters can be set with EVP_MAC_CTX_set_params():

  • "key" (OSSL_MAC_PARAM_KEY) <octet string> — Sets the MAC key. Setting this parameter is identical to passing a key to EVP_MAC_init(3). Same thing, different doorway. 🚪
  • "digest" (OSSL_MAC_PARAM_DIGEST) <UTF8 string> — Sets the name of the underlying digest to be used. Pick your fighter. 🥊
  • "properties" (OSSL_MAC_PARAM_PROPERTIES) <UTF8 string> — Sets the properties to be queried when trying to fetch the underlying digest. Heads up though: this must be given together with the digest naming parameter ("digest", or OSSL_MAC_PARAM_DIGEST) to be considered valid. No digest name, no deal. 🫶
  • "digest-noinit" (OSSL_MAC_PARAM_DIGEST_NOINIT) <integer> — A flag to set the MAC digest to not initialise the implementation specific data. The value 0 or 1 is expected. This option is deprecated and will be removed in a future release. It may be set but is currently ignored. 👻
  • "digest-oneshot" (OSSL_MAC_PARAM_DIGEST_ONESHOT) <integer> — A flag to set the MAC digest to be a one-shot operation. The value 0 or 1 is expected. This option is deprecated and will be removed in a future release. It may be set but is currently ignored. Same ghost energy. 💀
  • "tls-data-size" (OSSL_MAC_PARAM_TLS_DATA_SIZE) <unsigned integer>
  • "key-check" (OSSL_MAC_PARAM_FIPS_KEY_CHECK) <integer> — See "Mac Parameters" in provider-mac(7). (These last two are grouped together in the original, so we're keeping them together, periodt.)
Ngl, those two deprecated flags (digest-noinit and digest-oneshot) are gonna get yeeted in a future release. Set them if you want, but they're literally being ignored right now. Don't build your whole personality on them. 😭

The following parameters can be retrieved with EVP_MAC_CTX_get_params():

  • "size" (OSSL_MAC_PARAM_SIZE) <unsigned integer> — The "size" parameter can also be retrieved with EVP_MAC_CTX_get_mac_size(). The length of the "size" parameter is equal to that of an unsigned int. Two ways in, same answer, we love efficiency. ⭐
  • "block-size" (OSSL_MAC_PARAM_BLOCK_SIZE) <unsigned integer> — Gets the MAC block size. The "block-size" parameter can also be retrieved with EVP_MAC_CTX_get_block_size(). Again: double the doorways, zero the drama. 🦋
  • "fips-indicator" (OSSL_MAC_PARAM_FIPS_APPROVED_INDICATOR) <integer> — See "Mac Parameters" in provider-mac(7). 👑

🦋 SEE ALSO 🦋

Go touch these, bestie — they're all in the friend group:

Copyright 2018-2026 The OpenSSL Project Authors. All Rights Reserved. 💜

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

Okay so that's the whole page, mwah 💅 — this was OpenSSL 3.5.9, dated 2026-09-29, and yes the manual name is EVP_MAC-HMAC(7ossl), we just folded it in at the top so it didn't have to sit through the whole read. Byeee 🎀✨🫶

📦 where this page comes from