EVP_KDF-HMAC-DRBG(7SSL)

📦
version 4.0.3 · 6 versions
, in ubuntu stonking

💖 EVP_KDF-HMAC-DRBG 💖

okay bestie, welcome to the EVP_KDF-HMAC-DRBG page — she's manual section 7SSL, and she is the HMAC DRBG DETERMINISTIC EVP_KDF implementation. yes that's a mouthful. we love her anyway 🫶

✨ NAME ✨

EVP_KDF-HMAC-DRBG — the HMAC DRBG DETERMINISTIC EVP_KDF implementation 💅

🌸 DESCRIPTION 🌸

so like, this is support for a deterministic HMAC DRBG using the EVP_KDF API. she's giving very similar energy to EVP_RAND-HMAC-DRBG(7), except she uses fixed values for her entropy and nonce values. no random girlies here, everything is locked in 🔒✨

and why do we care?? because this is what generates the deterministic nonce value that ECDSA and DSA need (as defined in RFC 6979). periodt. 📜

🎀 Identity 🎀

"HMAC-DRBG-KDF" is the name for this implementation — that's her government name, bestie. you can use it with the EVP_KDF_fetch() function. 🪪

🦋 Supported parameters 🦋

here's the roster of supported parameters, no gatekeeping:

  • "digest" (OSSL_DRBG_PARAM_DIGEST) <UTF8 string> — yes babes, the digest
  • "properties" (OSSL_DRBG_PARAM_PROPERTIES) <UTF8 string> — and the properties

these two parameters work exactly as described in "PARAMETERS" in EVP_KDF(3). iykyk 💅

  • "entropy" (OSSL_KDF_PARAM_HMACDRBG_ENTROPY) <octet string> — sets the entropy bytes supplied to the HMAC-DRBG. handing her the vibes, literally 🌈
  • "nonce" (OSSL_KDF_PARAM_HMACDRBG_NONCE) <octet string> — sets the nonce bytes supplied to the HMAC-DRBG. the nonce!! iconic 🎀

💀 NOTES 💀

you can get yourself a context for KDF HMAC DRBG by calling this, copy it exactly bestie:

EVP_KDF *kdf = EVP_KDF_fetch(NULL, "HMAC-DRBG-KDF", NULL);
EVP_KDF_CTX *kdf_ctx = EVP_KDF_CTX_new(kdf, NULL);

slay. that's it. that's the note. 🫶

👑 CONFORMING TO 👑

RFC 6979 — she's certified, she's official, she read the standards so you don't have to 📜✨

🌟 SEE ALSO 🌟

go read those too, bestie, they're the supporting cast 💜

🧚 HISTORY 🧚

the EVP_KDF-HMAC-DRBG functionality was added in OpenSSL 3.2. so if you're on anything older, she simply does not exist yet — not me finding out the hard way 😭

Copyright 2022-2023 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

legal girlies stay winning, always read the license fr fr 💅

and that's the whole page, bestie!! 🌈 this was OpenSSL version 4.0.3, dated 2026-09-29, sitting pretty in section 7SSL of the manual. mwah, go forth and generate deterministic nonces responsibly 🎀💖✨

📦 where this page comes from