EVP_KDF-KB(7SSL)

📦

version 4.0.3 · 13 versions

💖 EVP_KDF-KB — the Key-Based EVP_KDF implementation 💖

okay bestie, this is EVP_KDF-KB from the OpenSSL manuals (yes, 7SSL, the fancy section 7 one) and it's genuinely one of the good ones. buckle up 🎀

✨ NAME ✨

EVP_KDF-KB — literally just: the Key-Based EVP_KDF implementation. that's the whole name. short. iconic. 💅

🌸 DESCRIPTION 🌸

so the EVP_KDF-KB algorithm is the Key-Based key derivation function, aka KBKDF for the girlies who like acronyms. what KBKDF does is derive a key by repeatedly applying a keyed MAC to an input secret (and some other optional values, because we love options 🫶).

the output? it's considered to be keying material. yes queen, that's the whole point.

🦋 Identity 🦋

the name for this implementation is "KBKDF" — that's the string you pass. it can be used with the EVP_KDF_fetch() function. that's it, that's the identity, no cap.

👑 Supported parameters 👑

here's the whole roster, no skips, no cuts:

"mode" (OSSL_KDF_PARAM_MODE) <UTF8 string> — this one picks which flavor of KBKDF you want. right now your choices are "counter" and "feedback". "counter" is the default and it'll be used if you don't say anything. she's the main character mode fr.
"mac" (OSSL_KDF_PARAM_MAC) <UTF8 string> — the value is either CMAC, HMAC, KMAC128 or KMAC256.
"digest" (OSSL_KDF_PARAM_DIGEST) <UTF8 string>
"cipher" (OSSL_KDF_PARAM_CIPHER) <UTF8 string>
"properties" (OSSL_KDF_PARAM_PROPERTIES) <UTF8 string>
"key" (OSSL_KDF_PARAM_KEY) <octet string>
"salt" (OSSL_KDF_PARAM_SALT) <octet string>
"info (OSSL_KDF_PARAM_INFO) <octet string> — (yes the quote is missing in the original, i'm keeping it exactly like that, we don't fix the source, we respect the source 😭)
"seed" (OSSL_KDF_PARAM_SEED) <octet string> — bestie, heads up: the seed parameter is unused in counter mode. it's just sitting there, chilling.
"use-l" (OSSL_KDF_PARAM_KBKDF_USE_L) <integer> — set it to 0 to disable use of the optional Fixed Input data 'L' (see SP800-108). if you say nothing, the default value of 1 is used.
"use-separator" (OSSL_KDF_PARAM_KBKDF_USE_SEPARATOR) <integer> — set it to 0 to disable use of the optional Fixed Input data 'zero separator' (see SP800-108) that gets placed between the Label and Context. default value 1 if unspecified.
"r" (OSSL_KDF_PARAM_KBKDF_R) <integer> — sets the fixed value 'r', which indicates the length of the counter in bits. supported values are 8, 16, 24, and 32. the default value of 32 is used if you don't specify.

and the OpenSSL FIPS provider ALSO supports these two, extra special:

"fips-indicator" (OSSL_KDF_PARAM_FIPS_APPROVED_INDICATOR) <integer> — this one's a getter that returns 1 if the operation is FIPS approved, or 0 otherwise. you can use it after calling EVP_KDF_derive. it returns 0 if "key-check" is set to 0 and the check fails.
"key-check" (OSSL_KDF_PARAM_FIPS_KEY_CHECK) <integer> — the default value of 1 causes an error during EVP_KDF_CTX_set_params() if the length of the used key-derivation key (OSSL_KDF_PARAM_KEY) is shorter than 112 bits. setting this to zero will ignore the error and set the approved "fips-indicator" to 0.

⚠️ real talk: this option breaks FIPS compliance if it causes the approved "fips-indicator" to return 0. setting it isn't a vibe, it's a choice. choose wisely 💀

depending on whether mac is CMAC or HMAC, either digest or cipher is required (respectively) and the other one is unused. and for KMAC128 and KMAC256? both of them are unused. they simply don't get invited.

the parameters key, salt, info, and seed correspond to KI, Label, Context, and IV (respectively) in SP800-108. and, as in that document, salt, info, and seed are optional and may be omitted. slay, optionality.

"mac", "digest", cipher" and "properties" are described in "PARAMETERS" in EVP_KDF(3).

🌈 NOTES 🌈

okay so to get a context for KBKDF you call:

 EVP_KDF *kdf = EVP_KDF_fetch(NULL, "KBKDF", NULL);
 EVP_KDF_CTX *kctx = EVP_KDF_CTX_new(kdf);

the output length of a KBKDF is specified via the "keylen" parameter to the EVP_KDF_derive(3) function. remember that. "keylen". it's the length. of the output. 💖

also, ngl, currently OpenSSL only implements counter and feedback modes. other variants may be supported in the future — so like, watch this space, but today's menu is those two.

🍓 EXAMPLES 🍓

example one: 10 bytes, `COUNTER-HMAC-SHA256` 🌸

this one derives 10 bytes using COUNTER-HMAC-SHA256, with KI "secret", Label "label", and Context "context". so cute, so simple.

 EVP_KDF *kdf;
 EVP_KDF_CTX *kctx;
 unsigned char out[10];
 OSSL_PARAM params[6], *p = params;

 kdf = EVP_KDF_fetch(NULL, "KBKDF", NULL);
 kctx = EVP_KDF_CTX_new(kdf);
 EVP_KDF_free(kdf);

 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
                                         "SHA2-256", 0);
 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_MAC,
                                         "HMAC", 0);
 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY,
                                          "secret", strlen("secret"));
 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SALT,
                                          "label", strlen("label"));
 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_INFO,
                                          "context", strlen("context"));
 *p = OSSL_PARAM_construct_end();
 if (EVP_KDF_derive(kctx, out, sizeof(out), params) <= 0)
     error("EVP_KDF_derive");

 EVP_KDF_CTX_free(kctx);

example two: 10 bytes, `FEEDBACK-CMAC-AES256` 🔥

this one derives 10 bytes using FEEDBACK-CMAC-AES256, with KI "secret", Label "label", and IV "sixteen bytes iv".

 EVP_KDF *kdf;
 EVP_KDF_CTX *kctx;
 unsigned char out[10];
 OSSL_PARAM params[8], *p = params;
 unsigned char *iv = "sixteen bytes iv";

 kdf = EVP_KDF_fetch(NULL, "KBKDF", NULL);
 kctx = EVP_KDF_CTX_new(kdf);
 EVP_KDF_free(kdf);

 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_CIPHER, "AES256", 0);
 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_MAC, "CMAC", 0);
 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_MODE, "FEEDBACK", 0);
 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY,
                                          "secret", strlen("secret"));
 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SALT,
                                          "label", strlen("label"));
 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_INFO,
                                          "context", strlen("context"));
 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SEED,
                                          iv, strlen(iv));
 *p = OSSL_PARAM_construct_end();
 if (EVP_KDF_derive(kctx, out, sizeof(out), params) <= 0)
     error("EVP_KDF_derive");

 EVP_KDF_CTX_free(kctx);

🧚 CONFORMING TO 🧚

NIST SP800-108, IETF RFC 6803, IETF RFC 8009. certified. standards girlie. 👑

⭐ SEE ALSO ⭐

go read those too, iykyk 💜

🎀 HISTORY 🎀

this functionality was added in OpenSSL 3.0.

support for KMAC was added in OpenSSL 3.1.

💅 COPYRIGHT 💅

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

and that's the whole page bestie!! this was 4.0.3 2026-09-29 EVP_KDF-KB(7SSL) and she ate, fr fr 🫶💖✨

📦 where this page comes from

ubuntu stonking: openssl 4.0.3-1ubuntu1
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash on 2026-11-03: a language model's rewrite of the original, under its terms