EVP_KDF-SNMPKDF(7SSL)

📦
version 4.0.3 · 2 versions
, in ubuntu stonking

✨ EVP_KDF-SNMPKDF 💅

okay bestie so like, the manual name situation: this whole thing lives in section 7SSL of the OpenSSL docs, and it's called EVP_KDF-SNMPKDF. yes it's a mouthful. we move anyway 🫶

💖 NAME 💖

EVP_KDF-SNMPKDF — the SNMPKDF EVP_KDF implementation. that's it, that's the name, iconic.

🌸 DESCRIPTION 🌸

so like. this page is all about computing the SNMPKDF KDF through the EVP_KDF API. slay.

the EVP_KDF-SNMPKDF algorithm implements the SNMPKDF key derivation function (KDF, the acronym, we love her 💅). it's defined all the way in RFC 3414, appendix A.2.2, and SNMP uses it to derive encryption keys. so yes it's kind of a big deal.

to actually perform key derivation you need three inputs, and not in a "pick two" way, you need all of them:

  • the hashing function (for example SHA1)
  • the engine ID
  • and the password 🍓

👑 Identity

"SNMPKDF" is the name for this implementation. that's the string you feed to EVP_KDF_fetch() when you want her. remember it, it's literally the whole doorway.

⭐ Supported parameters

here's the menu, lowercase-bestie voice, everything included:

  • "properties" (OSSL_KDF_PARAM_PROPERTIES) <UTF8 string> — works exactly as described in "PARAMETERS" in EVP_KDF(3), no notes.
  • "digest" (OSSL_KDF_PARAM_DIGEST) <UTF8 string> — same deal, described over in "PARAMETERS" in EVP_KDF(3).
  • "pass" (OSSL_KDF_PARAM_PASSWORD) <octet string> — also described in "PARAMETERS" in EVP_KDF(3).
  • "eid" (OSSL_KDF_PARAM_SNMPKDF_EID) <octet string> — this one sets the snmpEngineID value for the KDF. heads up: if a value is already set, the contents get replaced. no merging, no vibes, just replaced. 🙈
  • "fips-indicator" (OSSL_KDF_PARAM_FIPS_APPROVED_INDICATOR) <integer> — the OpenSSL FIPS provider returns 1 if the operation is FIPS approved, or 0 otherwise. want more lore? see "FIPS indicators" in fips_module(7). 📚

🦋 NOTES 🦋

want a context for SNMPKDF? you get one like this, periodt:

EVP_KDF *kdf = EVP_KDF_fetch(NULL, "SNMPKDF", NULL);
EVP_KDF_CTX *kctx = EVP_KDF_CTX_new(kdf);

now the important math-y tea ☕: the expected length of the SNMPKDF derivation output is the size of the digest. the SNMPKDF output length can vary depending on which digest you used, so your move as the caller is to allocate a buffer of the digest size and pass that buffer into the EVP_KDF_derive(3) function along with the expected length. don't fight it, just allocate the right size bestie 💖

💀 EXAMPLES 💀

okay so this example derives an 8 byte IV using SHA1, with a 1K "key" and the appropriate "xcghash" and "session_id" values. yep, that's what the original says, we are simply passing the message. 🎀

EVP_KDF *kdf;
EVP_KDF_CTX *kctx;
unsigned char eid[1024] = "01234...";
unsigned char pass[32] = "012345...";
unsigned char out[20];
size_t outlen = sizeof(out);
OSSL_PARAM params[6], *p = params;

kdf = EVP_KDF_fetch(NULL, "SNMPKDF", NULL);
kctx = EVP_KDF_CTX_new(kdf);
EVP_KDF_free(kdf);

*p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
                                        SN_sha1, strlen(SN_sha1));
*p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_PASSWORD,
                                         pass, sizeof(pass));
*p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SNMPKDF_EID,
                                         eid, sizeof(eid));
*p = OSSL_PARAM_construct_end();
if (EVP_KDF_derive(kctx, out, outlen, params) <= 0)
    /* Error */

🌈 CONFORMING TO 🌈

yes she's standards-compliant, we love a certified queen ✨

🧚 SEE ALSO 🧚

⭐ HISTORY ⭐

this functionality was added in OpenSSL 4.0. brand new, freshly dropped, main character energy 👑

Copyright 2025-2026 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

and that's the whole page bestie, no cap 💅 this was EVP_KDF-SNMPKDF(7SSL) from the OpenSSL fam, version 4.0.3, dated 2026-09-29. go derive something iconic, ily, drink water 🌸🫶

📦 where this page comes from