EVP_KDF-TLS1_PRF(7SSL)

📦
version 4.0.3 · 13 versions
, in ubuntu stonking

✨ NAME ✨

EVP_KDF-TLS1_PRF — the TLS1 PRF EVP_KDF implementation, bestie 💖 (this is the 7SSL manual page, btw, so you know exactly where you are)

🦋 DESCRIPTION 🦋

So basically: this is support for computing the TLS1 PRF through the EVP_KDF API. 💅

The EVP_KDF-TLS1_PRF algorithm implements the PRF used by TLS versions up to and including TLS 1.2. That's right, we're doing the classics. 🌸

And the output? It's considered to be keying material. Periodt. 👑

🎀 Identity

"TLS1-PRF" is the name for this implementation — like, that's the whole government name, okay? You can use it with the EVP_KDF_fetch() function. 🫶

🌈 Supported parameters

Here's the menu of supported parameters, and yes we're listing every single one, no skipping, that's the rules 😤:

  • "properties" (OSSL_KDF_PARAM_PROPERTIES) <UTF8 string> — and also "digest" (OSSL_KDF_PARAM_DIGEST) <UTF8 string> — these two work exactly as described in "PARAMETERS" in EVP_KDF(3), no cap.

The OSSL_KDF_PARAM_DIGEST parameter is the one that sets the message digest associated with the TLS PRF. Lowkey special case alert 🚨: EVP_md5_sha1() is treated as a special case which uses the PRF algorithm using both MD5 and SHA1 as used in TLS 1.0 and 1.1. Iconic behavior, honestly.

  • "secret" (OSSL_KDF_PARAM_SECRET) <octet string> — this one sets the secret value of the TLS PRF. Heads up: any existing secret value gets replaced. Not merged, not combined — replaced. Bye to the old one 💀
  • "seed" (OSSL_KDF_PARAM_SEED) <octet string> — this sets the context seed. The length of the context seed cannot exceed 1024 bytes. And fr fr, that should be more than enough for any normal use of the TLS PRF. Don't be extra. 🙈

The OpenSSL FIPS provider also supports the following parameters, and these are giving very serious compliance energy:

  • "fips-indicator" (OSSL_KDF_PARAM_FIPS_APPROVED_INDICATOR) <integer> — a getter that returns 1 if the operation is FIPS approved, or 0 otherwise. You can use this after calling EVP_KDF_derive. It returns 0 if any "***-check" related parameter is set to 0 and the check fails. 👀
  • "ems_check" (OSSL_KDF_PARAM_FIPS_EMS_CHECK) <integer> — the default value of 1 causes an error during EVP_KDF_derive() if "master secret" is used instead of "extended master secret". Setting this to zero will ignore the error and set the approved "fips-indicator" to 0. And listen — this option breaks FIPS compliance if it causes the approved "fips-indicator" to return 0. So like, choose wisely bestie 😭
  • "digest-check" (OSSL_KDF_PARAM_FIPS_DIGEST_CHECK) <integer> — the default value of 1 causes an error during EVP_KDF_CTX_set_params() if the used digest is not approved. Setting this to zero will ignore the error and set the approved "fips-indicator" to 0. Again: this option breaks FIPS compliance if it causes the approved "fips-indicator" to return 0. 🙃

According to SP 800-135r1, the following are approved digest algorithms: SHA2-256, SHA2-384, SHA2-512. Those three. That's the whole approved squad. ⭐

  • "key-check" (OSSL_KDF_PARAM_FIPS_KEY_CHECK) <integer> — the default value of 1 causes an error during EVP_KDF_CTX_set_params() if the length of used key-derivation key (OSSL_KDF_PARAM_SECRET) is shorter than 112 bits. Setting this to zero will ignore the error and set the approved "fips-indicator" to 0. And yep, you guessed it: this option breaks FIPS compliance if it causes the approved "fips-indicator" to return 0. 💅

🌸 NOTES 🌸

You can get yourself a context for the TLS PRF by calling this, okay? Copy it down:

EVP_KDF *kdf = EVP_KDF_fetch(NULL, "TLS1-PRF", NULL);
EVP_KDF_CTX *kctx = EVP_KDF_CTX_new(kdf);

The digest, the secret value and the seed must be set before a key is derived — otherwise an error will occur. No exceptions, no vibes-based shortcuts. 🚫

Also the output length of the PRF is specified by the keylen parameter to the EVP_KDF_derive() function. That's where you tell it how much you want. 💖

🔥 EXAMPLES 🔥

Okay so this example derives 10 bytes using SHA-256 with the secret key "secret" and seed value "seed". Look at her go 👑

EVP_KDF *kdf;
EVP_KDF_CTX *kctx;
unsigned char out[10];
OSSL_PARAM params[4], *p = params;

kdf = EVP_KDF_fetch(NULL, "TLS1-PRF", NULL);
kctx = EVP_KDF_CTX_new(kdf);
EVP_KDF_free(kdf);

*p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
                                        SN_sha256, strlen(SN_sha256));
*p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SECRET,
                                         "secret", (size_t)6);
*p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SEED,
                                         "seed", (size_t)4);
*p = OSSL_PARAM_construct_end();
if (EVP_KDF_derive(kctx, out, sizeof(out), params) <= 0) {
    error("EVP_KDF_derive");
}
EVP_KDF_CTX_free(kctx);

💜 CONFORMING TO 💜

RFC 2246, RFC 5246 and NIST SP 800-135 r1. She's certified, she's spec-compliant, she read the docs. 📚✨

🐚 SEE ALSO 🐚

Go read these too, they're all part of the squad:

⭐ HISTORY ⭐

This functionality was added in OpenSSL 3.0. So it's not ancient history, it's just iconic history. 💫

Copyright 2018-2024 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

And that's the whole page, bestie — this was EVP_KDF-TLS1_PRF(7SSL) from OpenSSL 4.0.3, dated 2026-09-29. Slay, go derive some keying material responsibly 🎀💖✨

📦 where this page comes from