EVP_KEYEXCH-ECDH(7SSL)

📦
version 4.0.3 · 13 versions
, in ubuntu stonking

💖 EVP_KEYEXCH-ECDH — ECDH Key Exchange algorithm support 💖

okay bestie, welcome to the EVP_KEYEXCH-ECDH(7SSL) page from the OpenSSL manual 🌸 this is your girl explaining elliptic curve key exchange like we're texting at 1am. buckle up 🦋

✨ NAME ✨

EVP_KEYEXCH-ECDH — ECDH Key Exchange algorithm support 👑

🎀 DESCRIPTION 🎀

So basically: this is key exchange support for the ECDH key type. that's the whole vibe 💅

This algorithm does ECDH key agreement for general elliptic curves. if you're looking for the special glow-up support for the X25519 and X448 curves, that lives in its own pages: EVP_KEYEXCH-X25519(7) and EVP_KEYEXCH-X448(7). different queens, different rules 💜

Now, per RFC 8998 <https://www.rfc-editor.org/rfc/rfc8998.html>, when curveSM2 is the negotiated key agreement group in TLS, ECDH shared secret derivation gets used instead of the normal key agreement protocol (KAP) that the "GB/T 32918.3-2016" standard specifies for the SM2 elliptic curve. this SM2 key agreement variant also gets called "ECDH over SM2" sometimes. and listen — when a curveSM2 key is generated or imported, the EC group name parameter you specify stays "SM2". the resulting curveSM2 key can only be used for "ECDH over SM2" key agreement. also "ECDH over SM2" is TLS-specific, so it should not be used in other protocols unless there's an actual specification saying it's fine in that protocol. no freelancing, babe 🙈

The curveSM2MLKEM768 hybrid post-quantum key exchange algorithm uses "ECDH over SM2" for its "classical" component. cute crossover episode ✨

🌈 ECDH Key Exchange parameters 🌈

  • "ecdh-cofactor-mode" (OSSL_EXCHANGE_PARAM_EC_ECDH_COFACTOR_MODE) &lt;integer&gt; — sets or gets the ECDH mode of operation for the associated key exchange ctx. 💫

In an Elliptic Curve Diffie-Hellman key exchange context, this parameter is what you use to pick between the plain Diffie-Hellman (DH) variant or the Cofactor Diffie-Hellman (CDH) variant of the key exchange algorithm.

When setting, the value should be 1, 0 or -1, which respectively force cofactor mode on, off, or reset it to the default for the private key associated with the given key exchange ctx.

When getting, the value should be either 1 or 0, which respectively signals whether cofactor mode is on or off.

oh also — peek at provider-keymgmt(7) for the related OSSL_PKEY_PARAM_USE_COFACTOR_ECDH parameter, which can be set on a per-key basis 👀

  • "kdf-type" (OSSL_EXCHANGE_PARAM_KDF_TYPE) &lt;UTF8 string&gt;
  • "kdf-digest" (OSSL_EXCHANGE_PARAM_KDF_DIGEST) &lt;UTF8 string&gt;
  • "kdf-digest-props" (OSSL_EXCHANGE_PARAM_KDF_DIGEST_PROPS) &lt;UTF8 string&gt;
  • "kdf-outlen" (OSSL_EXCHANGE_PARAM_KDF_OUTLEN) &lt;unsigned integer&gt;
  • "kdf-ukm" (OSSL_EXCHANGE_PARAM_KDF_UKM) &lt;octet string&gt;

The OpenSSL FIPS provider also supports these parameters, bestie:

  • "fips-indicator" (OSSL_EXCHANGE_PARAM_FIPS_APPROVED_INDICATOR) &lt;integer&gt;
  • "key-check" (OSSL_EXCHANGE_PARAM_FIPS_KEY_CHECK) &lt;integer&gt;
  • "digest-check" (OSSL_EXCHANGE_PARAM_FIPS_DIGEST_CHECK) &lt;integer&gt;

→ go read "Common Key Exchange parameters" in provider-keyexch(7) for these 💜

  • "ecdh-cofactor-check" (OSSL_EXCHANGE_PARAM_FIPS_ECDH_COFACTOR_CHECK) &lt;integer&gt; — if it's required, this parameter should be set before OSSL_FUNC_keyexch_derive(). the default value of 1 causes an error during the OSSL_FUNC_keyexch_derive if the EC curve has a cofactor that is not 1, and the cofactor is not used. setting this to 0 will ignore the error and set the approved "fips-indicator" to 0. 🚨 heads up: this option breaks FIPS compliance if it makes the approved "fips-indicator" return 0.

🧚 EXAMPLES 🧚

Examples of key agreement can be found in demos/keyexch 📂

Keys for the host and peer must be generated as shown in "Examples" in EVP_PKEY-EC(7), and they have to use the same curve name. twin keys, twin energy 🫶

The code to generate a shared secret for the normal case is identical to "Examples" in EVP_KEYEXCH-DH(7).

To derive a shared secret on the host using the host's key and the peer's public key, but also using X963KDF with a user key material:

/* It is assumed that the host_key, peer_pub_key and ukm are set up */
void derive_secret(EVP_PKEY *host_key, EVP_PKEY *peer_key,
                   unsigned char *ukm, size_t ukm_len)
{
    unsigned char secret[64];
    size_t out_len = sizeof(secret);
    size_t secret_len = out_len;
    unsigned int pad = 1;
    OSSL_PARAM params[6];
    EVP_PKEY_CTX *dctx = EVP_PKEY_CTX_new_from_pkey(NULL, host_key, NULL);

    EVP_PKEY_derive_init(dctx);

    params[0] = OSSL_PARAM_construct_uint(OSSL_EXCHANGE_PARAM_PAD, &pad);
    params[1] = OSSL_PARAM_construct_utf8_string(OSSL_EXCHANGE_PARAM_KDF_TYPE,
                                                 "X963KDF", 0);
    params[2] = OSSL_PARAM_construct_utf8_string(OSSL_EXCHANGE_PARAM_KDF_DIGEST,
                                                 "SHA1", 0);
    params[3] = OSSL_PARAM_construct_size_t(OSSL_EXCHANGE_PARAM_KDF_OUTLEN,
                                            &out_len);
    params[4] = OSSL_PARAM_construct_octet_string(OSSL_EXCHANGE_PARAM_KDF_UKM,
                                                  ukm, ukm_len);
    params[5] = OSSL_PARAM_construct_end();
    EVP_PKEY_CTX_set_params(dctx, params);

    EVP_PKEY_derive_set_peer(dctx, peer_pub_key);
    EVP_PKEY_derive(dctx, secret, &secret_len);
    ...
    OPENSSL_clear_free(secret, secret_len);
    EVP_PKEY_CTX_free(dctx);
}

ate that code, no crumbs 🔥

👑 SEE ALSO 👑

EVP_PKEY-EC(7) EVP_PKEY(3), provider-keyexch(7), provider-keymgmt(7), OSSL_PROVIDER-default(7), OSSL_PROVIDER-FIPS(7),

💀 HISTORY 💀

Support for "ECDH over SM2" via curveSM2 was added in OpenSSL 4.0. new era, new curve ✨

Copyright 2020-2026 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

and that's the whole page bestie!! 🌟 this was version 4.0.3, dated 2026-09-29, and it's the EVP_KEYEXCH-ECDH(7SSL) page — go forth and derive those secrets safely, mwah 💖💅🌸

📦 where this page comes from