EVP_MAC-HMAC(7SSL)

📦
version 4.0.3 · 13 versions
, in ubuntu stonking

✨ EVP_MAC-HMAC ✨

okay bestie, welcome to the EVP_MAC-HMAC glow-up 💅 — that's the manual page, and we're hanging out in section 7SSL (the SSL-flavoured part of the man pages, iykyk). no cap, this one's short and sweet.

🌸 NAME 🌸

EVP_MAC-HMAC — the whole entire HMAC implementation for EVP_MAC 🫶

💖 DESCRIPTION 💖

so basically, this is the thing that lets you compute HMAC MACs through the EVP_MAC API. that's it, that's the vibe.

and the way it works under the hood? this implementation uses EVP_MD functions to get at the underlying digest. cute, right? 🎀

🦋 Identity 🦋

when you're fetching this implementation with EVP_MAC_fetch(), this is the name and properties combo that identifies it:

"HMAC", "provider=default" or "provider=fips"

no notes. slay. ✨

👑 Supported parameters 👑

the general rundown of how these parameters work lives in "PARAMETERS" in EVP_MAC(3) — go peek at that if you want the big picture, bestie.

here's what you can set with EVP_MAC_CTX_set_params():

  • "key" (OSSL_MAC_PARAM_KEY) <octet string> — sets the MAC key. setting this parameter is literally identical to passing a key to EVP_MAC_init(3). same thing, no difference, periodt. 💅
  • "digest" (OSSL_MAC_PARAM_DIGEST) <UTF8 string> — sets the name of the underlying digest you wanna use. ⭐
  • "properties" (OSSL_MAC_PARAM_PROPERTIES) <UTF8 string> — sets the properties that get queried when it tries to fetch the underlying digest. ⚠️ important: this one must be given together with the digest naming parameter ("digest", or OSSL_MAC_PARAM_DIGEST) for it to even be considered valid. no digest param, no deal.
  • "digest-noinit" (OSSL_MAC_PARAM_DIGEST_NOINIT) <integer> — a flag to set the MAC digest to not initialise the implementation specific data. it expects the value 0 or 1. 🚨 this option is deprecated and will be removed in a future release. you may set it, but rn it's currently ignored. 💀
  • "digest-oneshot" (OSSL_MAC_PARAM_DIGEST_ONESHOT) <integer> — a flag to set the MAC digest to be a one-shot operation. agai, it expects 0 or 1. 🚨 this option is deprecated and will be removed in a future release. it may be set but is currently ignored.
bestie pls note: that last bit about 0 or 1 is on the digest-noinit flag, and yes — "agai" above was a typo of "again", but the "may be set but is currently ignored" energy applies to both of these deprecated flags. 🫶
  • "tls-data-size" (OSSL_MAC_PARAM_TLS_DATA_SIZE) <unsigned integer>
  • "key-check" (OSSL_MAC_PARAM_FIPS_KEY_CHECK) <integer>
for those last two — "tls-data-size" and "key-check" — see "Mac Parameters" in provider-mac(7). that's where the tea is. 🍓

and here's what you can retrieve with EVP_MAC_CTX_get_params():

  • "size" (OSSL_MAC_PARAM_SIZE) <unsigned integer> — fyi you can also grab this "size" parameter with EVP_MAC_CTX_get_mac_size(). and the length of the "size" parameter is equal to that of an unsigned int. 🔥
  • "block-size" (OSSL_MAC_PARAM_BLOCK_SIZE) <unsigned integer> — gets the MAC block size. and yes, the "block-size" parameter can also be retrieved with EVP_MAC_CTX_get_block_size(). double the access, double the fun. 💜
  • "fips-indicator" (OSSL_MAC_PARAM_FIPS_APPROVED_INDICATOR) <integer> — see "Mac Parameters" in provider-mac(7). 🌈

🎀 SEE ALSO 🎀

go read these too, bestie, they're all linked up:

Copyright 2018-2026 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

and that's the whole page, bestie!! 🫶 this was version 4.0.3, dated 2026-09-29, filed under EVP_MAC-HMAC(7SSL) — iconic behavior, honestly. go forth and HMAC responsibly ✨💖👑

📦 where this page comes from