EVP_PKEY-HMAC(7SSL)

📦
version 4.0.3 · 13 versions
, in ubuntu stonking

💖 EVP_PKEY-HMAC — the legacy MAC keytypes, but make it a group chat 💖

okay so bestie, this is the EVP_PKEY-HMAC(7SSL) page from the OpenSSL manual — and it's literally about a whole little squad of legacy MAC keytypes. So sit down, grab a boba, and let me tell you about EVP_PKEY-HMAC, EVP_KEYMGMT-HMAC, EVP_PKEY-Siphash, EVP_KEYMGMT-Siphash, EVP_PKEY-Poly1305, EVP_KEYMGMT-Poly1305, EVP_PKEY-CMAC and EVP_KEYMGMT-CMAC. Yes that's a lot of names, no I'm not typing them again, they're all one vibe: EVP_PKEY legacy MAC keytypes and algorithm support ✨

🌸 DESCRIPTION 🌸

So here's the tea 🍓: the HMAC and CMAC key types live inside OpenSSL's default and FIPS providers. And on top of that, the Siphash and Poly1305 key types are implemented in the default provider.

Now the important part, bestie, listen up 👂 — doing MAC operations through an EVP_PKEY is considered legacy. It's only there for backwards compatibility purposes and only for a restricted set of algorithms. The preferred way of doing MAC operations is through the EVP_MAC APIs. Go look at EVP_MAC_init(3), she's the icon here 💅

Wanna know more about using EVP_PKEY-based MAC keys? The girls have their own pages: EVP_SIGNATURE-HMAC(7), EVP_SIGNATURE-Siphash(7), EVP_SIGNATURE-Poly1305(7) and EVP_SIGNATURE-CMAC(7). Slay 🎀

💜 Common MAC parameters 💜

Every single one of these MAC keytypes supports the following parameters, no cap:

  • "priv" (OSSL_PKEY_PARAM_PRIV_KEY) <octet string> — the MAC key value itself. That's the secret, bestie, protect it 🫶
  • "properties" (OSSL_PKEY_PARAM_PROPERTIES) <UTF8 string> — a property query string that gets used whenever any algorithms are fetched. It's giving ✨*algorithm vibes selector*✨.

🦋 CMAC parameters 🦋

And as well as everything above, the CMAC keytype is extra and additionally supports this one:

  • "cipher" (OSSL_PKEY_PARAM_CIPHER) <UTF8 string> — the name of a cipher to be used when generating the MAC 🔐

🌈 Common MAC key generation parameters 🌈

okay so MAC key generation is lowkey unusual — no new key is actually generated. Not even kidding. Instead, a new provider-side key object gets created with the raw key value you supplied. Why? For backwards compatibility with previous versions of OpenSSL, periodt 💀

  • "priv" (OSSL_PKEY_PARAM_PRIV_KEY) <octet string> — the MAC key value. Yeah it's the same one. She's consistent, we respect her 💖

🎀 CMAC key generation parameters 🎀

On top of the common MAC key generation parameters, the CMAC key generation additionally recognises this:

  • "cipher" (OSSL_PKEY_PARAM_CIPHER) <UTF8 string> — the name of a cipher to be used when generating the MAC 🔥

👑 MAC key generation FIPS indicator 👑

This next key generation parameter can be retrieved with EVP_PKEY_CTX_get_params(3) for HMAC and CMAC in the OpenSSL FIPS provider:

  • "fips-indicator" (OSSL_PKEY_PARAM_FIPS_APPROVED_INDICATOR) <integer> — returns 1 if the operation is FIPS approved, or 0 otherwise. Peep "FIPS indicators" in fips_module(7) for more info 🧚

✨ SEE ALSO ✨

Go read your sisters, bestie, iykyk:

💀 HISTORY 💀

RIP to a real one: the CMAC parameter engine (OSSL_PKEY_PARAM_ENGINE) was removed in OpenSSL 4.0. She's gone, she's not coming back, we mourn 🙈

Copyright 2020-2026 The OpenSSL Project Authors. All Rights Reserved. 💖

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

and that's the whole page, bestie!! 🫶 this was OpenSSL version 4.0.3, dated 2026-09-29 — thanks for reading, mwah, go use EVP_MAC instead, ily 💅✨🌸

📦 where this page comes from