EVP_RAND-CTR-DRBG(7SSL)

📦
version 4.0.3 · 13 versions
, in ubuntu stonking

✨ EVP_RAND-CTR-DRBG 💅

okay bestie so this is the page about EVP_RAND-CTR-DRBG, which lives in the 7SSL section of the OpenSSL docs, and it's literally all about the counter deterministic random bit generator. yes the name is a mouthful, i know, but stay with me 🌸

🎀 NAME 🎀

EVP_RAND-CTR-DRBG — the CTR DRBG EVP_RAND implementation. that's it, that's the whole vibe 🦋

💖 DESCRIPTION 💖

so basically: support for the counter deterministic random bit generator, all through the EVP_RAND API. it's giving Very Official Cryptography™ and honestly? slay.

🪪 Identity 🪪

"CTR-DRBG" is the name for this implementation. when you need to pull it up, you use the EVP_RAND_fetch() function. remember the name, it's the whole personality 🔑

🌈 Supported parameters 🌈

these are the parameters that lowkey make it go:

  • "state" (OSSL_RAND_PARAM_STATE) <integer>
  • "strength" (OSSL_RAND_PARAM_STRENGTH) <unsigned integer>
  • "max_request" (OSSL_RAND_PARAM_MAX_REQUEST) <unsigned integer>
  • "reseed_requests" (OSSL_DRBG_PARAM_RESEED_REQUESTS) <unsigned integer>
  • "reseed_time_interval" (OSSL_DRBG_PARAM_RESEED_TIME_INTERVAL) <integer>
  • "min_entropylen" (OSSL_DRBG_PARAM_MIN_ENTROPYLEN) <unsigned integer>
  • "max_entropylen" (OSSL_DRBG_PARAM_MAX_ENTROPYLEN) <unsigned integer>
  • "min_noncelen" (OSSL_DRBG_PARAM_MIN_NONCELEN) <unsigned integer>
  • "max_noncelen" (OSSL_DRBG_PARAM_MAX_NONCELEN) <unsigned integer>
  • "max_perslen" (OSSL_DRBG_PARAM_MAX_PERSLEN) <unsigned integer>
  • "max_adinlen" (OSSL_DRBG_PARAM_MAX_ADINLEN) <unsigned integer>
  • "reseed_counter" (OSSL_DRBG_PARAM_RESEED_COUNTER) <unsigned integer>
  • "properties" (OSSL_DRBG_PARAM_PROPERTIES) <UTF8 string>
  • "cipher" (OSSL_DRBG_PARAM_CIPHER) <UTF8 string>

these ones behave exactly as described in "PARAMETERS" in EVP_RAND(3). no cap, go read that one too 📚

  • "use_derivation_function" (OSSL_DRBG_PARAM_USE_DF) <integer>

this Boolean tells you if a derivation function should be used or not. a nonzero value (which is the default, bestie) uses the derivation function. a zero value does not. simple as that 💅

  • "fips-indicator" (OSSL_DRBG_PARAM_FIPS_APPROVED_INDICATOR) <integer>

the OpenSSL FIPS provider returns 1 if the operation is FIPS approved, or 0 otherwise. peep "FIPS indicators" in fips_module(7) for more info 👑

📝 NOTES 📝

to get yourself a context for CTR DRBG, you call:

EVP_RAND *rand = EVP_RAND_fetch(NULL, "CTR-DRBG", NULL);
EVP_RAND_CTX *rctx = EVP_RAND_CTX_new(rand, NULL);

here's the tea on the default CTR-DRBG implementation: it attempts to fetch the required internal algorithms from the provider they're built into (like the default provider) regardless of the properties provided. but if that provider doesn't implement the required algorithms, then properties get used to find a different implementation. it's giving adaptive ✨

🌟 EXAMPLES 🌟

okay here's a whole little glow-up of how this looks in real code, character for character:

EVP_RAND *rand;
EVP_RAND_CTX *rctx;
unsigned char bytes[100];
OSSL_PARAM params[2], *p = params;
unsigned int strength = 128;

rand = EVP_RAND_fetch(NULL, "CTR-DRBG", NULL);
rctx = EVP_RAND_CTX_new(rand, NULL);
EVP_RAND_free(rand);

*p++ = OSSL_PARAM_construct_utf8_string(OSSL_DRBG_PARAM_CIPHER,
                                        SN_aes_256_ctr, 0);
*p = OSSL_PARAM_construct_end();
EVP_RAND_instantiate(rctx, strength, 0, NULL, 0, params);

EVP_RAND_generate(rctx, bytes, sizeof(bytes), strength, 0, NULL, 0);

EVP_RAND_CTX_free(rctx);

and that's the whole sequence, bestie. fetch, instantiate, generate, free. the full arc 🫶

📜 CONFORMING TO 📜

NIST SP 800-90A and SP 800-90B. certified behavior, we love to see it 💯

👀 SEE ALSO 👀

Copyright 2020-2026 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

and that's a wrap, queen 👑 this was version 4.0.3, dated 2026-09-29, and it's the EVP_RAND-CTR-DRBG(7SSL) page — go forth and generate some random bytes responsibly, mwah 💋✨

📦 where this page comes from