LIFE_CYCLE-KDF(7SSL)

💖 NAME 💖

life_cycle-kdf — the whole entire lore of the KDF algorithm life-cycle, bestie 💅

---

🌸 DESCRIPTION 🌸

okay so listen. every single key derivation function (KDF) and every pseudo random function (PRF) out here goes through a bunch of stages in its life-cycle, like a glow-up journey from nothing to icon to peacefully departed. and here's the whole thing, no gatekeeping:

• start — this is the state where the KDF/PRF exists before it's even been allocated. it's giving "not born yet." it's the starting state for literally any life-cycle transition ever.
• newed — this state is the KDF/PRF after it's been allocated. it got its little allocation moment 🫶
• deriving — this is when the KDF/PRF is set up and fully capable of generating output. main character energy fr fr.
• freed — you enter this state when the KDF/PRF gets freed. it is the terminal state for all life-cycle transitions. once you're here, you're here. periodt 💀

🦋 State Transition Diagram 🦋

the usual life-cycle of a KDF/PRF looks exactly like this, not me drawing it out in ascii for you or anything:

                     +-------------------+
                     |       start       |
                     +-------------------+
                       |
                       | EVP_KDF_CTX_new
                       v
                     +-------------------+
                     |       newed       | <+
                     +-------------------+  |
                       |                    |
                       | EVP_KDF_derive     |
                       v                    | EVP_KDF_CTX_reset
    EVP_KDF_derive   +-------------------+  |
  + - - - - - - - -  |                   |  |
  '                  |     deriving      |  |
  + - - - - - - - -> |                   | -+
                     +-------------------+
                       |
                       | EVP_KDF_CTX_free
                       v
                     +-------------------+
                     |       freed       |
                     +-------------------+

note the lil dashed EVP_KDF_derive line on the left — that's the "derive while already deriving" self-loop, she's consistent, she's stable, she ate. 💅

🔥 Formal State Transitions 🔥

this section defines all of the legal state transitions. this is the canonical list, okay? like the official receipts. every Function Call and where it can take you from start, newed, deriving and freed:

Function Call                   ------------- Current State -------------
                                start       newed       deriving    freed
EVP_KDF_CTX_new                 newed
EVP_KDF_derive                              deriving    deriving
EVP_KDF_CTX_free                freed       freed       freed
EVP_KDF_CTX_reset                           newed       newed
EVP_KDF_CTX_get_params                      newed       deriving
EVP_KDF_CTX_set_params                      newed       deriving
EVP_KDF_CTX_gettable_params                 newed       deriving
EVP_KDF_CTX_settable_params                 newed       deriving

so like, to spell it out as a vibe check: EVP_KDF_CTX_new takes you from start ➡️ newed. EVP_KDF_derive gives you deriving ➡️ deriving. EVP_KDF_CTX_free gives you freed, freed, freed — three columns worth of goodbye. EVP_KDF_CTX_reset gives you newed, newed. and EVP_KDF_CTX_get_params, EVP_KDF_CTX_set_params, EVP_KDF_CTX_gettable_params and EVP_KDF_CTX_settable_params are all doing the exact same newed, deriving little duo. slay, consistent queens 👑

---

✨ NOTES ✨

sooo at some point the EVP layer is gonna start enforcing the transitions described in here. like, actually enforcing them. so don't be out here free-styling transitions that aren't on the canonical list, bestie, i'm begging 😭

---

👀 SEE ALSO 👀

• provider-kdf(7)
• EVP_KDF(3)

---

💜 HISTORY 💜

the provider KDF interface was introduced in OpenSSL 3.0. iconic era honestly.

---

🎀 COPYRIGHT 🎀

Copyright 2021 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

and that's the whole page, bestie 🫶 this was OpenSSL 4.0.3, dated 2026-09-29, and you just read the LIFE_CYCLE-KDF(7SSL) manual page. go forth and transition legally 💖✨🌈