5 EVP_KDF-SS - The Single Step / One Step EVP_KDF implementation
9 The EVP_KDF-SS algorithm implements the Single Step key derivation function (SSKDF).
10 SSKDF derives a key using input such as a shared secret key (that was generated
11 during the execution of a key establishment scheme) and fixedinfo.
12 SSKDF is also informally referred to as 'Concat KDF'.
14 =head2 Auxiliary function
16 The implementation uses a selectable auxiliary function H, which can be one of:
20 =item B<H(x) = hash(x, digest=md)>
22 =item B<H(x) = HMAC_hash(x, key=salt, digest=md)>
24 =item B<H(x) = KMACxxx(x, key=salt, custom="KDF", outlen=mac_size)>
28 Both the HMAC and KMAC implementations set the key using the 'salt' value.
29 The hash and HMAC also require the digest to be set.
33 "SSKDF" is the name for this implementation; it
34 can be used with the EVP_KDF_fetch() function.
36 =head2 Supported parameters
38 The supported parameters are:
42 =item B<OSSL_KDF_PARAM_PROPERTIES> ("properties") <UTF8 string>
44 =item B<OSSL_KDF_PARAM_DIGEST> ("digest") <UTF8 string>
46 =item B<OSSL_KDF_PARAM_MAC> ("mac") <UTF8 string>
48 =item B<OSSL_KDF_PARAM_MAC_SIZE> ("maclen") <size_t>
50 =item B<OSSL_KDF_PARAM_SALT> ("salt") <octet string>
52 These parameters work as described in L<EVP_KDF(3)/PARAMETERS>.
54 =item B<EVP_KDF_CTRL_SET_KEY> ("key") <octet string>
56 This parameter set the shared secret that is used for key derivation.
58 =item B<OSSL_KDF_PARAM_INFO> ("info") <octet string>
60 This parameter sets an optional value for fixedinfo, also known as otherinfo.
66 A context for SSKDF can be obtained by calling:
68 EVP_KDF *kdf = EVP_KDF_fetch(NULL, "SSKDF", NULL);
69 EVP_KDF_CTX *kctx = EVP_KDF_CTX_new(kdf);
71 The output length of an SSKDF is specified via the C<keylen>
72 parameter to the L<EVP_KDF-derive(3)> function.
76 This example derives 10 bytes using H(x) = SHA-256, with the secret key "secret"
77 and fixedinfo value "label":
81 unsigned char out[10];
82 OSSL_PARAM params[4], *p = params;
84 kdf = EVP_KDF_fetch(NULL, "SSKDF", NULL);
85 kctx = EVP_KDF_CTX_new(kdf);
88 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
89 SN_sha256, strlen(SN_sha256));
90 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_KEY,
92 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_INFO,
94 *p = OSSL_PARAM_construct_end();
95 if (EVP_KDF_CTX_set_params(kctx, params) <= 0) {
96 error("EVP_KDF_CTX_set_params");
98 if (EVP_KDF_derive(kctx, out, sizeof(out)) <= 0) {
99 error("EVP_KDF_derive");
102 EVP_KDF_CTX_free(kctx);
104 This example derives 10 bytes using H(x) = HMAC(SHA-256), with the secret key "secret",
105 fixedinfo value "label" and salt "salt":
109 unsigned char out[10];
110 OSSL_PARAM params[6], *p = params;
112 kdf = EVP_KDF_fetch(NULL, "SSKDF", NULL);
113 kctx = EVP_KDF_CTX_new(kdf);
116 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_MAC,
117 SN_hmac, strlen(SN_hmac));
118 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
119 SN_sha256, strlen(SN_sha256));
120 *p++ = OSSL_PARAM_construct_octet_string(EVP_KDF_CTRL_SET_KEY,
121 "secret", (size_t)6);
122 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_INFO,
124 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SALT,
126 *p = OSSL_PARAM_construct_end();
127 if (EVP_KDF_CTX_set_params(kctx, params) <= 0) {
128 error("EVP_KDF_CTX_set_params");
130 if (EVP_KDF_derive(kctx, out, sizeof(out)) <= 0) {
131 error("EVP_KDF_derive");
134 EVP_KDF_CTX_free(kctx);
136 This example derives 10 bytes using H(x) = KMAC128(x,salt,outlen), with the secret key "secret"
137 fixedinfo value "label", salt of "salt" and KMAC outlen of 20:
141 unsigned char out[10];
142 OSSL_PARAM params[7], *p = params;
144 kdf = EVP_KDF_fetch(NULL, "SSKDF", NULL);
145 kctx = EVP_KDF_CTX_new(kdf);
148 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_MAC,
149 SN_kmac128, strlen(SN_kmac128));
150 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
151 SN_sha256, strlen(SN_sha256));
152 *p++ = OSSL_PARAM_construct_octet_string(EVP_KDF_CTRL_SET_KEY,
153 "secret", (size_t)6);
154 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_INFO,
156 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SALT,
158 *p++ = OSSL_PARAM_construct_size_t(OSSL_KDF_PARAM_MAC_SIZE, (size_t)20);
159 *p = OSSL_PARAM_construct_end();
160 if (EVP_KDF_CTX_set_params(kctx, params) <= 0) {
161 error("EVP_KDF_CTX_set_params");
163 if (EVP_KDF_derive(kctx, out, sizeof(out)) <= 0) {
164 error("EVP_KDF_derive");
167 EVP_KDF_CTX_free(kctx);
176 L<EVP_KDF-CTX_new(3)>,
177 L<EVP_KDF-CTX_free(3)>,
178 L<EVP_KDF-CTX_set_params(3)>,
180 L<EVP_KDF-derive(3)>,
181 L<EVP_KDF(3)/PARAMETERS>
185 This functionality was added to OpenSSL 3.0.
189 Copyright 2019 The OpenSSL Project Authors. All Rights Reserved. Copyright
190 (c) 2019, Oracle and/or its affiliates. All rights reserved.
192 Licensed under the Apache License 2.0 (the "License"). You may not use
193 this file except in compliance with the License. You can obtain a copy
194 in the file LICENSE in the source distribution or at
195 L<https://www.openssl.org/source/license.html>.