{ "mode": "man", "parameter": "EVP_KDF-HKDF", "section": "7", "url": "https://www.chedong.com/phpMan.php/man/EVP_KDF-HKDF/7/json", "generated": "2026-09-16T13:14:32Z", "sections": { "NAME": { "content": "EVPKDF-HKDF - The HKDF EVPKDF implementation\n", "subsections": [] }, "DESCRIPTION": { "content": "Support for computing the HKDF KDF through the EVPKDF API.\n\nThe EVPKDF-HKDF algorithm implements the HKDF key derivation function. HKDF follows the\n\"extract-then-expand\" paradigm, where the KDF logically consists of two modules. The first\nstage takes the input keying material and \"extracts\" from it a fixed-length pseudorandom key\nK. The second stage \"expands\" the key K into several additional pseudorandom keys (the output\nof the KDF).\n", "subsections": [ { "name": "Identity", "content": "\"HKDF\" is the name for this implementation; it can be used with the EVPKDFfetch() function.\n" }, { "name": "Supported parameters", "content": "The supported parameters are:\n\n\"properties\" (OSSLKDFPARAMPROPERTIES) \n\"digest\" (OSSLKDFPARAMDIGEST) \n\"key\" (OSSLKDFPARAMKEY) \n\"salt\" (OSSLKDFPARAMSALT) \nThese parameters work as described in \"PARAMETERS\" in EVPKDF(3).\n\n\"info\" (OSSLKDFPARAMINFO) \nThis parameter sets the info value. The length of the context info buffer cannot exceed\n1024 bytes; this should be more than enough for any normal use of HKDF.\n\n\"mode\" (OSSLKDFPARAMMODE) or \nThis parameter sets the mode for the HKDF operation. There are three modes that are\ncurrently defined:\n\n\"EXTRACTANDEXPAND\" or EVPKDFHKDFMODEEXTRACTANDEXPAND\nThis is the default mode. Calling EVPKDFderive(3) on an EVPKDFCTX set up for\nHKDF will perform an extract followed by an expand operation in one go. The derived\nkey returned will be the result after the expand operation. The intermediate fixed-\nlength pseudorandom key K is not returned.\n\nIn this mode the digest, key, salt and info values must be set before a key is\nderived otherwise an error will occur.\n\n\"EXTRACTONLY\" or EVPKDFHKDFMODEEXTRACTONLY\nIn this mode calling EVPKDFderive(3) will just perform the extract operation. The\nvalue returned will be the intermediate fixed-length pseudorandom key K. The keylen\nparameter must match the size of K, which can be looked up by calling\nEVPKDFCTXgetkdfsize() after setting the mode and digest.\n\nThe digest, key and salt values must be set before a key is derived otherwise an\nerror will occur.\n\n\"EXPANDONLY\" or EVPKDFHKDFMODEEXPANDONLY\nIn this mode calling EVPKDFderive(3) will just perform the expand operation. The\ninput key should be set to the intermediate fixed-length pseudorandom key K returned\nfrom a previous extract operation.\n\nThe digest, key and info values must be set before a key is derived otherwise an\nerror will occur.\n" } ] }, "NOTES": { "content": "A context for HKDF can be obtained by calling:\n\nEVPKDF *kdf = EVPKDFfetch(NULL, \"HKDF\", NULL);\nEVPKDFCTX *kctx = EVPKDFCTXnew(kdf);\n\nThe output length of an HKDF expand operation is specified via the keylen parameter to the\nEVPKDFderive(3) function. When using EVPKDFHKDFMODEEXTRACTONLY the keylen parameter\nmust equal the size of the intermediate fixed-length pseudorandom key otherwise an error will\noccur. For that mode, the fixed output size can be looked up by calling\nEVPKDFCTXgetkdfsize() after setting the mode and digest on the EVPKDFCTX.\n", "subsections": [] }, "EXAMPLES": { "content": "This example derives 10 bytes using SHA-256 with the secret key \"secret\", salt value \"salt\"\nand info value \"label\":\n\nEVPKDF *kdf;\nEVPKDFCTX *kctx;\nunsigned char out[10];\nOSSLPARAM params[5], *p = params;\n\nkdf = EVPKDFfetch(NULL, \"HKDF\", NULL);\nkctx = EVPKDFCTXnew(kdf);\nEVPKDFfree(kdf);\n\n*p++ = OSSLPARAMconstructutf8string(OSSLKDFPARAMDIGEST,\nSNsha256, strlen(SNsha256));\n*p++ = OSSLPARAMconstructoctetstring(OSSLKDFPARAMKEY,\n\"secret\", (sizet)6);\n*p++ = OSSLPARAMconstructoctetstring(OSSLKDFPARAMINFO,\n\"label\", (sizet)5);\n*p++ = OSSLPARAMconstructoctetstring(OSSLKDFPARAMSALT,\n\"salt\", (sizet)4);\n*p = OSSLPARAMconstructend();\nif (EVPKDFderive(kctx, out, sizeof(out), params) <= 0) {\nerror(\"EVPKDFderive\");\n}\n\nEVPKDFCTXfree(kctx);\n", "subsections": [] }, "CONFORMING TO": { "content": "RFC 5869\n", "subsections": [] }, "SEE ALSO": { "content": "EVPKDF(3), EVPKDFCTXnew(3), EVPKDFCTXfree(3), EVPKDFCTXgetkdfsize(3),\nEVPKDFCTXsetparams(3), EVPKDFderive(3), \"PARAMETERS\" in EVPKDF(3),\nEVPKDF-TLS13KDF(7)\n", "subsections": [] }, "HISTORY": { "content": "This functionality was added in OpenSSL 3.0.\n", "subsections": [] }, "COPYRIGHT": { "content": "Copyright 2016-2021 The OpenSSL Project Authors. All Rights Reserved.\n\nLicensed under the Apache License 2.0 (the \"License\"). You may not use this file except in\ncompliance with the License. You can obtain a copy in the file LICENSE in the source\ndistribution or at .\n\n3.0.13 2026-07-29 EVPKDF-HKDF(7SSL)", "subsections": [] } }, "summary": "EVPKDF-HKDF - The HKDF EVPKDF implementation", "flags": [], "examples": [ "This example derives 10 bytes using SHA-256 with the secret key \"secret\", salt value \"salt\"", "and info value \"label\":", "EVPKDF *kdf;", "EVPKDFCTX *kctx;", "unsigned char out[10];", "OSSLPARAM params[5], *p = params;", "kdf = EVPKDFfetch(NULL, \"HKDF\", NULL);", "kctx = EVPKDFCTXnew(kdf);", "EVPKDFfree(kdf);", "*p++ = OSSLPARAMconstructutf8string(OSSLKDFPARAMDIGEST,", "SNsha256, strlen(SNsha256));", "*p++ = OSSLPARAMconstructoctetstring(OSSLKDFPARAMKEY,", "\"secret\", (sizet)6);", "*p++ = OSSLPARAMconstructoctetstring(OSSLKDFPARAMINFO,", "\"label\", (sizet)5);", "*p++ = OSSLPARAMconstructoctetstring(OSSLKDFPARAMSALT,", "\"salt\", (sizet)4);", "*p = OSSLPARAMconstructend();", "if (EVPKDFderive(kctx, out, sizeof(out), params) <= 0) {", "error(\"EVPKDFderive\");", "EVPKDFCTXfree(kctx);" ], "see_also": [ { "name": "EVPKDF", "section": "3", "url": "https://www.chedong.com/phpMan.php/man/EVPKDF/3/json" }, { "name": "EVPKDFCTXnew", "section": "3", "url": "https://www.chedong.com/phpMan.php/man/EVPKDFCTXnew/3/json" }, { "name": "EVPKDFCTXfree", "section": "3", "url": "https://www.chedong.com/phpMan.php/man/EVPKDFCTXfree/3/json" }, { "name": "EVPKDFCTXgetkdfsize", "section": "3", "url": "https://www.chedong.com/phpMan.php/man/EVPKDFCTXgetkdfsize/3/json" }, { "name": "EVPKDFCTXsetparams", "section": "3", "url": "https://www.chedong.com/phpMan.php/man/EVPKDFCTXsetparams/3/json" }, { "name": "EVPKDFderive", "section": "3", "url": "https://www.chedong.com/phpMan.php/man/EVPKDFderive/3/json" }, { "name": "EVPKDF", "section": "3", "url": "https://www.chedong.com/phpMan.php/man/EVPKDF/3/json" }, { "name": "EVPKDF-TLS13KDF", "section": "7", "url": "https://www.chedong.com/phpMan.php/man/EVPKDF-TLS13KDF/7/json" } ] }