{
    "mode": "man",
    "parameter": "EVP_KDF-SS",
    "section": "7ssl",
    "url": "https://www.chedong.com/phpMan.php/man/EVP_KDF-SS/7ssl/json",
    "generated": "2026-06-03T01:36:44Z",
    "sections": {
        "NAME": {
            "content": "EVPKDF-SS - The Single Step / One Step EVPKDF implementation\n",
            "subsections": []
        },
        "DESCRIPTION": {
            "content": "The EVPKDF-SS algorithm implements the Single Step key derivation function (SSKDF).  SSKDF\nderives a key using input such as a shared secret key (that was generated during the\nexecution of a key establishment scheme) and fixedinfo.  SSKDF is also informally referred to\nas 'Concat KDF'.\n",
            "subsections": [
                {
                    "name": "Auxiliary function",
                    "content": "The implementation uses a selectable auxiliary function H, which can be one of:\n"
                },
                {
                    "name": "H(x) = hash(x, digest=md)",
                    "content": "H(x) = HMAChash(x, key=salt, digest=md)\nH(x) = KMACxxx(x, key=salt, custom=\"KDF\", outlen=macsize)\n\nBoth the HMAC and KMAC implementations set the key using the 'salt' value.  The hash and HMAC\nalso require the digest to be set.\n"
                },
                {
                    "name": "Identity",
                    "content": "\"SSKDF\" is the name for this implementation; it can be used with the EVPKDFfetch()\nfunction.\n"
                },
                {
                    "name": "Supported parameters",
                    "content": "The supported parameters are:\n\n\"properties\" (OSSLKDFPARAMPROPERTIES) <UTF8 string>\n\"digest\" (OSSLKDFPARAMDIGEST) <UTF8 string>\n\"mac\" (OSSLKDFPARAMMAC) <UTF8 string>\n\"maclen\" (OSSLKDFPARAMMACSIZE) <unsigned integer>\n\"salt\" (OSSLKDFPARAMSALT) <octet string>\nThese parameters work as described in \"PARAMETERS\" in EVPKDF(3).\n\n\"key\" (EVPKDFCTRLSETKEY) <octet string>\nThis parameter set the shared secret that is used for key derivation.\n\n\"info\" (OSSLKDFPARAMINFO) <octet string>\nThis parameter sets an optional value for fixedinfo, also known as otherinfo.\n"
                }
            ]
        },
        "NOTES": {
            "content": "A context for SSKDF can be obtained by calling:\n\nEVPKDF *kdf = EVPKDFfetch(NULL, \"SSKDF\", NULL);\nEVPKDFCTX *kctx = EVPKDFCTXnew(kdf);\n\nThe output length of an SSKDF is specified via the keylen parameter to the EVPKDFderive(3)\nfunction.\n",
            "subsections": []
        },
        "EXAMPLES": {
            "content": "This example derives 10 bytes using H(x) = SHA-256, with the secret key \"secret\" and\nfixedinfo value \"label\":\n\nEVPKDF *kdf;\nEVPKDFCTX *kctx;\nunsigned char out[10];\nOSSLPARAM params[4], *p = params;\n\nkdf = EVPKDFfetch(NULL, \"SSKDF\", NULL);\nkctx = EVPKDFCTXnew(kdf);\nEVPKDFfree(kdf);\n\n*p++ = OSSLPARAMconstructutf8string(OSSLKDFPARAMDIGEST,\nSNsha256, strlen(SNsha256));\n*p++ = OSSLPARAMconstructoctetstring(OSSLKDFPARAMKEY,\n\"secret\", (sizet)6);\n*p++ = OSSLPARAMconstructoctetstring(OSSLKDFPARAMINFO,\n\"label\", (sizet)5);\n*p = OSSLPARAMconstructend();\nif (EVPKDFderive(kctx, out, sizeof(out), params) <= 0) {\nerror(\"EVPKDFderive\");\n}\n\nEVPKDFCTXfree(kctx);\n\nThis example derives 10 bytes using H(x) = HMAC(SHA-256), with the secret key \"secret\",\nfixedinfo value \"label\" and salt \"salt\":\n\nEVPKDF *kdf;\nEVPKDFCTX *kctx;\nunsigned char out[10];\nOSSLPARAM params[6], *p = params;\n\nkdf = EVPKDFfetch(NULL, \"SSKDF\", NULL);\nkctx = EVPKDFCTXnew(kdf);\nEVPKDFfree(kdf);\n\n*p++ = OSSLPARAMconstructutf8string(OSSLKDFPARAMMAC,\nSNhmac, strlen(SNhmac));\n*p++ = OSSLPARAMconstructutf8string(OSSLKDFPARAMDIGEST,\nSNsha256, strlen(SNsha256));\n*p++ = OSSLPARAMconstructoctetstring(EVPKDFCTRLSETKEY,\n\"secret\", (sizet)6);\n*p++ = OSSLPARAMconstructoctetstring(OSSLKDFPARAMINFO,\n\"label\", (sizet)5);\n*p++ = OSSLPARAMconstructoctetstring(OSSLKDFPARAMSALT,\n\"salt\", (sizet)4);\n*p = OSSLPARAMconstructend();\nif (EVPKDFderive(kctx, out, sizeof(out), params) <= 0) {\nerror(\"EVPKDFderive\");\n}\n\nEVPKDFCTXfree(kctx);\n\nThis example derives 10 bytes using H(x) = KMAC128(x,salt,outlen), with the secret key\n\"secret\" fixedinfo value \"label\", salt of \"salt\" and KMAC outlen of 20:\n\nEVPKDF *kdf;\nEVPKDFCTX *kctx;\nunsigned char out[10];\nOSSLPARAM params[7], *p = params;\n\nkdf = EVPKDFfetch(NULL, \"SSKDF\", NULL);\nkctx = EVPKDFCTXnew(kdf);\nEVPKDFfree(kdf);\n\n*p++ = OSSLPARAMconstructutf8string(OSSLKDFPARAMMAC,\nSNkmac128, strlen(SNkmac128));\n*p++ = OSSLPARAMconstructutf8string(OSSLKDFPARAMDIGEST,\nSNsha256, strlen(SNsha256));\n*p++ = OSSLPARAMconstructoctetstring(EVPKDFCTRLSETKEY,\n\"secret\", (sizet)6);\n*p++ = OSSLPARAMconstructoctetstring(OSSLKDFPARAMINFO,\n\"label\", (sizet)5);\n*p++ = OSSLPARAMconstructoctetstring(OSSLKDFPARAMSALT,\n\"salt\", (sizet)4);\n*p++ = OSSLPARAMconstructsizet(OSSLKDFPARAMMACSIZE, (sizet)20);\n*p = OSSLPARAMconstructend();\nif (EVPKDFderive(kctx, out, sizeof(out), params) <= 0) {\nerror(\"EVPKDFderive\");\n}\n\nEVPKDFCTXfree(kctx);\n",
            "subsections": []
        },
        "CONFORMING TO": {
            "content": "NIST SP800-56Cr1.\n",
            "subsections": []
        },
        "SEE ALSO": {
            "content": "EVPKDF(3), EVPKDFCTXnew(3), EVPKDFCTXfree(3), EVPKDFCTXsetparams(3),\nEVPKDFCTXgetkdfsize(3), EVPKDFderive(3), \"PARAMETERS\" in EVPKDF(3)\n",
            "subsections": []
        },
        "HISTORY": {
            "content": "This functionality was added to OpenSSL 3.0.\n",
            "subsections": []
        },
        "COPYRIGHT": {
            "content": "Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved.  Copyright (c) 2019,\nOracle and/or its affiliates.  All rights reserved.\n\nLicensed under the Apache License 2.0 (the \"License\").  You may not use this file except in\ncompliance with the License.  You can obtain a copy in the file LICENSE in the source\ndistribution or at <https://www.openssl.org/source/license.html>.\n\n\n\n3.0.2                                        2026-04-07                             EVPKDF-SS(7SSL)",
            "subsections": []
        }
    },
    "summary": "EVPKDF-SS - The Single Step / One Step EVPKDF implementation",
    "flags": [],
    "examples": [
        "This example derives 10 bytes using H(x) = SHA-256, with the secret key \"secret\" and",
        "fixedinfo value \"label\":",
        "EVPKDF *kdf;",
        "EVPKDFCTX *kctx;",
        "unsigned char out[10];",
        "OSSLPARAM params[4], *p = params;",
        "kdf = EVPKDFfetch(NULL, \"SSKDF\", NULL);",
        "kctx = EVPKDFCTXnew(kdf);",
        "EVPKDFfree(kdf);",
        "*p++ = OSSLPARAMconstructutf8string(OSSLKDFPARAMDIGEST,",
        "SNsha256, strlen(SNsha256));",
        "*p++ = OSSLPARAMconstructoctetstring(OSSLKDFPARAMKEY,",
        "\"secret\", (sizet)6);",
        "*p++ = OSSLPARAMconstructoctetstring(OSSLKDFPARAMINFO,",
        "\"label\", (sizet)5);",
        "*p = OSSLPARAMconstructend();",
        "if (EVPKDFderive(kctx, out, sizeof(out), params) <= 0) {",
        "error(\"EVPKDFderive\");",
        "EVPKDFCTXfree(kctx);",
        "This example derives 10 bytes using H(x) = HMAC(SHA-256), with the secret key \"secret\",",
        "fixedinfo value \"label\" and salt \"salt\":",
        "EVPKDF *kdf;",
        "EVPKDFCTX *kctx;",
        "unsigned char out[10];",
        "OSSLPARAM params[6], *p = params;",
        "kdf = EVPKDFfetch(NULL, \"SSKDF\", NULL);",
        "kctx = EVPKDFCTXnew(kdf);",
        "EVPKDFfree(kdf);",
        "*p++ = OSSLPARAMconstructutf8string(OSSLKDFPARAMMAC,",
        "SNhmac, strlen(SNhmac));",
        "*p++ = OSSLPARAMconstructutf8string(OSSLKDFPARAMDIGEST,",
        "SNsha256, strlen(SNsha256));",
        "*p++ = OSSLPARAMconstructoctetstring(EVPKDFCTRLSETKEY,",
        "\"secret\", (sizet)6);",
        "*p++ = OSSLPARAMconstructoctetstring(OSSLKDFPARAMINFO,",
        "\"label\", (sizet)5);",
        "*p++ = OSSLPARAMconstructoctetstring(OSSLKDFPARAMSALT,",
        "\"salt\", (sizet)4);",
        "*p = OSSLPARAMconstructend();",
        "if (EVPKDFderive(kctx, out, sizeof(out), params) <= 0) {",
        "error(\"EVPKDFderive\");",
        "EVPKDFCTXfree(kctx);",
        "This example derives 10 bytes using H(x) = KMAC128(x,salt,outlen), with the secret key",
        "\"secret\" fixedinfo value \"label\", salt of \"salt\" and KMAC outlen of 20:",
        "EVPKDF *kdf;",
        "EVPKDFCTX *kctx;",
        "unsigned char out[10];",
        "OSSLPARAM params[7], *p = params;",
        "kdf = EVPKDFfetch(NULL, \"SSKDF\", NULL);",
        "kctx = EVPKDFCTXnew(kdf);",
        "EVPKDFfree(kdf);",
        "*p++ = OSSLPARAMconstructutf8string(OSSLKDFPARAMMAC,",
        "SNkmac128, strlen(SNkmac128));",
        "*p++ = OSSLPARAMconstructutf8string(OSSLKDFPARAMDIGEST,",
        "SNsha256, strlen(SNsha256));",
        "*p++ = OSSLPARAMconstructoctetstring(EVPKDFCTRLSETKEY,",
        "\"secret\", (sizet)6);",
        "*p++ = OSSLPARAMconstructoctetstring(OSSLKDFPARAMINFO,",
        "\"label\", (sizet)5);",
        "*p++ = OSSLPARAMconstructoctetstring(OSSLKDFPARAMSALT,",
        "\"salt\", (sizet)4);",
        "*p++ = OSSLPARAMconstructsizet(OSSLKDFPARAMMACSIZE, (sizet)20);",
        "*p = OSSLPARAMconstructend();",
        "if (EVPKDFderive(kctx, out, sizeof(out), params) <= 0) {",
        "error(\"EVPKDFderive\");",
        "EVPKDFCTXfree(kctx);"
    ],
    "see_also": [
        {
            "name": "EVPKDF",
            "section": "3",
            "url": "https://www.chedong.com/phpMan.php/man/EVPKDF/3/json"
        },
        {
            "name": "EVPKDFCTXnew",
            "section": "3",
            "url": "https://www.chedong.com/phpMan.php/man/EVPKDFCTXnew/3/json"
        },
        {
            "name": "EVPKDFCTXfree",
            "section": "3",
            "url": "https://www.chedong.com/phpMan.php/man/EVPKDFCTXfree/3/json"
        },
        {
            "name": "EVPKDFCTXsetparams",
            "section": "3",
            "url": "https://www.chedong.com/phpMan.php/man/EVPKDFCTXsetparams/3/json"
        },
        {
            "name": "EVPKDFCTXgetkdfsize",
            "section": "3",
            "url": "https://www.chedong.com/phpMan.php/man/EVPKDFCTXgetkdfsize/3/json"
        },
        {
            "name": "EVPKDFderive",
            "section": "3",
            "url": "https://www.chedong.com/phpMan.php/man/EVPKDFderive/3/json"
        },
        {
            "name": "EVPKDF",
            "section": "3",
            "url": "https://www.chedong.com/phpMan.php/man/EVPKDF/3/json"
        }
    ]
}