EVP_KDF-HMAC-DRBG7ssl
The hmac drbg deterministic evp_kdf implementation
Overview
Support for a deterministic HMAC DRBG using the EVP_KDF API. This is similar to EVP_RAND-HMAC-DRBG(7), but uses fixed values for its entropy and nonce values. This is used to generate deterministic nonce value required by ECDSA and DSA (as defined in RFC 6979).
Identity
"HMAC-DRBG-KDF" is the name for this implementation; it can be used with the EVP_KDF_fetch() function.
Supported parameters
The supported parameters are:
- "digest" (
OSSL_DRBG_PARAM_DIGEST) <UTF8 string>
- "properties" (
OSSL_DRBG_PARAM_PROPERTIES) <UTF8 string> -
These parameters work as described in "PARAMETERS" in EVP_KDF(3).
- "entropy" (
OSSL_KDF_PARAM_HMACDRBG_ENTROPY) <octet string> -
Sets the entropy bytes supplied to the HMAC-DRBG.
- "nonce" (
OSSL_KDF_PARAM_HMACDRBG_NONCE) <octet string> -
Sets the nonce bytes supplied to the HMAC-DRBG.
Notes
A context for KDF HMAC DRBG can be obtained by calling:
EVP_KDF *kdf = EVP_KDF_fetch(NULL, "HMAC-DRBG-KDF", NULL);EVP_KDF_CTX *kdf_ctx = EVP_KDF_CTX_new(kdf, NULL);
Releases
2 releases since Debian 13 (Trixie); the text changed 1 time.