EVP_KDF-PBKDF17ssl
The pbkdf1 evp_kdf implementation
Overview
Support for computing the PBKDF1 password-based KDF through the EVP_KDF API.
The EVP_KDF-PBKDF1 algorithm implements the PBKDF1 password-based key derivation function, as described in RFC 8018; it derives a key from a password using a salt and iteration count.
Identity
"PBKDF1" is the name for this implementation; it can be used with the EVP_KDF_fetch() function.
Supported parameters
The supported parameters are:
- "pass" (
OSSL_KDF_PARAM_PASSWORD) <octet string>
- "salt" (
OSSL_KDF_PARAM_SALT) <octet string>
- "iter" (
OSSL_KDF_PARAM_ITER) <unsigned integer> -
This parameter has a default value of 0 and should be set.
- "properties" (
OSSL_KDF_PARAM_PROPERTIES) <UTF8 string>
- "digest" (
OSSL_KDF_PARAM_DIGEST) <UTF8 string> -
These parameters work as described in "PARAMETERS" in EVP_KDF(3).
Notes
A typical application of this algorithm is to derive keying material for an encryption algorithm from a password in the "pass", a salt in "salt", and an iteration count.
Increasing the "iter" parameter slows down the algorithm which makes it harder for an attacker to perform a brute force attack using a large number of candidate passwords.
No assumption is made regarding the given password; it is simply treated as a byte sequence.
The legacy provider needs to be available in order to access this algorithm.
Releases
3 releases since Debian 12 (Bookworm); the text changed 2 times.