EVP_KDF-PBKDF27ssl
The pbkdf2 evp_kdf implementation
Overview
Support for computing the PBKDF2 password-based KDF through the EVP_KDF API.
The EVP_KDF-PBKDF2 algorithm implements the PBKDF2 password-based key derivation function, as described in SP800-132; it derives a key from a password using a salt and iteration count.
The output is considered to be a cryptographic key.
Identity
"PBKDF2" is the name for this implementation; it can be used with the EVP_KDF_fetch() function.
Supported parameters
The supported parameters are:
- "pass" (
OSSL_KDF_PARAM_PASSWORD) <octet string>
- "salt" (
OSSL_KDF_PARAM_SALT) <octet string>
- "iter" (
OSSL_KDF_PARAM_ITER) <unsigned integer> -
This parameter has a default value of 2048.
- "properties" (
OSSL_KDF_PARAM_PROPERTIES) <UTF8 string>
- "digest" (
OSSL_KDF_PARAM_DIGEST) <UTF8 string> -
These parameters work as described in "PARAMETERS" in EVP_KDF(3).
- "pkcs5" (
OSSL_KDF_PARAM_PKCS5) <integer> -
This parameter can be used to enable or disable SP800-132 compliance checks. Setting the mode to 0 enables the compliance checks.
The checks performed are:
- - the iteration count is at least 1000.
- - the salt length is at least 128 bits.
- - the derived key length is at least 112 bits.
The default provider uses a default mode of 1 for backwards compatibility, and the FIPS provider uses a default mode of 0. This option breaks FIPS compliance if it causes the approved "fips-indicator" to return 0.
- "fips-indicator" (
OSSL_KDF_PARAM_FIPS_APPROVED_INDICATOR) <integer> -
This option is used by the OpenSSL FIPS provider.
A getter that returns 1 if the operation is FIPS approved, or 0 otherwise. This may be used after calling EVP_KDF_derive. It returns 0 if "pkcs5" is set to 1 and the derived key length, salt length or iteration count test fails.
Notes
A typical application of this algorithm is to derive keying material for an encryption algorithm from a password in the "pass", a salt in "salt", and an iteration count.
Increasing the "iter" parameter slows down the algorithm which makes it harder for an attacker to perform a brute force attack using a large number of candidate passwords.
No assumption is made regarding the given password; it is simply treated as a byte sequence.
Releases
3 releases since Debian 12 (Bookworm); the text changed 2 times.