Gecko [ georgetownmover.com ]

Name	Size	Permission	Date
CA.pl.html	9.05 KB	-rw-r--r--	2025-02-06 06:22
openssl-asn1parse.html	8.55 KB	-rw-r--r--	2025-02-06 06:22
openssl-ca.html	36.18 KB	-rw-r--r--	2025-02-06 06:22
openssl-ciphers.html	36.78 KB	-rw-r--r--	2025-02-06 06:22
openssl-cmds.html	5.78 KB	-rw-r--r--	2025-02-06 06:22
openssl-cmp.html	54.5 KB	-rw-r--r--	2025-02-06 06:22
openssl-cms.html	37.56 KB	-rw-r--r--	2025-02-06 06:22
openssl-crl.html	6.56 KB	-rw-r--r--	2025-02-06 06:22
openssl-crl2pkcs7.html	4.73 KB	-rw-r--r--	2025-02-06 06:22
openssl-dgst.html	11.53 KB	-rw-r--r--	2025-02-06 06:22
openssl-dhparam.html	6.07 KB	-rw-r--r--	2025-02-06 06:22
openssl-dsa.html	7.81 KB	-rw-r--r--	2025-02-06 06:22
openssl-dsaparam.html	5.24 KB	-rw-r--r--	2025-02-06 06:22
openssl-ec.html	8.78 KB	-rw-r--r--	2025-02-06 06:22
openssl-ecparam.html	8.02 KB	-rw-r--r--	2025-02-06 06:22
openssl-enc.html	17.67 KB	-rw-r--r--	2025-02-06 06:22
openssl-engine.html	4.67 KB	-rw-r--r--	2025-02-06 06:22
openssl-errstr.html	1.95 KB	-rw-r--r--	2025-02-06 06:22
openssl-fipsinstall.html	10.78 KB	-rw-r--r--	2025-02-06 06:22
openssl-format-options.html	5.31 KB	-rw-r--r--	2025-02-06 06:22
openssl-gendsa.html	4.87 KB	-rw-r--r--	2025-02-06 06:22
openssl-genpkey.html	21.93 KB	-rw-r--r--	2025-02-06 06:22
openssl-genrsa.html	6.04 KB	-rw-r--r--	2025-02-06 06:22
openssl-info.html	3 KB	-rw-r--r--	2025-02-06 06:22
openssl-kdf.html	8.34 KB	-rw-r--r--	2025-02-06 06:22
openssl-list.html	8.98 KB	-rw-r--r--	2025-02-06 06:22
openssl-mac.html	6.9 KB	-rw-r--r--	2025-02-06 06:22
openssl-namedisplay-options.html	7.59 KB	-rw-r--r--	2025-02-06 06:22
openssl-nseq.html	3.37 KB	-rw-r--r--	2025-02-06 06:22
openssl-ocsp.html	24.92 KB	-rw-r--r--	2025-02-06 06:22
openssl-passphrase-options.html	3.38 KB	-rw-r--r--	2025-02-06 06:22
openssl-passwd.html	4.61 KB	-rw-r--r--	2025-02-06 06:22
openssl-pkcs12.html	20.17 KB	-rw-r--r--	2025-02-06 06:22
openssl-pkcs7.html	4.29 KB	-rw-r--r--	2025-02-06 06:22
openssl-pkcs8.html	12.99 KB	-rw-r--r--	2025-02-06 06:22
openssl-pkey.html	9.4 KB	-rw-r--r--	2025-02-06 06:22
openssl-pkeyparam.html	4.04 KB	-rw-r--r--	2025-02-06 06:22
openssl-pkeyutl.html	18.97 KB	-rw-r--r--	2025-02-06 06:22
openssl-prime.html	2.77 KB	-rw-r--r--	2025-02-06 06:22
openssl-rand.html	3.68 KB	-rw-r--r--	2025-02-06 06:22
openssl-rehash.html	6.29 KB	-rw-r--r--	2025-02-06 06:22
openssl-req.html	32.43 KB	-rw-r--r--	2025-02-06 06:22
openssl-rsa.html	8.42 KB	-rw-r--r--	2025-02-06 06:22
openssl-rsautl.html	9.56 KB	-rw-r--r--	2025-02-06 06:22
openssl-s_client.html	44.32 KB	-rw-r--r--	2025-02-06 06:22
openssl-s_server.html	43.08 KB	-rw-r--r--	2025-02-06 06:22
openssl-s_time.html	9.76 KB	-rw-r--r--	2025-02-06 06:22
openssl-sess_id.html	5.8 KB	-rw-r--r--	2025-02-06 06:22
openssl-smime.html	22.26 KB	-rw-r--r--	2025-02-06 06:22
openssl-speed.html	5.92 KB	-rw-r--r--	2025-02-06 06:22
openssl-spkac.html	6.73 KB	-rw-r--r--	2025-02-06 06:22
openssl-srp.html	4.78 KB	-rw-r--r--	2025-02-06 06:22
openssl-storeutl.html	5.58 KB	-rw-r--r--	2025-02-06 06:22
openssl-ts.html	29.63 KB	-rw-r--r--	2025-02-06 06:22
openssl-verification-options.html	30.64 KB	-rw-r--r--	2025-02-06 06:22
openssl-verify.html	9.11 KB	-rw-r--r--	2025-02-06 06:22
openssl-version.html	2.62 KB	-rw-r--r--	2025-02-06 06:22
openssl-x509.html	31.82 KB	-rw-r--r--	2025-02-06 06:22
openssl.html	31.45 KB	-rw-r--r--	2025-02-06 06:22
tsget.html	8.46 KB	-rw-r--r--	2025-02-06 06:22

Rename

<?xml version="1.0" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>openssl-kdf</title>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<link rev="made" href="mailto:root@localhost" />
</head>

<ul id="index">
 <li><a href="#NAME">NAME</a></li>
 <li><a href="#SYNOPSIS">SYNOPSIS</a></li>
 <li><a href="#DESCRIPTION">DESCRIPTION</a></li>
 <li><a href="#OPTIONS">OPTIONS</a></li>
 <li><a href="#EXAMPLES">EXAMPLES</a></li>
 <li><a href="#NOTES">NOTES</a></li>
 <li><a href="#SEE-ALSO">SEE ALSO</a></li>
 <li><a href="#HISTORY">HISTORY</a></li>
 <li><a href="#COPYRIGHT">COPYRIGHT</a></li>
</ul>

openssl-kdf - perform Key Derivation Function operations

<h1 id="SYNOPSIS">SYNOPSIS</h1>

openssl kdf [-help] [-cipher] [-digest] [-mac] [-kdfopt nm:v] [-keylen num] [-out filename] [-binary] [-provider name] [-provider-path path] [-propquery propq] kdf_name

<h1 id="DESCRIPTION">DESCRIPTION</h1>

The key derivation functions generate a derived key from either a secret or password.

<h1 id="OPTIONS">OPTIONS</h1>

<dl>

Print a usage message.

</dd>
<dt id="keylen-num">-keylen num</dt>
<dd>

The output size of the derived key. This field is required.

</dd>
<dt id="out-filename">-out filename</dt>
<dd>

Filename to output to, or standard output by default.

</dd>
<dt id="binary">-binary</dt>
<dd>

Output the derived key in binary form. Uses hexadecimal text format if not specified.

</dd>
<dt id="cipher-name">-cipher name</dt>
<dd>

Specify the cipher to be used by the KDF. Not all KDFs require a cipher and it is an error to use this option in such cases.

</dd>
<dt id="digest-name">-digest name</dt>
<dd>

Specify the digest to be used by the KDF. Not all KDFs require a digest and it is an error to use this option in such cases. To see the list of supported digests, use <code>openssl list -digest-commands</code>.

</dd>
<dt id="mac-name">-mac name</dt>
<dd>

Specify the MAC to be used by the KDF. Not all KDFs require a MAC and it is an error to use this option in such cases.

</dd>
<dt id="kdfopt-nm:v">-kdfopt nm:v</dt>
<dd>

Passes options to the KDF algorithm. A comprehensive list of parameters can be found in the EVP_KDF_CTX implementation documentation. Common parameter names used by EVP_KDF_CTX_set_params() are:

<dl>

<dt id="key:string">key:string</dt>
<dd>

Specifies the secret key as an alphanumeric string (use if the key contains printable characters only). The string length must conform to any restrictions of the KDF algorithm. A key must be specified for most KDF algorithms.

</dd>
<dt id="hexkey:string">hexkey:string</dt>
<dd>

Specifies the secret key in hexadecimal form (two hex digits per byte). The key length must conform to any restrictions of the KDF algorithm. A key must be specified for most KDF algorithms.

</dd>
<dt id="pass:string">pass:string</dt>
<dd>

Specifies the password as an alphanumeric string (use if the password contains printable characters only). The password must be specified for PBKDF2 and scrypt.

</dd>
<dt id="hexpass:string">hexpass:string</dt>
<dd>

Specifies the password in hexadecimal form (two hex digits per byte). The password must be specified for PBKDF2 and scrypt.

</dd>
<dt id="digest:string">digest:string</dt>
<dd>

This option is identical to the -digest option.

</dd>
<dt id="cipher:string">cipher:string</dt>
<dd>

This option is identical to the -cipher option.

</dd>
<dt id="mac:string">mac:string</dt>
<dd>

This option is identical to the -mac option.

</dd>
</dl>

</dd>
<dt id="provider-name">-provider name</dt>
<dd>

</dd>
<dt id="provider-path-path">-provider-path path</dt>
<dd>

</dd>
<dt id="propquery-propq">-propquery propq</dt>
<dd>

See <a href="../man1/openssl.html">&quot;Provider Options&quot; in openssl(1)</a>, <a href="../man7/provider.html">provider(7)</a>, and <a href="../man7/property.html">property(7)</a>.

</dd>
<dt id="kdf_name">kdf_name</dt>
<dd>

Specifies the name of a supported KDF algorithm which will be used. The supported algorithms names include TLS1-PRF, HKDF, SSKDF, PBKDF2, SSHKDF, X942KDF-ASN1, X942KDF-CONCAT, X963KDF and SCRYPT.

</dd>
</dl>

<h1 id="EXAMPLES">EXAMPLES</h1>

Use TLS1-PRF to create a hex-encoded derived key from a secret key and seed:

<pre><code> openssl kdf -keylen 16 -kdfopt digest:SHA2-256 -kdfopt key:secret \
 -kdfopt seed:seed TLS1-PRF</code></pre>

Use HKDF to create a hex-encoded derived key from a secret key, salt and info:

<pre><code> openssl kdf -keylen 10 -kdfopt digest:SHA2-256 -kdfopt key:secret \
 -kdfopt salt:salt -kdfopt info:label HKDF</code></pre>

Use SSKDF with KMAC to create a hex-encoded derived key from a secret key, salt and info:

<pre><code> openssl kdf -keylen 64 -kdfopt mac:KMAC-128 -kdfopt maclen:20 \
 -kdfopt hexkey:b74a149a161545 -kdfopt hexinfo:348a37a2 \
 -kdfopt hexsalt:3638271ccd68a2 SSKDF</code></pre>

Use SSKDF with HMAC to create a hex-encoded derived key from a secret key, salt and info:

<pre><code> openssl kdf -keylen 16 -kdfopt mac:HMAC -kdfopt digest:SHA2-256 \
 -kdfopt hexkey:b74a149a -kdfopt hexinfo:348a37a2 \
 -kdfopt hexsalt:3638271c SSKDF</code></pre>

Use SSKDF with Hash to create a hex-encoded derived key from a secret key, salt and info:

<pre><code> openssl kdf -keylen 14 -kdfopt digest:SHA2-256 \
 -kdfopt hexkey:6dbdc23f045488 \
 -kdfopt hexinfo:a1b2c3d4 SSKDF</code></pre>

Use SSHKDF to create a hex-encoded derived key from a secret key, hash and session_id:

<pre><code> openssl kdf -keylen 16 -kdfopt digest:SHA2-256 \
 -kdfopt hexkey:0102030405 \
 -kdfopt hexxcghash:06090A \
 -kdfopt hexsession_id:01020304 \
 -kdfopt type:A SSHKDF</code></pre>

Use PBKDF2 to create a hex-encoded derived key from a password and salt:

<pre><code> openssl kdf -keylen 32 -kdfopt digest:SHA256 -kdfopt pass:password \
 -kdfopt salt:salt -kdfopt iter:2 PBKDF2</code></pre>

Use scrypt to create a hex-encoded derived key from a password and salt:

<pre><code> openssl kdf -keylen 64 -kdfopt pass:password -kdfopt salt:NaCl \
 -kdfopt n:1024 -kdfopt r:8 -kdfopt p:16 \
 -kdfopt maxmem_bytes:10485760 SCRYPT</code></pre>

<h1 id="NOTES">NOTES</h1>

The KDF mechanisms that are available will depend on the options used when building OpenSSL.

<a href="../man1/openssl.html">openssl(1)</a>, <a href="../man1/openssl-pkeyutl.html">openssl-pkeyutl(1)</a>, <a href="../man3/EVP_KDF.html">EVP_KDF(3)</a>, <a href="../man7/EVP_KDF-SCRYPT.html">EVP_KDF-SCRYPT(7)</a>, <a href="../man7/EVP_KDF-TLS1_PRF.html">EVP_KDF-TLS1_PRF(7)</a>, <a href="../man7/EVP_KDF-PBKDF2.html">EVP_KDF-PBKDF2(7)</a>, <a href="../man7/EVP_KDF-HKDF.html">EVP_KDF-HKDF(7)</a>, <a href="../man7/EVP_KDF-SS.html">EVP_KDF-SS(7)</a>, <a href="../man7/EVP_KDF-SSHKDF.html">EVP_KDF-SSHKDF(7)</a>, <a href="../man7/EVP_KDF-X942-ASN1.html">EVP_KDF-X942-ASN1(7)</a>, <a href="../man7/EVP_KDF-X942-CONCAT.html">EVP_KDF-X942-CONCAT(7)</a>, <a href="../man7/EVP_KDF-X963.html">EVP_KDF-X963(7)</a>

<h1 id="HISTORY">HISTORY</h1>

Added in OpenSSL 3.0

<h1 id="COPYRIGHT">COPYRIGHT</h1>

Licensed under the Apache License 2.0 (the &quot;License&quot;). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.

</body>

</html>