# OpenSSL PBKDF2 documentation

I'm using OpenSSL 0.9.8 on OSX Maverick, and I want to use a PBKDF but I can't find any doc/man about it on OpenSSL's website.

I'm working on QCA, an OpenSSL wrapper for Qt, and when I arrived there was PKCS5_PBKDF2_HMAC_SHA1 as PBKDF2, a function I can’t find either on the OpenSSL website. It's marked as DEPRECATED on OSX, so my questions are: Is there one or multiple PBKDF2 on OpenSSL? If there is/are, does anyone know where I can find the documentation please?

-

In 0.9.8 there is only PKCS5_PBKDF2_HMAC_SHA1.

Sample C code:

#include <openssl/evp.h>
#include <openssl/sha.h>

void PBKDF2_HMAC_SHA_1nat(const char* pass, const unsigned char* salt, int32_t iterations, uint32_t outputBytes, char* hexResult)
{
unsigned int i;
unsigned char digest[outputBytes];
PKCS5_PBKDF2_HMAC_SHA1(pass, strlen(pass), salt, strlen(salt), iterations, outputBytes, digest);
for (i = 0; i < sizeof(digest); i++)
sprintf(hexResult + (i * 2), "%02x", 255 & digest[i]);
}


In 1.0.1 there is also PKCS5_PBKDF2_HMAC, which allows passing in different underlying hash functions.

Sample C code for PBKDF2-HMAC-SHA-512:

#include <openssl/evp.h>
#include <openssl/sha.h>

void PBKDF2_HMAC_SHA_1(const char* pass, const unsigned char* salt, int32_t iterations, uint32_t outputBytes, char* hexResult)
{
unsigned int i;
unsigned char digest[outputBytes];
PKCS5_PBKDF2_HMAC(pass, strlen(pass), salt, strlen(salt), iterations, EVP_sha512(), outputBytes, digest);
for (i = 0; i < sizeof(digest); i++)
sprintf(hexResult + (i * 2), "%02x", 255 & digest[i]);
}

-
Thank you for that, really helpful –  Max13 Mar 3 '14 at 23:11

There is only one, it's declared in <openssl/evp.h>. This post from 2009 names it as yet to be documented, and this seems to be still true. It does have a man page on my Linux systems.

BTW recent Mac OS X deprecates all of openssl for crypto use (use CommonCrypto instead).

-
I'm working on cross-platform apps, so I prefer to use OpenSSL instead, that's why I'm asking for a reference. Actually I didn't know that the only PBKDF2 included in OpenSSL is PKCS5_PBKDF2_HMAC_SHA1, and it seems not to appear on the website :S –  Max13 Dec 15 '13 at 16:52