OpenSSL PBKDF2 documentation

Question

I'm using OpenSSL 0.9.8 on OSX Maverick, and I want to use a PBKDF but I can't find any doc/man about it on OpenSSL's website.

I'm working on QCA, an OpenSSL wrapper for Qt, and when I arrived there was PKCS5_PBKDF2_HMAC_SHA1 as PBKDF2, a function I can’t find either on the OpenSSL website. It's marked as DEPRECATED on OSX, so my questions are: Is there one or multiple PBKDF2 on OpenSSL? If there is/are, does anyone know where I can find the documentation please?

Answer 1

In 0.9.8 there is only PKCS5_PBKDF2_HMAC_SHA1.

Sample C code:

#include <openssl/evp.h>
#include <openssl/sha.h>

void PBKDF2_HMAC_SHA_1nat(const char* pass, const unsigned char* salt, int32_t iterations, uint32_t outputBytes, char* hexResult)
{
    unsigned int i;
    unsigned char digest[outputBytes];
    PKCS5_PBKDF2_HMAC_SHA1(pass, strlen(pass), salt, strlen(salt), iterations, outputBytes, digest);
    for (i = 0; i < sizeof(digest); i++)
        sprintf(hexResult + (i * 2), "%02x", 255 & digest[i]);
}

In 1.0.1 there is also PKCS5_PBKDF2_HMAC, which allows passing in different underlying hash functions.

Sample C code for PBKDF2-HMAC-SHA-512:

#include <openssl/evp.h>
#include <openssl/sha.h>

void PBKDF2_HMAC_SHA_1(const char* pass, const unsigned char* salt, int32_t iterations, uint32_t outputBytes, char* hexResult)
{
    unsigned int i;
    unsigned char digest[outputBytes];
    PKCS5_PBKDF2_HMAC(pass, strlen(pass), salt, strlen(salt), iterations, EVP_sha512(), outputBytes, digest);
    for (i = 0; i < sizeof(digest); i++)
        sprintf(hexResult + (i * 2), "%02x", 255 & digest[i]);
}

Answer 2

There is only one, it's declared in <openssl/evp.h>. This post from 2009 names it as yet to be documented, and this seems to be still true. It does have a man page on my Linux systems.

BTW recent Mac OS X deprecates all of openssl for crypto use (use CommonCrypto instead).