EVP\_KDF-SNMPKDF(7ossl) OpenSSL EVP\_KDF-SNMPKDF(7ossl)

# [NAME](#NAME)

EVP\_KDF-SNMPKDF - The SNMPKDF EVP\_KDF implementation

# [DESCRIPTION](#DESCRIPTION)

Support for computing the **SNMPKDF** KDF through the **EVP\_KDF** API.

The EVP\_KDF-SNMPKDF algorithm implements the SNMPKDF key derivation function. It is defined in RFC 3414, appendix A.2.2 and is used by SNMP to derive encryption keys. Three inputs are required to perform key derivation: The hashing function (for example SHA1), the engine ID, and the password

## [Identity](#Identity)

"SNMPKDF" is the name for this implementation; it can be used with the **EVP\_KDF\_fetch()** function.

## [Supported parameters](#Supported_parameters)

The supported parameters are:

"properties" (**OSSL\_KDF\_PARAM\_PROPERTIES**) <UTF8 string>

"digest" (**OSSL\_KDF\_PARAM\_DIGEST**) <UTF8 string>

"pass" (**OSSL\_KDF\_PARAM\_PASSWORD**) <octet string>

These parameters work as described in "PARAMETERS" in [**EVP\_KDF**(3)](/man/os/openssl-4.0/EVP_KDF.3).

"eid" (**OSSL\_KDF\_PARAM\_SNMPKDF\_EID**) <octet string>

This parameter sets the snmpEngineID value for the KDF. If a value is already set, the contents are replaced.

"fips-indicator" (**OSSL\_KDF\_PARAM\_FIPS\_APPROVED\_INDICATOR**) <integer>

The OpenSSL FIPS provider returns 1 if the operation is FIPS approved, or 0 otherwise. See "FIPS indicators" in [**fips\_module**(7)](/man/os/openssl-4.0/fips_module.7) for more information.

# [NOTES](#NOTES)

A context for SNMPKDF can be obtained by calling:

```
 EVP_KDF *kdf = EVP_KDF_fetch(NULL, "SNMPKDF", NULL);
 EVP_KDF_CTX *kctx = EVP_KDF_CTX_new(kdf);
```

The expected length of the SNMPKDF derivation output is the size of the *digest*. Since the SNMPKDF output length can vary depending on the digest used, the caller should allocate a buffer of the digest size and pass that buffer in the [**EVP\_KDF\_derive**(3)](/man/os/openssl-4.0/EVP_KDF_derive.3) function along with the expected length.

# [EXAMPLES](#EXAMPLES)

This example derives an 8 byte IV using SHA1 with a 1K "key" and appropriate "xcghash" and "session\_id" values:

```
 EVP_KDF *kdf;
 EVP_KDF_CTX *kctx;
 unsigned char eid[1024] = "01234...";
 unsigned char pass[32] = "012345...";
 unsigned char out[20];
 size_t outlen = sizeof(out);
 OSSL_PARAM params[6], *p = params;
 kdf = EVP_KDF_fetch(NULL, "SNMPKDF", NULL);
 kctx = EVP_KDF_CTX_new(kdf);
 EVP_KDF_free(kdf);
 *p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
                                         SN_sha1, strlen(SN_sha1));
 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_PASSWORD,
                                          pass, sizeof(pass));
 *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SNMPKDF_EID,
                                          eid, sizeof(eid));
 *p = OSSL_PARAM_construct_end();
 if (EVP_KDF_derive(kctx, out, outlen, params) <= 0)
     /* Error */
```

# [CONFORMING TO](#CONFORMING_TO)

RFC 3414, RFC 7860, NIST SP800-135

# [SEE ALSO](#SEE_ALSO)

[**EVP\_KDF**(3)](/man/os/openssl-4.0/EVP_KDF.3), [**EVP\_KDF\_CTX\_new**(3)](/man/os/openssl-4.0/EVP_KDF_CTX_new.3), [**EVP\_KDF\_CTX\_dup**(3)](/man/os/openssl-4.0/EVP_KDF_CTX_dup.3), [**EVP\_KDF\_CTX\_free**(3)](/man/os/openssl-4.0/EVP_KDF_CTX_free.3), [**EVP\_KDF\_CTX\_set\_params**(3)](/man/os/openssl-4.0/EVP_KDF_CTX_set_params.3), [**EVP\_KDF\_CTX\_get\_kdf\_size**(3)](/man/os/openssl-4.0/EVP_KDF_CTX_get_kdf_size.3), [**EVP\_KDF\_derive**(3)](/man/os/openssl-4.0/EVP_KDF_derive.3), "PARAMETERS" in [**EVP\_KDF**(3)](/man/os/openssl-4.0/EVP_KDF.3)

# [HISTORY](#HISTORY)

This functionality was added in OpenSSL 4.0.

# [COPYRIGHT](#COPYRIGHT)

Copyright 2025-2026 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at &lt;https://www.openssl.org/source/license.html&gt;.

2026-09-29 4.0.3

---

Document: EVP_KDF-SNMPKDF(7ossl) from openssl-4.0 4.0.3-r3 (Chainguard OS)