Skip to main content
Tool Factory

Keys, Certificates & Tokens

EVP key Derivation

Derive EVP key from the supplied material. Enter the key material, choose the required format, then review the result.

Tool workspace

Your input stays in this browser.

Add the required input to continue.

Needs input

You can run the tool again after any change.

Options

Your result appears here

Derive EVP key from the supplied material. Enter the key material, choose the required format, then review the result.

This tool runs open-source code from CyberChef by GCHQ (Apache License 2.0). See open-source credits.

EVP key Derivation performs OpenSSL EVP key derivation for the supplied key or certificate data. The operation returns derived key bytes as the selected text or hexadecimal output.

The operation returns derived key bytes as the selected text or hexadecimal output. This result runs in the browser for this catalog category. Processing runs in the browser.

Key derivation separates password or input material from application keys; it does not replace secret storage or authentication.

Instructions

  1. Provide text or data for this tool.
  2. Use public password and salt values only. This applies to EVP key Derivation.
  3. Record the digest, iterations, length, and salt with the result. This applies to EVP key Derivation.
  4. Use a dedicated password policy before deriving production keys. This applies to EVP key Derivation.

Example

Input: Password "test password" with salt "public-salt" and a documented output length.

Settings: EVP key Derivation: Set the salt, digest, iteration or cost controls, and output length shown by the operation. Use text input for the public password fixture. Keep the salt and all parameters when reproducing the derived key.

Result: The operation returns derived key bytes as the selected text or hexadecimal output.

Limits

  • EVP key Derivation: A derived key is not a password and cannot restore a missing password.
  • EVP key Derivation: Security depends on salt uniqueness, cost parameters, and secret handling.
  • EVP key Derivation: The output does not establish identity or authorize a user.

Questions

What input does EVP key Derivation accept?

EVP key Derivation accepts text. This operation performs a password-based key derivation function (PBKDF) used extensively in OpenSSL. In many applications of cryptography, user security is ultimately dependent on a password, and because a password usually can't be used directly as a cryptographic key, some processing is required. A salt provides a large set of keys for any given password, and an iteration count increases the cost of producing keys from a password, thereby also increasing the difficulty of attack. If you leave the salt argument empty, a random salt will be generated.

Which settings does EVP key Derivation provide?

EVP key Derivation provides controls for Passphrase, Key size, Iterations, Hashing function, Salt.

What does EVP key Derivation return?

EVP key Derivation returns text. This operation performs a password-based key derivation function (PBKDF) used extensively in OpenSSL. In many applications of cryptography, user security is ultimately dependent on a password, and because a password usually can't be used directly as a cryptographic key, some processing is required. A salt provides a large set of keys for any given password, and an iteration count increases the cost of producing keys from a password, thereby also increasing the difficulty of attack. If you leave the salt argument empty, a random salt will be generated.