Add KDF support to pkeyutl. Update documentation.

[thirdparty/openssl.git] / doc / apps / pkeyutl.pod

diff --git a/doc/apps/pkeyutl.pod b/doc/apps/pkeyutl.pod
index a2da2558f6a9b84dd99fc0cc98c9aa8f8b0993d7..042600909488a189ea6389e0c3ca71d72a0586d8 100644 (file)
--- a/doc/apps/pkeyutl.pod
+++ b/doc/apps/pkeyutl.pod
@@ -25,6 +25,8 @@ B<openssl> B<pkeyutl>
 [B<-encrypt>]
 [B<-decrypt>]
 [B<-derive>]
+[B<-kdf algorithm>]
+[B<-kdflen length>]
 [B<-pkeyopt opt:value>]
 [B<-hexdump>]
 [B<-asn1parse>]
@@ -119,6 +121,15 @@ decrypt the input data using a private key.
 
 derive a shared secret using the peer key.
 
+=item B<-kdf algorithm>
+
+Use key derivation function B<algorithm>. Note: additional paramers
+will normally have to be set and the KDF output length for this to work.
+
+=item B<-kdflen length>
+
+Set the ouput length for KDF.
+
 =item B<-pkeyopt opt:value>
 
 Public key options specified as opt:value. See NOTES below for more details.
@@ -249,6 +260,12 @@ Derive a shared secret value:
 
  openssl pkeyutl -derive -inkey key.pem -peerkey pubkey.pem -out secret
 
+Hexdump 48 bytes of TLS1 PRF using digest B<SHA256> and shared secret and
+seed consisting of the single byte 0xFF.
+
+ openssl pkeyutl -kdf TLS1-PRF -kdflen 48 -pkeyopt md:SHA256 \
+    -pkeyopt hexsecret:ff -pkeyopt hexseed:ff -hexdump
+
 =head1 SEE ALSO
 
 L<genpkey(1)>, L<pkey(1)>, L<rsautl(1)>