Stdlib: openssl_pbkdf2()/openssl_pbkdf2_scrypt() — OpenSSL KDF API missing (ext/openssl/kdf.c) #6488

Category

stdlib

Problem

OpenSSL extension KDF helpers openssl_pbkdf2() and openssl_pbkdf2_scrypt() (PHP 7.4+) are undefined. Distinct from hash_pbkdf2() in ext/hash (#3773) — openssl_* uses OpenSSL EVP KDF/scrypt with $digest_method / $options semantics.

Password-based key derivation for TLS/crypto stacks expects these when ext/openssl is enabled.

php-src reference

• php/php-src ext/openssl/kdf.c — PHP_FUNCTION(openssl_pbkdf2), openssl_pbkdf2_scrypt
• php/php-src ext/openssl/openssl.stub.php — signatures
• Related (not duplicate): ext/hash/hash_pbkdf2.c via hash_pbkdf2() (Stdlib: hash_pbkdf2() — PBKDF2 key derivation (ext/hash/hash_pbkdf2.c parity) #3773, php-in-php: hash_pbkdf2() — native VmHash path without host \\hash_pbkdf2() (ext/hash/hash_pbkdf2.c, bootstrap) #6186 bootstrap)

Repro (today)

./script/docker-exec.sh -- bash -lc 'source script/php-env.sh
php bin/vm.php -r "
var_export(function_exists(\"openssl_pbkdf2\"));
echo \"\\n\";
var_export(function_exists(\"openssl_pbkdf2_scrypt\"));
echo \"\\n\";
"
'

Zend (with ext-openssl): true / true

This compiler: false / false

php-src-strict

• Non-string $password / $salt / $digest_method → TypeError (Z_PARAM_STR).
• Enum case operands → TypeError, not backing-string coercion (Stdlib: hash()/hash_hmac()/md5()/sha1()/crc32() — enum case operands must TypeError (ext/hash, ext/standard) #5780 pattern).
• Invalid digest / negative iterations → ValueError per php-src.

Scope (this repo)

• ext/openssl/ module (pairs Stdlib: ext/openssl — openssl_encrypt/decrypt/sign/verify (ext/openssl parity) #3324 openssl_encrypt phase) or ext/standard/ if openssl stubs live there today
• VM: thin OpenSSL EVP wrapper or documented subset; no duplicate of hash_pbkdf2() in C runtime tables
• JIT/AOT: lower when openssl ext lands; VM-first acceptable with matrix note

Done when

• Repro: both functions exist and derive a known test vector matching Zend on same inputs
• test/compliance/cases/stdlib/openssl_pbkdf2.phpt (+ scrypt variant or @group openssl skip without libssl)
• docs/capabilities.md row after script/capability-matrix.php

Verification

./script/docker-exec.sh -- bash -lc 'source script/php-env.sh && vendor/bin/phpunit test/compliance/VMTest.php --filter openssl_pbkdf2'