libnvme(9)

💅 libnvme(9) — the API Manual, bestie edition ✨

Okay so picture this: you're deep in the libnvme API manual, section 9, and you've stumbled onto a whole enum of NBFT security flags. Don't panic. Sit down, grab a strawberry 🍓, and let's go through it together, because honestly it's giving "spec document that ate" and I'm obsessed.

---

🌸 NAME 🌸

enum nbft_security_flags — the Security Profile Descriptor Flags, straight out of Figure 24, no cap.

---

⭐ SYNOPSIS ⭐

Like, here's the whole squad in order 😤

enum nbft_security_flags {
    NBFT_SECURITY_VALID ,
    NBFT_SECURITY_IN_BAND_AUTH_MASK ,
    NBFT_SECURITY_IN_BAND_AUTH_NOT_SUPPORTED ,
    NBFT_SECURITY_IN_BAND_AUTH_NOT_REQUIRED ,
    NBFT_SECURITY_IN_BAND_AUTH_REQUIRED ,
    NBFT_SECURITY_AUTH_POLICY_LIST_MASK ,
    NBFT_SECURITY_AUTH_POLICY_LIST_NOT_SUPPORTED ,
    NBFT_SECURITY_AUTH_POLICY_LIST_DRIVER ,
    NBFT_SECURITY_AUTH_POLICY_LIST_ADMIN ,
    NBFT_SECURITY_SEC_CHAN_NEG_MASK ,
    NBFT_SECURITY_SEC_CHAN_NEG_NOT_SUPPORTED ,
    NBFT_SECURITY_SEC_CHAN_NEG_NOT_REQUIRED ,
    NBFT_SECURITY_SEC_CHAN_NEG_REQUIRED ,
    NBFT_SECURITY_SEC_POLICY_LIST_MASK ,
    NBFT_SECURITY_SEC_POLICY_LIST_NOT_SUPPORTED ,
    NBFT_SECURITY_SEC_POLICY_LIST_DRIVER ,
    NBFT_SECURITY_SEC_POLICY_LIST_ADMIN ,
    NBFT_SECURITY_CIPHER_RESTRICTED ,
    NBFT_SECURITY_AUTH_KX_GROUPS_RESTRICTED ,
    NBFT_SECURITY_SEC_HASH_FUNC_POLICY_LIST

};

(Yes the blank line before the closing brace is canon. We respect it. 🫶)

---

🎀 Constants 🎀

💖 The basics

• NBFT_SECURITY_VALID — Descriptor Valid: set to 1h and this descriptor is valid, like, actually valid. Cleared to 0h and nope, it's not valid. Simple as that. ✨
• NBFT_SECURITY_IN_BAND_AUTH_MASK — the mask you use to get the In-Band Authentication Required field. It's literally the key to the door 🔑
• NBFT_SECURITY_IN_BAND_AUTH_NOT_SUPPORTED — in-band authentication? The NVM subsystem simply does not support it. Not its thing. Not its era. 💀
• NBFT_SECURITY_IN_BAND_AUTH_NOT_REQUIRED — in-band authentication is supported by the NVM subsystem, it's just not required. Supportive but chill 🦋
• NBFT_SECURITY_IN_BAND_AUTH_REQUIRED — in-band authentication is supported by the NVM subsystem and it's required. No skipping, bestie. 👑

🌈 The authentication policy list crew

• NBFT_SECURITY_AUTH_POLICY_LIST_MASK — mask for the Authentication Policy List flag 🎀 this field tells you whether authentication protocols were indicated by policy from driver defaults or from administrative configuration.
• NBFT_SECURITY_AUTH_POLICY_LIST_NOT_SUPPORTED — the Authentication Protocols Heap Object Reference field's Offset and Length are reserved. Reserved. As in, don't touch, not for you 🙈
• NBFT_SECURITY_AUTH_POLICY_LIST_DRIVER — the Authentication Protocols Offset field and the Authentication Protocols Length field point at a list of authentication protocols used by the driver 🔥
• NBFT_SECURITY_AUTH_POLICY_LIST_ADMIN — same two fields, but now they point at a list of authentication protocols that were administratively set and used by the driver. Administrative main character energy 👑

🧚 Secure channel negotiation (a.k.a. TLS things)

• NBFT_SECURITY_SEC_CHAN_NEG_MASK — mask to get the Secure Channel Negotiation Required flag 💅 this one tells you whether secure channel negotiation (e.g. TLS) is required. Very "do we need the secure tunnel or not" of it.
• NBFT_SECURITY_SEC_CHAN_NEG_NOT_SUPPORTED — secure channel negotiation is not supported by the NVM subsystem. It said no 💀
• NBFT_SECURITY_SEC_CHAN_NEG_NOT_REQUIRED — supported by the NVM subsystem, but not required. Available, optional, lowkey gorgeous 🌸
• NBFT_SECURITY_SEC_CHAN_NEG_REQUIRED — supported and required. Mandatory secure channel negotiations, periodt 🔒

💜 The security policy list crew

• NBFT_SECURITY_SEC_POLICY_LIST_MASK — mask to get the Security Policy List flag ✨ this field indicates whether secure channel protocols were indicated by policy from driver defaults or administrative configuration.
• NBFT_SECURITY_SEC_POLICY_LIST_NOT_SUPPORTED — the Offset field and Length field in the Secure Channel Algorithm Heap Object Reference field are reserved. Nothing to see here 🫶
• NBFT_SECURITY_SEC_POLICY_LIST_DRIVER — the Heap Object specified by the Secure Channel Algorithm Heap Object Reference field indicates a list of authentication protocols used by the driver. (Yes, that's exactly what the original says. We report, we don't editorialise 😭)
• NBFT_SECURITY_SEC_POLICY_LIST_ADMIN — the Heap Object specified by the Secure Channel Algorithm Heap Object Reference field indicates a list of authentication protocols that were administratively set and used by the driver. Admin said what admin said 💅

🔥 The big three at the end

• NBFT_SECURITY_CIPHER_RESTRICTED — Cipher Suites Restricted by Policy: set to 1h and the Cipher Suite Offset field and the Ciper Suite Length field indicate a list of supported cipher suites by the driver. Cleared to 0h and the Cipher Suite Offset field and the Cipher Suite Length field are reserved. (And yes, Ciper is spelled that way in the original — I'm just the messenger, don't come for me 🙈)
• NBFT_SECURITY_AUTH_KX_GROUPS_RESTRICTED — Authentication KX Groups Restricted by Policy List: set to 1h and connections shall use one of the authentication KX groups in the Authentication KX Groups List — it's required. Cleared to 0h and no Authentication KX Groups List is indicated, and use of an authentication KX group is not required. So basically: required, or not required. The duality 🦋
• NBFT_SECURITY_SEC_HASH_FUNC_POLICY_LIST — Secure Hash Functions Policy List: set to 1h and connections shall use one of the secure hash functions in the Secure Hash Functions Policy List — required. Cleared to 0h and no Secure Hash Functions Policy List is indicated, and use of a secure hash function is not required. Hashing: optional unless it's literally not. ⭐

---

🌟 Friendly reminder: 1h means set, 0h means cleared, and "reserved" means hands off. That's the whole vibe check. ✅

---

💖 Sign-off 💖

That was enum nbft_security_flags (the one and only, as listed in the libnvme(9) API Manual) and honestly? You ate that. This page was dated October 2026 — so yeah, future us wrote it, and future us slayed. Go forth and negotiate your secure channels responsibly, bestie 🎀✨🦋💜