libnvme(2)

💖 libnvme(2) 💖 — enum nbft_security_flags

okay bestie, sit DOWN, because we're doing libnvme(2) and it's giving API Manual energy. this is from the libnvme manual, section 2, and it's all about one adorable little enum. you're welcome 💅

---

✨ NAME ✨

enum nbft_security_flags — Security Profile Descriptor Flags (Figure 22) 🎀

---

🦋 SYNOPSIS 🦋

enum nbft_security_flags {
    NBFT_SECURITY_VALID ,
    NBFT_SECURITY_IN_BAND_AUTH_MASK ,
    NBFT_SECURITY_IN_BAND_AUTH_NOT_SUPPORTED ,
    NBFT_SECURITY_IN_BAND_AUTH_NOT_REQUIRED ,
    NBFT_SECURITY_IN_BAND_AUTH_REQUIRED ,
    NBFT_SECURITY_AUTH_POLICY_LIST_MASK ,
    NBFT_SECURITY_AUTH_POLICY_LIST_NOT_SUPPORTED ,
    NBFT_SECURITY_AUTH_POLICY_LIST_DRIVER ,
    NBFT_SECURITY_AUTH_POLICY_LIST_ADMIN ,
    NBFT_SECURITY_SEC_CHAN_NEG_MASK ,
    NBFT_SECURITY_SEC_CHAN_NEG_NOT_SUPPORTED ,
    NBFT_SECURITY_SEC_CHAN_NEG_NOT_REQUIRED ,
    NBFT_SECURITY_SEC_CHAN_NEG_REQUIRED ,
    NBFT_SECURITY_SEC_POLICY_LIST_MASK ,
    NBFT_SECURITY_SEC_POLICY_LIST_NOT_SUPPORTED ,
    NBFT_SECURITY_SEC_POLICY_LIST_DRIVER ,
    NBFT_SECURITY_SEC_POLICY_LIST_ADMIN ,
    NBFT_SECURITY_CIPHER_RESTRICTED ,
    NBFT_SECURITY_AUTH_DH_GROUPS_RESTRICTED ,
    NBFT_SECURITY_SEC_HASH_FUNC_POLICY_LIST

};

that's the whole squad, right there. no cap. 👑

---

🌸 CONSTANTS 🌸

like, one bullet per constant, exactly like the manpage does it. no skipping, we're thorough in this house 🫶

• NBFT_SECURITY_VALID — Descriptor Valid. if this is set to 1h, the descriptor is valid, slay 💖. if it's cleared to 0h, it's not valid. that's it, that's the vibe.
• NBFT_SECURITY_IN_BAND_AUTH_MASK — a mask to get the In-Band Authentication Required field. yes bestie, it's a mask, it masks things, iconic behaviour.
• NBFT_SECURITY_IN_BAND_AUTH_NOT_SUPPORTED — in-band authentication is not supported by the NVM subsystem. it said no thanks. 💀
• NBFT_SECURITY_IN_BAND_AUTH_NOT_REQUIRED — in-band authentication is supported by the NVM subsystem, but it's not required. so like, optional. casual. lowkey available.
• NBFT_SECURITY_IN_BAND_AUTH_REQUIRED — in-band authentication is supported by the NVM subsystem and it is required. mandatory, main character energy, no wiggle room ✨
• NBFT_SECURITY_AUTH_POLICY_LIST_MASK — a mask to get the Authentication Policy List flag. this field tells you whether authentication protocols were indicated by policy from driver defaults, or by administrative configuration. iykyk.
• NBFT_SECURITY_AUTH_POLICY_LIST_NOT_SUPPORTED — the Authentication Protocols Heap Object Reference field's Offset and Length are reserved. nothing to see here, move along 🙈
• NBFT_SECURITY_AUTH_POLICY_LIST_DRIVER — the Authentication Protocols Offset field and the Authentication Protocols Length field indicate a list of authentication protocols that the driver used. driver's choice, periodt.
• NBFT_SECURITY_AUTH_POLICY_LIST_ADMIN — the Authentication Protocols Offset field and the Authentication Protocols Length field indicate a list of authentication protocols that were administratively set and used by the driver. admin said so, and admin ate 🔥
• NBFT_SECURITY_SEC_CHAN_NEG_MASK — a mask to get the Secure Channel Negotiation Required flag. this field tells you whether secure channel negotiation (e.g. TLS) is required.
• NBFT_SECURITY_SEC_CHAN_NEG_NOT_SUPPORTED — secure channel negotiation is not supported by the NVM subsystem. not in this economy 😭
• NBFT_SECURITY_SEC_CHAN_NEG_NOT_REQUIRED — secure channel negotiation is supported by the NVM subsystem, and it's not required. it's there if you want it, bestie 💜
• NBFT_SECURITY_SEC_CHAN_NEG_REQUIRED — secure channel negotiation is supported by the NVM subsystem and it is required. locked in. no exceptions. 🔒
• NBFT_SECURITY_SEC_POLICY_LIST_MASK — a mask to get the Security Policy List flag. this field tells you whether secure channel protocols were indicated by policy from driver defaults, or by administrative configuration.
• NBFT_SECURITY_SEC_POLICY_LIST_NOT_SUPPORTED — the Offset field and Length field in the Secure Channel Algorithm Heap Object Reference field are reserved. reserved, as in, hands off 🚫
• NBFT_SECURITY_SEC_POLICY_LIST_DRIVER — the Heap Object specified by the Secure Channel Algorithm Heap Object Reference field indicates a list of authentication protocols used by the driver. driver defaults, doing their thing.
• NBFT_SECURITY_SEC_POLICY_LIST_ADMIN — the Heap Object specified by the Secure Channel Algorithm Heap Object Reference field indicates a list of authentication protocols that were administratively set and used by the driver. the admin really said "my list, my rules" 💅
• NBFT_SECURITY_CIPHER_RESTRICTED — Cipher Suites Restricted by Policy. if it's set to 1h, then the Cipher Suite Offset field and the Ciper Suite Length field indicate a list of supported cipher suites by the driver. if it's cleared to 0h, then the Cipher Suite Offset field and the Cipher Suite Length field are reserved.
• NBFT_SECURITY_AUTH_DH_GROUPS_RESTRICTED — Authentication DH Groups Restricted by Policy List. if it's set to 1h, then connections shall use one of the authentication DH groups in the Authentication DH Groups List is required. if it's cleared to 0h, then no Authentication DH Groups List is indicated, and use of an authentication DH Group is not required.
• NBFT_SECURITY_SEC_HASH_FUNC_POLICY_LIST — Secure Hash Functions Policy List. if it's set to 1h, then connections shall use one of the secure hash functions in the Secure Hash Functions Policy List is required. if it's cleared to 0h, then no Secure Hash Functions Policy List is indicated, and use of a secure hash function is not required.

---

bestie note: that's all 20 constants, every single flag, mask, and reserved field accounted for. we did not skip a single one because we don't do that here 💖

---

and that's the whole page, fr fr. this was the enum nbft_security_flags section of the API Manual page libnvme(2) — signed off July 2026, and that's a wrap on our little group chat about descriptor flags. go forth and parse responsibly 🦋💅✨