gnutls_hpke_decap(3)

📦 version 3.8.13, in alpine 3.22, alpine 3.23, alpine 3.24, arch rolling, fedora 43, fedora 44, ubuntu stonking

💖 gnutls_hpke_decap 💖

okay bestie, this page is from the gnutls manual (section 3, the library-call girlies) and it's all about gnutls_hpke_decap — the API function that does HPKE decapsulation. grab a strawberry 🍓 and let's get into it.

✨ NAME ✨

gnutls_hpke_decap — an API function, no cap

🌸 SYNOPSIS 🌸

#include <gnutls/hpke.h>

int gnutls_hpke_decap(gnutls_hpke_context_t ctx, const gnutls_datum_t *
info, const gnutls_datum_t * enc, const gnutls_privkey_t
receiver_privkey, const gnutls_pubkey_t sender_pubkey, const
gnutls_datum_t * psk, const gnutls_datum_t * psk_id);

🎀 ARGUMENTS 🎀

  • gnutls_hpke_context_t ctx — the HPKE context you're decapsulating with, your main character ✨
  • const gnutls_datum_t * info — the application-specific info that got baked into the key schedule. optional, so you can leave it out
  • const gnutls_datum_t * enc — a pointer to a gnutls_datum_t holding the encapsulated key that the sender sent you 📬
  • const gnutls_privkey_t receiver_privkey — the receiver's private key, aka your key, the one doing the decapsulation 💅
  • const gnutls_pubkey_t sender_pubkey — the sender's public key, only needed for the AuthDecap operation. also optional
  • const gnutls_datum_t * psk — the pre-shared key. optional
  • const gnutls_datum_t * psk_id — the pre-shared key identifier. optional too, she's flexible

🦋 DESCRIPTION 🦋

so this function runs the decapsulation operation of HPKE. she takes the encapsulated key (enc) that came from the sender, pairs it with the receiver's private key, and derives the shared secret from them. then she takes that shared secret plus any application-specific info you handed her (info) and sets up all the necessary keys and nonces inside the HPKE context, so that all your later sealing and opening operations just work. iconic behavior fr fr 🔥

⚠️ you get to call this function once per HPKE context, and it has to happen before any calls to gnutls_hpke_open(). no skipping the line, bestie.

enc should be the exact same encapsulated key that gnutls_hpke_encap() generated on the sender's side — like, literally the same one, don't freestyle it.

receiver_privkey has to be a valid private key that's compatible with the KEM algorithm specified in the HPKE context, and it has to correspond to the receiver's public key that was used during encapsulation. vibe check your key before you pass it in, ngl.

for GNUTLS_HPKE_MODE_AUTH or GNUTLS_HPKE_MODE_AUTH_PSK, sender_pubkey must be a valid public key that can be used for authentication. and for GNUTLS_HPKE_MODE_PSK or GNUTLS_HPKE_MODE_AUTH_PSK, you gotta supply a pre-shared key (psk) plus its identifier (psk_id). no psk, no service 🙈

⭐ RETURNS ⭐

0 on success, or a negative error code on failure. slay when it's zero, cry when it's negative 😭

🌈 SINCE 🌈

3.8.13 — she's been here since then, periodt

💜 REPORTING BUGS 💜

found a bug? tell the girlies at <bugs@gnutls.org>.

home page: https://www.gnutls.org

Copyright © 2001-2023 Free Software Foundation, Inc., and others.

copying and distribution of this file, with or without modification, are permitted in any medium without royalty provided the copyright notice and this notice are preserved. so yes, you may share her 💅

🧚 SEE ALSO 🧚

the full documentation for gnutls is maintained as a Texinfo manual. if the /usr/share/doc/gnutls/ directory does not contain the HTML form, visit

https://www.gnutls.org/manual/

and that's the whole page, bestie!! this was gnutls_hpke_decap(3) from the gnutls manual, version 3.8.13 — ty for reading, mwah 🫶✨🎀

📦 where this page comes from