KCAPI_AEAD_DECRYPT_A(3)

💖 kcapi_aead_decrypt_aio — the one where we decrypt AEAD data asynchronously, one shot, no drama 💖

okay bestie, welcome to kcapi_aead_decrypt_aio from section 3 of the manual — yes, the library one, the programming interface, not a command you type in your shell. it's giving "asynchronously decrypt AEAD data (one shot)" and honestly? iconic. let's get into it 🦋

---

✨ NAME ✨

kcapi_aead_decrypt_aio — asynchronously decrypt AEAD data (one shot). periodt. 💅

---

🌸 SYNOPSIS 🌸

ssize_t kcapi_aead_decrypt_aio(struct kcapi_handle * handle,
                               struct iovec * iniov,
                               struct iovec * outiov, size_t iovlen,
                               const uint8_t * iv, int access);

look at that signature. main character energy fr fr. 🫶

---

🎀 ARGUMENTS 🎀

• handle — [in] the cipher handle. your whole little universe of a cipher lives in here.
• iniov — [in] array of scatter-gather list with input buffers. where the encrypted stuff comes in 🍓
• outiov — [out] array of scatter-gather list with output buffers. where the decrypted stuff lands 💖
• iovlen — [in] number of IOVECs in array. literally just how many of them there are.
• iv — [in] IV to be used for cipher operation. the initialization vector, bestie, don't skip her.
• access — [in] kernel access type, and there are three flavors:
  • KCAPI_ACCESS_HEURISTIC — use internal heuristic for fastest kernel access 🏎️
  • KCAPI_ACCESS_VMSPLICE — use vmsplice access
  • KCAPI_ACCESS_SENDMSG — sendmsg access

---

🌈 DESCRIPTION 🌈

okay so. the AEAD cipher operation requires the furnishing of the associated authentication data. the way that this is a whole thing if you forget it. BUT — in case such data is not required, it can be set to NULL and length value must be set to zero. noted. 📝

each IOVEC is processed with its individual AEAD cipher operation. the memory holding the input data will receive the processed data. yes, in-place vibes. 👑

the memory should be aligned at the page boundary using posix_memalign(sysconf(_SC_PAGESIZE)). if it is not aligned at the page boundary, the vmsplice call may not send all data to the kernel. so like… align it. no cap. 🙈

the IV buffer must be exactly kcapi_cipher_ivsize bytes in size. exactly exactly. not "close enough". 💀

to catch authentication errors (i.e. integrity violations) during the decryption operation, the return value of this call should be checked. if this function returns -EBADMSG, an authentication error was detected. so check the return value, bestie, that's the whole point. 🔥

---

💅 IMPORTANT NOTE 💅

the kernel will only process sysconf(_SC_PAGESIZE) * ALG_MAX_PAGES at one time. longer input data cannot be handled by the kernel. so don't come crying to me with your giant buffer. 😭

return number of bytes encrypted upon success; a negative errno-style error code if an error occurred. (yes, the original says "encrypted" even though this is the decrypt function — i'm just the messenger, i keep the facts exactly as they are 🫶)

---

⭐ AUTHOR ⭐

Stephan Mueller <smueller@chronox.de>

• Author.

a legend, honestly. 👑

---

🌟 COPYRIGHT 🌟

that's the whole page, bestie! ✨ this was libkcapi Manual 1.5.0, dated July 2025, and it lives in section 3 under the name kcapi_aead_decrypt_aio. go align your pages, check your -EBADMSG, and slay 💖🎀🦋💜