KCAPI_AEAD_ENCRYPT(3)

💖 KCAPI_AEAD_ENCRYPT 💖

okay bestie, welcome to kcapi_aead_encrypt(3) — straight outta the libkcapi Programming Interface, and she is the one-shot synchronous AEAD glow-up. no cap. let's get into it 🦋

---

✨ NAME ✨

kcapi_aead_encrypt — synchronously encrypt AEAD data, one shot, no redo, periodt. 💅

---

🌸 SYNOPSIS 🌸

ssize_t kcapi_aead_encrypt(struct kcapi_handle * handle,
                           const uint8_t * in, size_t inlen,
                           const uint8_t * iv, uint8_t * out,
                           size_t outlen, int access);

---

🎀 ARGUMENTS 🎀

she takes seven whole args, and every single one is doing her job, okay:

• handle — [in] the cipher handle. your main character. 👑
• in — [in] plaintext data buffer, i.e. the tea before it gets sealed.
• inlen — [in] length of the plaintext buffer.
• iv — [in] the IV to be used for the cipher operation.
• out — [out] the data buffer that holds the cipher text and the authentication tag. two-for-one, iconic. ✨
• outlen — [in] length of the out buffer.
• access — [in] kernel access type. your options are:
  • KCAPI_ACCESS_HEURISTIC — use the internal heuristic to grab the fastest kernel access. the "let her cook" option. 🔥
  • KCAPI_ACCESS_VMSPLICE — use vmsplice access.
  • KCAPI_ACCESS_SENDMSG — use sendmsg access.

---

💜 DESCRIPTION 💜

so, the AEAD cipher operation requires you to furnish the associated authentication data. no auth data, no vibe. but — plot twist — if that data genuinely isn't needed, you can set it to NULL and set the length value to zero. yes really. 🙈

it is perfectly legal to use the same buffer for both the plaintext and ciphertext pointers. what that means, bestie, is that after the encryption operation, the plaintext gets overwritten by the ciphertext. it's giving transformation arc. 🦋

your memory should be aligned at the page boundary using posix_memalign(sysconf(_SC_PAGESIZE)). if it's not aligned at the page boundary, the vmsplice call may not send all the data to the kernel, and that's just sad. 😭

the iv buffer must be exactly kcapi_cipher_ivsize bytes in size. exactly. not vibes-approximately. exactly.

after invoking this function, the caller should use kcapi_aead_getdata_output to obtain the resulting ciphertext and authentication tag references. don't forget her, she's part of the story. 🫶

---

⚠️ IMPORTANT NOTE ⚠️

bestie. listen. the kernel will only process sysconf(_SC_PAGESIZE) * ALG_MAX_PAGES at one time. longer input data cannot be handled by the kernel. that's it. that's the limit. fr fr.

and what does she give you back? the number of bytes encrypted upon success; a negative errno-style error code if an error occurred. 💀

---

🌈 AUTHOR 🌈

Stephan Mueller <smueller@chronox.de>

• Author. (yes, THE author. respect the icon. 👑)

---

📜 COPYRIGHT 📜

that's the whole page, bestie! 💖 this one comes from the libkcapi Manual 1.5.0, dated July 2025 — go encrypt something slay, and remember: aligned memory, correct IV size, no cap. periodt. 💅✨🎀