KCAPI_AEAD_ENCRYPT_A(3)

✨ kcapi_aead_encrypt_aio ✨

okay bestie, gather round 💖 this is the kcapi_aead_encrypt_aio(3) page from the libkcapi Manual — like, the async one-shot AEAD encrypt girlie. she's from version 1.5.0, dated July 2025, and yes we're gonna get into all of it. no skips. periodt.

---

🌸 NAME 🌸

kcapi_aead_encrypt_aio — asynchronously encrypt AEAD data (one shot). literally what it says on the tin 💅

---

🎀 SYNOPSIS 🎀

ssize_t kcapi_aead_encrypt_aio(struct kcapi_handle * handle,
                               struct iovec * iniov,
                               struct iovec * outiov, size_t iovlen,
                               const uint8_t * iv, int access);

---

🦋 ARGUMENTS 🦋

• handle — [in] the cipher handle. your main character, fr.
• iniov — [in] array of scatter-gather list with input buffers. this is where your data lives going in.
• outiov — [out] array of scatter-gather list with output buffers. this is where the glow-up lands.
• iovlen — [in] number of IOVECs in the array. bestie, count them correctly or it's giving chaos.
• iv — [in] the IV to be used for the cipher operation.
• access — [in] kernel access type. your options are:
  • KCAPI_ACCESS_HEURISTIC — use internal heuristic for fastest kernel access (the "just pick for me" option, iconic)
  • KCAPI_ACCESS_VMSPLICE — use vmsplice access
  • KCAPI_ACCESS_SENDMSG — sendmsg access

---

💜 DESCRIPTION 💜

so, the AEAD cipher operation requires you to furnish the associated authentication data. but if you don't need that data? totally fine — set it to NULL and the length value must be set to zero. no vibes-based guessing here, okay? zero means zero. 🫶

Each IOVEC gets processed with its own individual AEAD cipher operation. and heads up: the memory holding the input data will receive the processed data. she writes in place, she's efficient like that.

the memory should be aligned at the page boundary using posix_memalign(sysconf(_SC_PAGESIZE)). If it is not aligned at the page boundary, the vmsplice call may not send all data to the kernel. and like... that's a silent-ish data loss situation and we do not stan 😭

The IV buffer must be exactly kcapi_cipher_ivsize bytes in size. exactly. not "around that". exactly.

After invoking this function the caller should use kcapi_aead_getdata_output to obtain the resulting ciphertext and authentication tag references. so don't forget your follow-up call, that's the second half of the choreography 💃

---

🔥 IMPORTANT NOTE 🔥

The kernel will only process sysconf(_SC_PAGESIZE) * ALG_MAX_PAGES at one time. Longer input data cannot be handled by the kernel. like, at all. so if you were planning to just yeet a giant buffer at it, that's a no. split it up, bestie. 💀

return number of bytes encrypted upon success; a negative errno-style error code if an error occurred. so like, positive = slay, negative = the errno is telling you what went wrong, read it 🍓

---

👑 AUTHOR 👑

Stephan Mueller <smueller@chronox.de>

• Author.

---

🌈 COPYRIGHT 🌈

that's the whole page bestie, go forth and encrypt asynchronously ✨

libkcapi Manual version 1.5.0, July 2025 — mwah, love u, drink water, align your pages 💖🧚🌸