KCAPI_AEAD_STREAM_IN(3)

💖 kcapi_aead_stream_init_dec — start a decryption operation (stream) 💖

okay bestie, we're deep in the libkcapi manual, section 3, and this page is literally the kickoff call for streaming AEAD decryption. buckle up, it's giving ✨cryptographic slay✨.

---

🎀 NAME 🎀

kcapi_aead_stream_init_dec — start a decryption operation (stream)

---

🌸 SYNOPSIS 🌸

ssize_t kcapi_aead_stream_init_dec(struct kcapi_handle * handle,
                                   const uint8_t * iv,
                                   struct iovec * iov, size_t iovlen);

---

🦋 ARGUMENTS 🦋

• handle — [in] cipher handle. it's your ✨handle✨, the little grip on the cipher you're working with.
• iv — [in] IV to be used for cipher operation. the initialization vector, no cap.
• iov — [in] scatter/gather list with data to be encrypted. This is the pointer to the first iov entry if an array of iov entries is supplied. See sendmsg(2) for details on how iov is to be used. This pointer may be NULL if no data to be encrypted is available at the point of the call.
• iovlen — [in] number of scatter/gather list elements. If iov is NULL, this value must be zero. 🚨 like, zero-zero, bestie, don't test it.

---

💅 DESCRIPTION 💅

A stream decryption operation is started with this call. Multiple successive kcapi_aead_stream_update function calls can be invoked to send more ciphertext data to be encrypted. The kernel buffers the input until kcapi_aead_stream_op picks up the decrypted data. Once ciphertext is decrypted during the kcapi_aead_stream_op it is removed from the kernel buffer.

okay so this is the part where the group chat goes quiet: Note, unlike the corresponding symmetric cipher API, the function calls of kcapi_aead_stream_update and kcapi_aead_stream_op cannot be mixed! This due to the nature of AEAD where the cipher operation ensures the integrity of the entire data (decryption) or calculates a message digest over the entire data (encryption).

fr fr, no mixing, it's not that kind of party 🚫🎉

When using the stream API, the caller must ensure that data is sent in the correct order (regardless whether data is sent in multiple chunks using kcapi_aead_stream_init_enc or kcapi_cipher_stream_update):

1. the complete associated data must be provided, followed by
2. the plaintext.

For decryption, also:

3. the tag value must be sent.

the order is the whole vibe check here — mess it up and everything falls apart 💀

The IV buffer must be exactly kcapi_cipher_ivsize bytes in size. not one byte more, not one byte less, she's precise 💅

return number of bytes sent to the kernel upon success; a negative errno-style error code if an error occurred. 👑

---

👑 AUTHOR 👑

Stephan Mueller <smueller@chronox.de> Author.

---

🌈 COPYRIGHT 🌈

and that's the whole page, bestie!! we made it 🫶 this lil slice of the libkcapi Manual 1.5.0, dated July 2025, is officially decoded. go forth and stream your AEAD decryption responsibly, mwah 💖🎀✨