KCAPI_AKCIPHER_VERIF(3)

💖 KCAPI_AKCIPHER_VERIF — signature verification, bestie edition 💖

okay so this page is KCAPI_AKCIPHER_VERIF(3) from the Programming Interface section, and it's literally the whole vibe of "did this signature actually come from who it says it did" 🕵️♀️✨

---

🌸 NAME 🌸

kcapi_akcipher_verify — signature verification. that's it, that's the whole job. she verifies signatures. queen behavior 👑

---

✨ SYNOPSIS ✨

ssize_t kcapi_akcipher_verify(struct kcapi_handle * handle,
                              const uint8_t * in, size_t inlen,
                              uint8_t * out, size_t outlen, int access);

---

🎀 ARGUMENTS 🎀

• handle — [in] the cipher handle. your girl. your main character. the thing you already set up 💅
• in — [in] the message data buffer. this is the data whose signature we're checking.
• inlen — [in] how long in is. the length. the size. the amount of stuff. 🍓
• out — [out] the signature data buffer. yes it's marked out, and yes that's a whole thing — read the DESCRIPTION, bestie 👀
• outlen — [in] the length of the out buffer. she needs to know how much room she has.
• access — [in] the kernel access type, pick your fighter:
  • KCAPI_ACCESS_HEURISTIC — uses the internal heuristic to find the fastest kernel access 🔥
  • KCAPI_ACCESS_VMSPLICE — uses the vmsplice access
  • KCAPI_ACCESS_SENDMSG — uses the sendmsg access

---

💜 DESCRIPTION 💜

okay so first thing, and this is important: it is perfectly legal to use the same buffer for the message pointer and the signature pointer. same buffer, both jobs, no drama. 🫶 but like, think about what that means — after the signature generation operation, the message gets overwritten with the signature. so your original message? gone. replaced. it's giving "we traded". 💀

now, the memory situation. you should align it at the page boundary using posix_memalign(sysconf(_SC_PAGESIZE)). and I mean should, because if it is not aligned at the page boundary, the vmsplice call may not send all the data to the kernel. not all of it. some of it just… stays home. 😭 so align it, fr fr.

if the output size is insufficiently large, -EINVAL gets returned. so the output buffer must be at least as large as the modulus of the key you're using — that's the floor, that's the minimum, do not test her. 📏

and now the part you cannot skip: to catch signature verification errors, you must check the return value of this call. like actually check it. if this function returns -EBADMSG, the verification of the signature failed. that's the whole point of the call, bestie, don't just call it and walk away 🙈

return value breakdown:

• on success, it returns the number of bytes returned by the signature ver operation 🎉
• if an error occurred, you get a negative errno-style error code back

⚠️ no cap: an unchecked return value here is a vibe check you will fail. -EBADMSG means the signature did not verify. periodt. 👑

---

🌈 AUTHOR 🌈

Stephan Mueller <smueller@chronox.de>

• Author.

---

👑 COPYRIGHT 👑

that's the whole page, bestie, go forth and verify responsibly 💅

---

and that's a wrap! this was libkcapi Manual 1.5.0, dated July 2025 — mwah, iconic, no notes 💖✨🦋🎀