KCAPI_CIPHER_DECRYPT(3)

📦
version 1.5.0 · 7 versions
, in fedora 43

✨ NAME ✨

kcapi_cipher_decrypt — decrypt data (synchronous one shot) 💖

okay bestie, welcome to the KCAPI_CIPHER_DECRYPT(3) page, you're gonna eat this up. it's the one-shot decryption girlie. no streaming, no drama, just one call. periodt.

🌸 SYNOPSIS 🌸

ssize_t kcapi_cipher_decrypt(struct kcapi_handle * handle,
                             const uint8_t * in, size_t inlen,
                             const uint8_t * iv, uint8_t * out,
                             size_t outlen, int access);

🎀 ARGUMENTS 🎀

  • handle — [in] the cipher handle. your main character. 💅
  • in — [in] ciphertext data buffer. this is the scrambled stuff you're trying to un-scramble.
  • inlen — [in] length of the in buffer. she needs to know how much she's working with.
  • iv — [in] the IV to be used for the cipher operation. yes you need it, no you can't skip it, it's giving essential. 🔥
  • out — [out] plaintext data buffer. this is where the readable stuff lands. 🦋
  • outlen — [in] length of the out bufferS 👀 (that trailing S is literally in the manual, i'm just the messenger bestie, not me fixing it 💀)
  • access — [in] kernel access type. pick your fighter:
    • KCAPI_ACCESS_HEURISTIC — use the internal heuristic for the fastest kernel access. let her cook. 👑
    • KCAPI_ACCESS_VMSPLICE — use vmsplice access.
    • KCAPI_ACCESS_SENDMSG — sendmsg access.

💖 DESCRIPTION 💖

okay so, plot twist that's actually not a plot twist: it is perfectly legal to use the same buffer for the plaintext pointer and the ciphertext pointer. same buffer, both jobs, she's versatile like that. ✨ what that means is that after the encryption operation, the ciphertext is overwritten with the plaintext. (yes, the manual says "encryption" here, and i'm repeating it exactly, no notes, we don't edit the ancestors 😭)

about memory: your memory should be aligned at the page boundary, using posix_memalign(sysconf(_SC_PAGESIZE)). if it is not aligned at the page boundary, the vmsplice call may not send all data to the kernel. so like... align it. don't be the girl who forgets to align it. 🙈

and the IV buffer? it must be exactly kcapi_cipher_ivsize bytes in size. exactly. not a byte more, not a byte less. vibe check failed otherwise.

what you get back: the number of bytes decrypted upon success 💚 — or a negative errno-style error code if an error occurred 💀.

🌈 AUTHOR 🌈

Stephan Mueller <smueller@chronox.de> — Author. (we love a credited icon 🫶)

that's the whole page bestie, go decrypt something iconic. this masterpiece is from libkcapi Manual 1.5.0, dated July 2025 — slay, and see you on the KCAPI_CIPHER_DECRYPT(3) side. ⭐💜🎀

📦 where this page comes from