KCAPI_CIPHER_DECRYPT(3)

✨ KCAPI_CIPHER_DECRYPT(3) — aka the "Programming Interface" girlies' guide ✨

okay so bestie, this is the page for kcapi_cipher_decrypt_aio and it lives in section 3 of the manual under Programming Interface. it's giving "decrypt data (asynchronous one shot)" and honestly? iconic. let's get into it 💅

---

🌸 NAME 🌸

kcapi_cipher_decrypt_aio — decrypt data (asynchronous one shot). no cap, that's the whole vibe. 🦋

---

🎀 SYNOPSIS 🎀

ssize_t kcapi_cipher_decrypt_aio(struct kcapi_handle * handle,
                                 struct iovec * iniov,
                                 struct iovec * outiov, size_t iovlen,
                                 const uint8_t * iv, int access);

---

💖 ARGUMENTS 💖

• handle — [in] the cipher handle. it's your main character, the one holding everything together. 👑
• iniov — [in] head of the scatter-gather list array that's holding the ciphertext. the mystery box, basically. 🔥
• outiov — [out] head of the scatter-gather list with the destination buffers for the plaintext. this is where the decrypted tea gets poured. 🍓
• iovlen — [in] the number of scatter-gather list entries. literally just the headcount. 🙈
• iv — [in] the IV to be used for the cipher operation. ✨
• access — [in] kernel access type. your options are, in order:
  • KCAPI_ACCESS_HEURISTIC — use the internal heuristic for the fastest kernel access
  • KCAPI_ACCESS_VMSPLICE — use vmsplice access
  • KCAPI_ACCESS_SENDMSG — sendmsg access

---

🦋 DESCRIPTION 🦋

so the way that this works is: the individual scatter-gather list entries are each processed with separate invocations of the given cipher. not one big gulp, a lil sip each. okayyy. 😌

⚠️ your memory should be aligned at the page boundary using posix_memalign(sysconf(_SC_PAGESIZE)). if it is not aligned at the page boundary, the vmsplice call may not send all data to the kernel. and that's the kind of situation that has me on the floor, honestly. 😭

also, highkey important: the IV buffer must be exactly kcapi_cipher_ivsize bytes in size. not one byte more, not one byte less. periodt. 💅

and the return situation:

• returns the number of bytes decrypted upon success 🌈
• returns a negative errno-style error code if an error occurred 💀

---

💜 AUTHOR 💜

Stephan Mueller <smueller@chronox.de>

• Author.

---

🌟 COPYRIGHT 🌟

---

okay that's the whole page, bestie, go forth and decrypt responsibly 🫶 and yes, this was libkcapi Manual 1.5.0, from July 2025 — the KCAPI_CIPHER_DECRYPT(3) era, we were all there, it was everything. bye bye 💖✨🧚