KRB5_C_MAKE_CHECKSUM(3)

💖 KRB5_C_MAKE_CHECKSUM 💖

okay bestie, sit down, hydrate, because we're about to talk about the Kerberos 5 crypto API and honestly? it's giving ✨cryptographic excellence✨. this is the manual page for KRB5_C_MAKE_CHECKSUM(3), and the whole little fam of krb5_c_* functions is in here. no cap. 💅

🌸 NAME 🌸

so the icons in this friend group are:

• krb5_c_block_size
• krb5_c_decrypt
• krb5_c_encrypt
• krb5_c_encrypt_length
• krb5_c_enctype_compare
• krb5_c_get_checksum
• krb5_c_is_coll_proof_cksum
• krb5_c_is_keyed_cksum
• krb5_c_keylength
• krb5_c_make_checksum
• krb5_c_make_random_key
• krb5_c_set_checksum
• krb5_c_valid_cksumtype
• krb5_c_valid_enctype
• krb5_c_verify_checksum
• krb5_c_checksum_length

and collectively they're the Kerberos 5 crypto API. the way that's a whole squad 🫶

📚 LIBRARY 📚

this lives in the Kerberos 5 Library, aka libkrb5, and you link it with -lkrb5. periodt.

✨ SYNOPSIS ✨

first, the classic move:

#include <krb5.h>

then, the whole lineup, exactly as written, no edits, we don't touch the source around here:

krb5_error_code
krb5_c_block_size(krb5_context context, krb5_enctype enctype,
    size_t *blocksize);

krb5_error_code
krb5_c_decrypt(krb5_context context, const krb5_keyblock key,
    krb5_keyusage usage, const krb5_data *ivec, krb5_enc_data *input,
    krb5_data *output);

krb5_error_code
krb5_c_encrypt(krb5_context context, const krb5_keyblock *key,
    krb5_keyusage usage, const krb5_data *ivec, const krb5_data *input,
    krb5_enc_data *output);

krb5_error_code
krb5_c_encrypt_length(krb5_context context, krb5_enctype enctype,
    size_t inputlen, size_t *length);

krb5_error_code
krb5_c_enctype_compare(krb5_context context, krb5_enctype e1,
    krb5_enctype e2, krb5_boolean *similar);

krb5_error_code
krb5_c_make_random_key(krb5_context context, krb5_enctype enctype,
    krb5_keyblock *random_key);

krb5_error_code
krb5_c_make_checksum(krb5_context context, krb5_cksumtype cksumtype,
    const krb5_keyblock *key, krb5_keyusage usage,
    const krb5_data *input, krb5_checksum *cksum);

krb5_error_code
krb5_c_verify_checksum(krb5_context context, const krb5_keyblock *key,
    krb5_keyusage usage, const krb5_data *data,
    const krb5_checksum *cksum, krb5_boolean *valid);

krb5_error_code
krb5_c_checksum_length(krb5_context context, krb5_cksumtype cksumtype,
    size_t *length);

krb5_error_code
krb5_c_get_checksum(krb5_context context, const krb5_checksum *cksum,
    krb5_cksumtype *type, krb5_data **data);

krb5_error_code
krb5_c_set_checksum(krb5_context context, krb5_checksum *cksum,
    krb5_cksumtype type, const krb5_data *data);

krb5_boolean
krb5_c_valid_enctype(krb5_enctype, etype");

krb5_boolean
krb5_c_valid_cksumtype(krb5_cksumtype ctype);

krb5_boolean
krb5_c_is_coll_proof_cksum(krb5_cksumtype ctype);

krb5_boolean
krb5_c_is_keyed_cksum(krb5_cksumtype ctype);

krb5_error_code
krb5_c_keylengths(krb5_context context, krb5_enctype enctype,
    size_t *inlength, size_t *keylength);

🦋 DESCRIPTION 🦋

okay so the plot: every function that starts with krb5_c is a compat function with MIT kerberos. iykyk. 🤝

now, the krb5_enc_data structure? she holds an encrypted data (yes, the original says it like that, we respect the typo in spirit but not in copy). there are two publicly accessible members of krb5_enc_data:

• enctype — holds the encryption type of the data that got encrypted
• ciphertext — a krb5_data that might contain the encrypted data

💜 the functions, one by one 💜

• krb5_c_block_size() — returns the blocksize of the encryption type. that's it, that's the whole job, and she does it flawlessly 👑
• krb5_c_decrypt() — decrypts input and stores the data in output. if ivec is NULL, the default initialization vector for that encryption type gets used. convenient? yes. iconic? also yes.
• krb5_c_encrypt() — takes the plaintext in input, encrypts it, and stores the ciphertext in output. main character energy fr fr.
• krb5_c_encrypt_length() — returns the length the encrypted data will be, given the plaintext length. future-telling but make it crypto 🔮
• krb5_c_enctype_compare() — compares two encryption types and tells you if they use compatible encryption key types.
• krb5_c_make_checksum() — creates a checksum cksum with the checksum type cksumtype of the data in data. key and usage get used if the checksum is a keyed checksum type. returns 0 or an error code.
• krb5_c_verify_checksum() — verifies the checksum of the data in cksum that was created with key using the key usage usage. the verify-out param gets set to non-zero if the checksum verifies correctly and zero if it doesn't (the signature calls it valid, same vibe). returns 0 or an error code.
• krb5_c_checksum_length() — returns the length of the checksum. short and sweet.
• krb5_c_set_checksum() — sets the krb5_checksum structure given type and data.

⚠️ important bestie: the content of cksum should be freeed with krb5_c_free_checksum_contents(). (yes, "freeed" — that's the original spelling, we're keeping it, it's part of the lore.) don't leak, it's not cute 💀

• krb5_c_get_checksum() — retrieves the components of the krb5_checksum structure.

🎀 data should be freed with krb5_free_data(). and if either data or checksum isn't needed by your application, you can just pass in NULL. flexible queen.

• krb5_c_valid_enctype() — returns true if etype is a valid encryption type.
• krb5_c_valid_cksumtype() — returns true if ctype is a valid checksum type.
• krb5_c_is_keyed_cksum() — returns true if ctype is a keyed checksum type.
• krb5_c_is_coll_proof_cksum() — returns true if ctype is a collision proof checksum type.
• krb5_c_keylengths() — returns the minimum length (inlength) in bytes needed to create a key, plus the length (keylength) of the resulting key, for the enctype. two answers in one call, efficient diva 💅

👀 SEE ALSO 👀

go read these next, bestie, they're the extended universe:

• krb5(3)
• krb5_create_checksum(3)
• krb5_free_data(3)
• kerberos(8)

and that's the whole page, no notes, we ate that up 🌈⭐

this lil masterpiece came from HEIMDAL, dated Nov 17, 2006, and it's filed under KRB5_C_MAKE_CHECKSUM(3). slay, bye bestie 💖🦋🎀