KRB5_MK_SAFE(3)

💖 KRB5_MK_SAFE(3) 💖

okay bestie, so this one is from the Library Functions Manual, and it's giving krb5_mk_safe and its chaotic sibling krb5_mk_priv. two functions, one manpage, zero chill. let's get into it 🫶

✨ NAME ✨

krb5_mk_safe, krb5_mk_priv — generates integrity protected and/or encrypted messages

like… it literally makes messages that are safe. and/or private. the naming team ate fr fr 🔥

📚 LIBRARY 📚

Kerberos 5 Library (libkrb5, -lkrb5)

so you gotta link against libkrb5 with -lkrb5, no cap. the Kerberos 5 Library is the main character here 👑

🌸 SYNOPSIS 🌸

#include <krb5.h>

krb5_error_code
krb5_mk_priv(krb5_context context, krb5_auth_context auth_context,
    const krb5_data *userdata, krb5_data *outbuf,
    krb5_replay_data *outdata);

krb5_error_code
krb5_mk_safe(krb5_context context, krb5_auth_context auth_context,
    const krb5_data *userdata, krb5_data *outbuf,
    krb5_replay_data *outdata);

not me including <krb5.h> obviously, like where else would these live 💅 both of them return a krb5_error_code and take the exact same five args. twins. iconic behaviour.

🦋 DESCRIPTION 🦋

so krb5_mk_safe() and krb5_mk_priv() format KRB-SAFE (integrity protected) and KRB-PRIV (also encrypted) messages into outbuf. that's the whole glow-up: safe = protected, priv = protected and encrypted. pick your fighter ✨

the actual message data is taken from userdata. that's your stuff, your payload, your little data baby, and it goes in as a const krb5_data *.

now here's the spicy part 🌶️ — if the KRB5_AUTH_CONTEXT_DO_SEQUENCE or KRB5_AUTH_CONTEXT_DO_TIME flags are set in the auth_context, then sequence numbers and time stamps get generated. so like, if you flipped those flags on, the function's gonna do the extra work for you, periodt.

and if the KRB5_AUTH_CONTEXT_RET_SEQUENCE or KRB5_AUTH_CONTEXT_RET_TIME flags are set, then those are also returned in the outdata parameter. so it's not just generating them, it's handing them back to you in outdata. you get the receipts 🧾

lowkey important: DO_ flags = generate them. RET_ flags = give them back to me. that's the whole vibe check on these four flags, iykyk.

👀 SEE ALSO 👀

• krb5_auth_con_init(3)
• krb5_rd_priv(3)
• krb5_rd_safe(3)

like yeah go read the read-side ones too, rd is the reverse of mk, you're gonna need both if you're actually doing the thing 💜

and that's the whole page bestie!! 🌈 this one's from HEIMDAL, dated May 1, 2006 — yes she's an elder but she still serves 💅 go forth and protect your messages, you've got this 🎀💖✨