aes_gcm_init(9)

📦 version 7.3.1, in nixpkgs unstable

💅 aes_gcm_init(9)

okay so this is a page straight out of the Kernel API Manual, and honestly? it's kind of a big deal. bestie, we're talking about aes_gcm_init — the little function that kicks off AES-GCM. buckle up 🎀

✨ NAME ✨

aes_gcm_init — initializes the context for incremental AES-GCM encryption or decryption, or for AES-GMAC computation. that's it, that's the vibe 💖

🦋 SYNOPSIS 🦋

void aes_gcm_init (struct aes_gcm_ctx *ctx , const u8 nonce[static 12] ,
const struct aes_gcm_key *key );

like, look at her. tiny signature, huge responsibility. 🔥

🌸 ARGUMENTS 🌸

  • ctx — the context you're initializing. this is her moment, this is her main character energy 👑
  • nonce — the 12-byte nonce. and listen, this part is not a joke: every single (key, nonce) pair you use for encryption or MAC generation MUST be distinct. no repeating, no recycling, no "eh it's probably fine". it is not fine. 💀
  • key — the key, which you've already prepped with aes_gcm_preparekey. ⚠️ heads up though: a pointer to the key gets saved inside the context, so that key must live at least as long as the context does. no yeeting it out of scope early, bestie, that's how you get undefined behavior and a bad time 😭

💜 DESCRIPTION 💜

so, first things first: the context should be zeroized when it's done living its life. usually that zeroization just happens on its own inside aes_gcm_encrypt_final or aes_gcm_decrypt_final — slay, automatic. 🫶 but if you're the kind of caller who abandons a context without ever finalizing it? yeah, you gotta zeroize it explicitly. no skipping. 🧹

IMPORTANT 🔥 if you're decrypting data, or computing a GMAC value for verification, you MUST NOT assume that any decrypted data or associated data is authentic until the authentication tag has actually been verified. like, at all. zero trust until the tag checks out, periodt. 💅

and why does this incremental API even exist? because some callers can't efficiently use the one-shot functions — their data layout is nonlinear. that's the only reason. it's giving "specialized tool for a specialized problem." 🌈

🍓 incremental AES-GCM encryption

here's the recipe, in order:

  1. aes_gcm_init
  2. aes_gcm_auth_update (any number of times)
  3. aes_gcm_encrypt_update (any number of times)
  4. aes_gcm_encrypt_final

🍓 incremental AES-GCM decryption

same energy, different middle steps:

  1. aes_gcm_init
  2. aes_gcm_auth_update (any number of times)
  3. aes_gcm_decrypt_update (any number of times)
  4. aes_gcm_decrypt_final

🍓 incremental AES-GMAC computation

fun fact: AES-GMAC is just AES-GCM with zero bytes en/decrypted. literally the same thing with nothing going in or out, iconic. ✨ so for incremental AES-GMAC:

  1. aes_gcm_init
  2. aes_gcm_auth_update (any number of times)
  3. aes_gcm_encrypt_final to return the computed tag to the caller, or aes_gcm_decrypt_final to directly verify the computed tag

see? two paths, both valid, pick your fighter. 🥊

⭐ CONTEXT ⭐

Any context. (yes really, she's flexible like that 🦋)

👑 SEE ALSO 👑

Kernel file ./include/crypto/aes-gcm.h, plus the whole friend group:

go read them, iykyk 📚💖

and that's the whole page, bestie! 🎀 this lil masterpiece lives in ./include/crypto and it's dated October 2026 — go off, future manpage. mwah. 💋✨

📦 where this page comes from