blk_crypto_derive_sw_secret(9)

💖 NAME 💖

okay so this is the blk_crypto_derive_sw_secret(9) manual page, bestie, and it's the kernel API entry for deriving a software secret from a wrapped key. That's the whole vibe: hardware-wrapped key goes in, software secret comes out, no cap. ✨

🛠️ SYNOPSIS 🛠️

int blk_crypto_derive_sw_secret (struct block_device *bdev , const u8
       *eph_key , size_t eph_key_size , u8 sw_secret[BLK_CRYPTO_SW_SECRET_SIZE]
       );

🎀 ARGUMENTS 🎀

• bdev — a block device that supports hardware-wrapped keys. Like, it has to have the hardware-wrapped-key glow-up already, okay?
• eph_key — a hardware-wrapped key in ephemerally-wrapped form. This is the same form it's used in for I/O, iykyk.
• eph_key_size — size of eph_key in bytes.
• sw_secret — (output) the software secret. This is where the derived secret lands, bestie.

🌸 DESCRIPTION 🌸

Given a hardware-wrapped key in ephemerally-wrapped form — the same form that it is used for I/O — you ask the hardware to derive the secret which software can use for cryptographic tasks other than inline encryption. It's giving “hardware does the secret math, software gets a safe little secret for other stuff.” 🦋

This secret is guaranteed to be cryptographically isolated from the inline encryption key, i.e. derived with a different KDF context. No cap, that isolation is the whole point: different KDF context, separate secret vibe. 🔥

👑 RETURN 👑

• 0 on success. Slay.
• -EOPNOTSUPP if the block device doesn't support hardware-wrapped keys.
• -EBADMSG if the key isn't a valid ephemerally-wrapped key.
• or another -errno code.

bestie, keep these return codes in mind: 0, -EOPNOTSUPP, -EBADMSG, or another -errno code. That's the contract. 💅

🌈 SEE ALSO 🌈

Kernel file: ./block/blk-crypto-profile.c

• blk-crypto profiles(9)
• blk_crypto_profile_init(9)
• devm_blk_crypto_profile_init(9)
• blk_crypto_keyslot_index(9)
• blk_crypto_get_keyslot(9)
• blk_crypto_put_keyslot(9)
• blk_crypto_reprogram_all_keys(9)
• blk_crypto_intersect_capabilities(9)
• blk_crypto_has_capabilities(9)
• blk_crypto_update_capabilities(9)

these are the supporting cast, go read them too 🫶

Bye bestie! 💋 This page's source/version is ./block, dated October 2026, and the manual name is blk_crypto_derive_sw_secret(9) — periodt. 🎀