cnstr_shdsc_aead_encap(9)

📦 version 7.3.1, in nixpkgs unstable

🌸 cnstr_shdsc_aead_encap — NAME 💅

okay so bestie, welcome to the Kernel API Manual ✨ — this page is literally all about cnstr_shdsc_aead_encap, which is the IPSec ESP encapsulation shared descriptor builder, and no cap, it's the non-protocol one 🫶. That's the whole vibe. iykyk.

✨ SYNOPSIS ✨

void cnstr_shdsc_aead_encap (u32 * const desc , struct alginfo *cdata ,
struct alginfo *adata , unsigned int ivsize , unsigned int icvsize ,
const bool is_rfc3686 , u32 *nonce , const u32 ctx1_iv_off , const bool
is_qi , int era );

like, that's the whole signature 🎀 copy it exactly, don't be weird about it.

🦋 ARGUMENTS 🦋

okay this is the part where we go through every single param one by one, no skipping, no "tl;dr" — we eat every bite 🍓

  • desc — pointer to the buffer used for descriptor construction. it's giving "the canvas, the main character" 🎨
  • cdata — pointer to the block cipher transform definitions. valid algorithm values are one of OP_ALG_ALGSEL_{AES, DES, 3DES} ANDed with OP_ALG_AAI_CBC or OP_ALG_AAI_CTR_MOD128. like, pick one and AND it, that's the assignment 💅
  • adata — pointer to the authentication transform definitions. heads up bestie: a split key is required for SEC Era < 6, and in that case the size of the split key is specified in this field. valid algorithm values are one of OP_ALG_ALGSEL_{MD5, SHA1, SHA224, SHA256, SHA384, SHA512} ANDed with OP_ALG_AAI_HMAC_PRECOMP. same deal, ANDed, not OR'd, don't try it 🙈
  • ivsize — initialization vector size. that's it, that's the whole thing ✨
  • icvsize — integrity check value (ICV) size, and it can be truncated or full. your call, queen 👑
  • is_rfc3686 — true when ctr(aes) is wrapped by the rfc3686 template. so like, the little rfc3686 wrapper jacket for ctr(aes) 🧥
  • nonce — pointer to the rfc3686 nonce. yes it's a real word, yes it's iconic ⭐
  • ctx1_iv_off — IV offset in the CONTEXT1 register. register lore, fr fr 🔥
  • is_qi — true when called from caam/qi. context matters, bestie 🌈
  • era — SEC Era. the era. the moment. the timeline 💀 (remember, adata's split key requirement depends on this being < 6, so don't sleep on it)
lowkey important: those algorithm values in cdata and adata are ANDed with the AAI flag — that's not a suggestion, that's the spec 😭 keep the exact constants, no renaming, no "fixing."

🎀 SEE ALSO 🎀

in the kernel file ./drivers/crypto/caam/caamalg_desc.c — that's where the source lives, go look, it's giving homework but make it fun 📚

and then the whole friend group, literally the entire squad of descriptor builders:

all of them, together, slaying in their own lanes 💖

and that's the page!! 🌸 this lil manual came from the source tree at ./drivers/crypto/caam, dated October 2026, living under the Kernel API Manual umbrella, and it's all about cnstr_shdsc_aead_encap(9) — stan the ESP encapsulation descriptor builder, periodt 👑💜🦋

📦 where this page comes from