crypto_krb5_decrypt(9)

📦 version 7.3.1, in nixpkgs unstable

💅 crypto_krb5_decrypt(9) — like, the Kernel API Manual page, bestie

okay so you're in the Kernel API Manual and the page is crypto_krb5_decrypt(9). buckle up 🎀

✨ NAME ✨

crypto_krb5_decrypt — validate and remove Kerberos encryption and integrity. that's the whole vibe. it checks the crypto, then yeets it off your buffer. 🦋

🌸 SYNOPSIS 🌸

int crypto_krb5_decrypt (const struct krb5_enctype *krb5 , struct
crypto_aead *aead , struct scatterlist *sg , unsigned int nr_sg , size_t
*_offset , size_t *_len );

🫶 ARGUMENTS 🫶

  • krb5 — the encoding to use. like, which flavour of Kerberos we're doing today ✨
  • aead — the keyed crypto object to use. it's the one holding the key, very main character energy 👑
  • sg — scatterlist defining the crypto buffer. that's the actual memory, sliced up 💫
  • nr_sg — the number of elements in sg. count 'em 📋
  • _offset — offset of the secure blob in the buffer; gets updated to the data offset. so it comes in as one thing and leaves as another, glow-up fr 💅
  • _len — the length of the secure blob; gets updated to the data length. same deal, she changes too 🦋

💖 DESCRIPTION 💖

so using the specified Kerberos encoding, this thing checks and removes the integrity checksum and decrypts the secure region, stripping off the confounder. yes, the confounder. it's giving "the filler bits before your actual data" and we are NOT keeping her 🧚

if it's successful, _offset and _len are updated to outline the region in which the data plus the trailing padding are stored. lowkey important: the caller is responsible for working out how much padding there is and removing it. that's on YOU, bestie — this function hands you the region and dips 🙈

returns 0 if successful, and -ENOMEM on an allocation failure. it sets *_error_code and returns -EPROTO if the data cannot be parsed, or -EBADMSG if the integrity checksum doesn't match (yes, the original page has a stray ) there, we're keeping the lore 🤭). other errors may also be returned from the crypto layer — so like, don't assume these are the only ones, okay? 😭

ngl this one is a whole pipeline: parse, verify, decrypt, strip, hand back. if the checksum don't match you get -EBADMSG and nothing is yours. periodt 💀

🌈 SEE ALSO 🌈

kernel file ./crypto/krb5/krb5_api.c — that's the home base 🏠

and the whole friend group:

aaaand that's the page!! 💜 brought to you by ./crypto/krb5, dated October 2026, filed under crypto_krb5_decrypt(9) — mwah, go decrypt something iconic ⭐🔥

📦 where this page comes from