crypto_krb5_encrypt(9)

📦 version 7.3.1, in nixpkgs unstable

💅 crypto_krb5_encrypt(9) — the Kernel API Manual glow-up ✨

okay so bestie, welcome to the Kernel API Manual entry for crypto_krb5_encrypt(9) — the function that does the Kerberos encryption and the integrity thing in one go, and yes it's giving main character energy 🔥

✨ NAME ✨

crypto_krb5_encrypt — applies Kerberos encryption and integrity, together, periodt.

🦋 SYNOPSIS 🦋

ssize_t crypto_krb5_encrypt (const struct krb5_enctype *krb5 , struct
crypto_aead *aead , struct scatterlist *sg , unsigned int nr_sg , size_t
sg_len , size_t data_offset , size_t data_len , bool preconfounded );

🎀 ARGUMENTS 🎀

like, every single one of them, no skipping 🙈

  • krb5 — the encoding to use. this is the vibe you're encrypting with ✨
  • aead — the keyed crypto object to use. it's literally the keyed one, so it's important, iykyk.
  • sg — the scatterlist that defines the crypto buffer 🌸
  • nr_sg — how many elements are in sg. count 'em.
  • sg_len — the size of the buffer 🫶
  • data_offset — where the data actually starts inside the sg buffer, like an offset bestie
  • data_len — the length of the data. yes, the data. you got this.
  • preconfounded — True if the confounder is already inserted. that's it, that's the flag 💅

💖 DESCRIPTION 💖

so here's the tea ☕ — using the specified Kerberos encoding, this function inserts a confounder and any padding as needed, then encrypts this and the data in place, and finally inserts an integrity checksum into the buffer. all in one function. iconic behaviour, honestly 👑

the buffer must include space for the confounder, the checksum, and any padding required — so no showing up with a buffer that's too small, that's not the move 😭. the caller can also preinsert the confounder into the buffer (for testing, for example 🧪).

and like, important detail: the resulting secured blob may be less than the size of the buffer. don't panic, it's fine, that's just how it be ✨

Returns the size of the secure blob if successful 🎉 — otherwise:

  • -ENOMEM on an allocation failure 💀
  • -EFAULT if there is insufficient space 😭
  • -EMSGSIZE if the confounder is too short or the data is misaligned 🙈
ngl, other errors may also be returned from the crypto layer, so keep an eye out bestie 👀

🧚 SEE ALSO 🧚

the whole friend group, fr fr:

and that's the whole page bestie, slay 💅✨

— source lives at ./crypto/krb5, dated October 2026, and this little section was brought to you by crypto_krb5_encrypt(9) 🫶 go encrypt something safely, mwah 💖

📦 where this page comes from