gss_krb5_aead_decrypt(9)

💅 NAME 💅

okay so bestie, welcome to the gss_krb5_aead_decrypt(9) page from the Kernel API Manual — it's literally about decrypting a wrap token using crypto/krb5, and yes, that's the whole vibe. slay.

🎀 SYNOPSIS 🎀

u32 gss_krb5_aead_decrypt (struct krb5_ctx *kctx , u32 offset , u32 len
       , struct xdr_buf *buf , u32 *headskip , u32 *tailskip );

✨ ARGUMENTS ✨

• kctx — the Kerberos context, aka the main-character context for this whole operation 💫
• offset — byte offset of the GSS token header in buf. yep, exactly that.
• len — total length of the GSS token. the whole token, no cap.
• buf — ciphertext buffer, decrypted in-place. it gets changed right there in the buffer, bestie.
• headskip — OUT: confounder length, in octets 🎀
• tailskip — OUT: checksum length, in octets 🦋

🌸 DESCRIPTION 🌸

so the return values are giving very specific energy, and you need to know them:

• GSS_S_COMPLETE: Decryption and integrity verification succeeded ✅
• GSS_S_BAD_SIG: Integrity checksum did not match 😭
• GSS_S_DEFECTIVE_TOKEN: Token is malformed or truncated 💀
• GSS_S_FAILURE: Decryption failed 🙈

like, those are the outcomes. no extra lore, just the facts, fr fr.

🦋 SEE ALSO 🦋

• Kernel file ./net/sunrpc/auth_gss/gss_krb5_crypto.c
• gss_krb5_aead_encrypt(9), gss_krb5_mic_build_sg(9)

made with 💖 from ./net/sunrpc/auth_gss — October 2026 edition, bestie. decrypt responsibly and stay iconic 👑✨