KRB5_ENCRYPT(3) | Library Functions Manual | KRB5_ENCRYPT(3)

# NAME

krb5_crypto_getblocksize, krb5_crypto_getconfoundersize krb5_crypto_getenctype, krb5_crypto_getpadsize, krb5_crypto_overhead, krb5_decrypt, krb5_decrypt_EncryptedData, krb5_decrypt_ivec, krb5_decrypt_ticket, krb5_encrypt, krb5_encrypt_EncryptedData, krb5_encrypt_ivec, krb5_enctype_disable, krb5_enctype_keysize, krb5_enctype_to_string, krb5_enctype_valid, krb5_get_wrapped_length, krb5_string_to_enctype — encrypt and decrypt data, set and get encryption type parameters

# LIBRARY

Kerberos 5 Library (libkrb5, -lkrb5)

# SYNOPSIS

#include <krb5/krb5.h>
krb5_error_code
krb5_encrypt(krb5_context context, krb5_crypto crypto, unsigned usage, void *data, size_t len, krb5_data *result);
krb5_error_code
krb5_encrypt_EncryptedData(krb5_context context, krb5_crypto crypto, unsigned usage, void *data, size_t len, int kvno, EncryptedData *result);
krb5_error_code
krb5_encrypt_ivec(krb5_context context, krb5_crypto crypto, unsigned usage, void *data, size_t len, krb5_data *result, void *ivec);
krb5_error_code
krb5_decrypt(krb5_context context, krb5_crypto crypto, unsigned usage, void *data, size_t len, krb5_data *result);
krb5_error_code
krb5_decrypt_EncryptedData(krb5_context context, krb5_crypto crypto, unsigned usage, EncryptedData *e, krb5_data *result);
krb5_error_code
krb5_decrypt_ivec(krb5_context context, krb5_crypto crypto, unsigned usage, void *data, size_t len, krb5_data *result, void *ivec);
krb5_error_code
krb5_decrypt_ticket(krb5_context context, Ticket *ticket, krb5_keyblock *key, EncTicketPart *out, krb5_flags flags);
krb5_error_code
krb5_crypto_getblocksize(krb5_context context, size_t *blocksize);
krb5_error_code
krb5_crypto_getenctype(krb5_context context, krb5_crypto crypto, krb5_enctype *enctype);
krb5_error_code
krb5_crypto_getpadsize(krb5_context context, size_t, *padsize");
krb5_error_code
krb5_crypto_getconfoundersize(krb5_context context, krb5_crypto crypto, size_t, *confoundersize");
krb5_error_code
krb5_enctype_keysize(krb5_context context, krb5_enctype type, size_t *keysize);
krb5_error_code
krb5_crypto_overhead(krb5_context context, size_t, *padsize");
krb5_error_code
krb5_string_to_enctype(krb5_context context, const char *string, krb5_enctype *etype);
krb5_error_code
krb5_enctype_to_string(krb5_context context, krb5_enctype etype, char **string);
krb5_error_code
krb5_enctype_valid(krb5_context context, krb5_enctype etype);
void
krb5_enctype_disable(krb5_context context, krb5_enctype etype);
size_t
krb5_get_wrapped_length(krb5_context context, krb5_crypto crypto, size_t data_len);

# DESCRIPTION

These functions are used to encrypt and decrypt data.
krb5_encrypt_ivec() puts the encrypted version of data (of size len) in result. If the encryption type supports using derived keys, usage should be the appropriate key-usage. ivec is a pointer to a initial IV, it is modified to the end IV at the end of the round. Ivec should be the size of If `NULL` is passed in, the default IV is used. krb5_encrypt() does the same as krb5_encrypt_ivec() but with ivec being `NULL`. krb5_encrypt_EncryptedData() does the same as krb5_encrypt(), but it puts the encrypted data in a EncryptedData structure instead. If kvno is not zero, it will be put in the (optional) kvno field in the EncryptedData.
krb5_decrypt_ivec(), krb5_decrypt(), and krb5_decrypt_EncryptedData() works similarly.
krb5_decrypt_ticket() decrypts the encrypted part of ticket with key. krb5_decrypt_ticket() also verifies the timestamp in the ticket, invalid flag and if the KDC haven't verified the transited path, the transit path.
krb5_enctype_keysize(), krb5_crypto_getconfoundersize(), krb5_crypto_getblocksize(), krb5_crypto_getenctype(), krb5_crypto_getpadsize(), krb5_crypto_overhead() all returns various (sometimes) useful information from a crypto context. krb5_crypto_overhead() is the combination of krb5_crypto_getconfoundersize, krb5_crypto_getblocksize and krb5_crypto_getpadsize and return the maximum overhead size.
krb5_enctype_to_string() converts a encryption type number to a string that can be printable and stored. The strings returned should be freed with free(3).
krb5_string_to_enctype() converts a encryption type strings to a encryption type number that can use used for other Kerberos crypto functions.
krb5_enctype_valid() returns 0 if the encrypt is supported and not disabled, otherwise and error code is returned.
krb5_enctype_disable() (globally, for all contextes) disables the enctype.
krb5_get_wrapped_length() returns the size of an encrypted packet by crypto of length data_len.

# SEE ALSO

krb5_create_checksum(3), krb5_crypto_init(3)

March 20, 2004 | NetBSD 8.2