---
name: "Fapi_Decrypt"
section: "3"
platform: "linux"
package: "tpm2-tss"
version: "4.2.0-2"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/Fapi_Decrypt"
---

# Fapi\_Decrypt(3)

Fapi\_Decrypt

## NAME

Fapi\_Decrypt - Fapi\_Decrypt

## SYNOPSIS

### Functions

TSS2\_RC **Fapi\_Decrypt** (**FAPI\_CONTEXT** \*context, char const \*keyPath, uint8\_t const \*cipherText, size\_t cipherTextSize, uint8\_t \*\*plainText, size\_t \*plainTextSize)\
 TSS2\_RC **Fapi\_Decrypt\_Async** (**FAPI\_CONTEXT** \*context, char const \*keyPath, uint8\_t const \*cipherText, size\_t cipherTextSize)\
 TSS2\_RC **Fapi\_Decrypt\_Finish** (**FAPI\_CONTEXT** \*context, uint8\_t \*\*plainText, size\_t \*plainTextSize)\

## Detailed Description

FAPI functions to invoke Decrypt either as one-call or in an asynchronous manner.

## Function Documentation

### TSS2\_RC Fapi\_Decrypt (FAPI\_CONTEXT \* context, char const \* keyPath, uint8\_t const \* cipherText, size\_t cipherTextSize, uint8\_t \*\* plainText, size\_t \* plainTextSize)

One-Call function for Fapi\_Decrypt

Decrypts data that was previously encrypted with Fapi\_Encrypt.

Note, that the size of the cipher text must not exceed the maximum supported size for payloads in a TPM2B\_MAX\_BUFFER, i.e TPM2\_MAX\_DIGEST\_BUFFER.

**Parameters**

*context* The **FAPI\_CONTEXT** \
 *keyPath* The decryption key. \
 *cipherText* The ciphertext to decrypt. \
 *cipherTextSize* The size of the ciphertext to decrypt. \
 *plainText* the decrypted ciphertext. May be NULL (callee-allocated) \
 *plainTextSize* The size of the ciphertext in bytes. May be NULL

**Return values**

*TSS2\_RC\_SUCCESS* if the function call was a success. \
 *TSS2\_FAPI\_RC\_BAD\_REFERENCE* if context or cipherText is NULL. \
 *TSS2\_FAPI\_RC\_BAD\_CONTEXT* if context corruption is detected. \
 *TSS2\_FAPI\_RC\_KEY\_NOT\_FOUND* if can't find the key necessary to decrypt the file. \
 *TSS2\_FAPI\_RC\_BAD\_KEY* if the decryption key is unsuitable for the requested operation. \
 *TSS2\_FAPI\_RC\_BAD\_VALUE* if the decryption fails or the cipher text size is invalid \
 *TSS2\_FAPI\_RC\_BAD\_SEQUENCE* if the context has an asynchronous operation already pending. \
 *TSS2\_FAPI\_RC\_IO\_ERROR* if the data cannot be saved. \
 *TSS2\_FAPI\_RC\_MEMORY* if the FAPI cannot allocate enough memory for internal operations or return parameters. \
 *TSS2\_FAPI\_RC\_NO\_TPM* if FAPI was initialized in no-TPM-mode via its config file. \
 *TSS2\_FAPI\_RC\_GENERAL\_FAILURE* if an internal error occurred. \
 *TSS2\_FAPI\_RC\_TRY\_AGAIN* if an I/O operation is not finished yet and this function needs to be called again. \
 *TSS2\_FAPI\_RC\_PATH\_NOT\_FOUND* if a FAPI object path was not found during authorization. \
 *TSS2\_FAPI\_RC\_AUTHORIZATION\_UNKNOWN* if a required authorization callback is not set. \
 *TSS2\_FAPI\_RC\_AUTHORIZATION\_FAILED* if the authorization attempt fails. \
 *TSS2\_FAPI\_RC\_POLICY\_UNKNOWN* if policy search for a certain policy digest was not successful. \
 *TSS2\_ESYS\_RC\_\** possible error codes of ESAPI. \
 *TSS2\_FAPI\_RC\_NOT\_PROVISIONED* FAPI was not provisioned. \
 *TSS2\_FAPI\_RC\_BAD\_PATH* if the path is used in inappropriate context or contains illegal characters.

### TSS2\_RC Fapi\_Decrypt\_Async (FAPI\_CONTEXT \* context, char const \* keyPath, uint8\_t const \* cipherText, size\_t cipherTextSize)

Asynchronous function for Fapi\_Decrypt

Decrypts data that was previously encrypted with Fapi\_Encrypt.

Note, that the size of the cipher text must not exceed the maximum supported size for payloads in a TPM2B\_MAX\_BUFFER, i.e TPM2\_MAX\_DIGEST\_BUFFER.

Call Fapi\_Decrypt\_Finish to finish the execution of this command.

**Parameters**

*context* The **FAPI\_CONTEXT** \
 *keyPath* The decryption key. \
 *cipherText* The ciphertext to decrypt \
 *cipherTextSize* The size of the ciphertext to decrypt

**Return values**

*TSS2\_RC\_SUCCESS* if the function call was a success. \
 *TSS2\_FAPI\_RC\_BAD\_REFERENCE* if context or cipherText is NULL. \
 *TSS2\_FAPI\_RC\_BAD\_CONTEXT* if context corruption is detected. \
 *TSS2\_FAPI\_RC\_KEY\_NOT\_FOUND* if can't find the key necessary to decrypt the file. \
 *TSS2\_FAPI\_RC\_BAD\_KEY* if the decryption key is unsuitable for the requested operation. \
 *TSS2\_FAPI\_RC\_BAD\_VALUE* if the decryption fails or the cipher text size is invalid \
 *TSS2\_FAPI\_RC\_BAD\_SEQUENCE* if the context has an asynchronous operation already pending. \
 *TSS2\_FAPI\_RC\_IO\_ERROR* if the data cannot be saved. \
 *TSS2\_FAPI\_RC\_MEMORY* if the FAPI cannot allocate enough memory for internal operations or return parameters. \
 *TSS2\_FAPI\_RC\_NO\_TPM* if FAPI was initialized in no-TPM-mode via its config file.

### TSS2\_RC Fapi\_Decrypt\_Finish (FAPI\_CONTEXT \* context, uint8\_t \*\* plainText, size\_t \* plainTextSize)

Asynchronous finish function for Fapi\_Decrypt

This function should be called after a previous Fapi\_Decrypt.

**Parameters**

*context* The **FAPI\_CONTEXT** \
 *plainText* the decrypted ciphertext. May be NULL (callee-allocated) \
 *plainTextSize* The size of the ciphertext in bytes. May be NULL

**Return values**

*TSS2\_RC\_SUCCESS* if the function call was a success. \
 *TSS2\_FAPI\_RC\_BAD\_REFERENCE* if context, plainText or plainTextSize is NULL. \
 *TSS2\_FAPI\_RC\_BAD\_CONTEXT* if context corruption is detected. \
 *TSS2\_FAPI\_RC\_BAD\_SEQUENCE* if the context has an asynchronous operation already pending. \
 *TSS2\_FAPI\_RC\_IO\_ERROR* if the data cannot be saved. \
 *TSS2\_FAPI\_RC\_MEMORY* if the FAPI cannot allocate enough memory for internal operations or return parameters. \
 *TSS2\_FAPI\_RC\_TRY\_AGAIN* if the asynchronous operation is not yet complete. Call this function again later. \
 *TSS2\_FAPI\_RC\_GENERAL\_FAILURE* if an internal error occurred. \
 *TSS2\_FAPI\_RC\_BAD\_VALUE* if an invalid value was passed into the function. \
 *TSS2\_FAPI\_RC\_PATH\_NOT\_FOUND* if a FAPI object path was not found during authorization. \
 *TSS2\_FAPI\_RC\_KEY\_NOT\_FOUND* if a key was not found. \
 *TSS2\_FAPI\_RC\_AUTHORIZATION\_UNKNOWN* if a required authorization callback is not set. \
 *TSS2\_FAPI\_RC\_AUTHORIZATION\_FAILED* if the authorization attempt fails. \
 *TSS2\_FAPI\_RC\_POLICY\_UNKNOWN* if policy search for a certain policy digest was not successful. \
 *TSS2\_ESYS\_RC\_\** possible error codes of ESAPI. \
 *TSS2\_FAPI\_RC\_NOT\_PROVISIONED* FAPI was not provisioned. \
 *TSS2\_FAPI\_RC\_BAD\_PATH* if the path is used in inappropriate context or contains illegal characters.

## Author

Generated automatically by Doxygen for tpm2-tss from the source code.