---
name: "Fapi_Encrypt"
section: "3"
platform: "linux"
package: "tpm2-tss"
version: "4.2.0-2"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/Fapi_Encrypt"
---

# Fapi\_Encrypt(3)

Fapi\_Encrypt

## NAME

Fapi\_Encrypt - Fapi\_Encrypt

## SYNOPSIS

### Functions

TSS2\_RC **Fapi\_Encrypt** (**FAPI\_CONTEXT** \*context, char const \*keyPath, uint8\_t const \*plainText, size\_t plainTextSize, uint8\_t \*\*cipherText, size\_t \*cipherTextSize)\
 TSS2\_RC **Fapi\_Encrypt\_Async** (**FAPI\_CONTEXT** \*context, char const \*keyPath, uint8\_t const \*plainText, size\_t plainTextSize)\
 TSS2\_RC **Fapi\_Encrypt\_Finish** (**FAPI\_CONTEXT** \*context, uint8\_t \*\*cipherText, size\_t \*cipherTextSize)\

## Detailed Description

FAPI functions to invoke Encrypt either as one-call or in an asynchronous manner.

## Function Documentation

### TSS2\_RC Fapi\_Encrypt (FAPI\_CONTEXT \* context, char const \* keyPath, uint8\_t const \* plainText, size\_t plainTextSize, uint8\_t \*\* cipherText, size\_t \* cipherTextSize)

One-Call function for Fapi\_Encrypt

Encrypt the provided data for the target key using the TPM encryption schemes as specified in the crypto profile. This function does not use the TPM; i.e. works in non-TPM mode. Note, that the size of the plain text must not exceed the maximum supported size for payloads in a TPM2B\_MAX\_BUFFER, i.e TPM2\_MAX\_DIGEST\_BUFFER.

**Parameters**

*context* The **FAPI\_CONTEXT** \
 *keyPath* THe path to the encryption key \
 *plainText* The plaintext data to encrypt \
 *plainTextSize* The size of the plainText in bytes \
 *cipherText* The encoded cipher text. \
 *cipherTextSize* The size of the encoded cipher text.

**Return values**

*TSS2\_RC\_SUCCESS* if the function call was a success. \
 *TSS2\_FAPI\_RC\_BAD\_REFERENCE* if context, keyPath, plainText, or cipherText is NULL. \
 *TSS2\_FAPI\_RC\_BAD\_CONTEXT* if context corruption is detected. \
 *TSS2\_FAPI\_RC\_KEY\_NOT\_FOUND* if keyPath does not map to a FAPI key. \
 *TSS2\_FAPI\_RC\_BAD\_KEY* if the key at keyPath is unsuitable for encryption. \
 *TSS2\_FAPI\_RC\_BAD\_VALUE* if plainTextSize is 0 or larger than TPM2\_MAX\_DIGEST\_BUFFER. \
 *TSS2\_FAPI\_RC\_BAD\_SEQUENCE* if the context has an asynchronous operation already pending. \
 *TSS2\_FAPI\_RC\_MEMORY* if the FAPI cannot allocate enough memory for internal operations or return parameters. \
 *TSS2\_FAPI\_RC\_NO\_TPM* if FAPI was initialized in no-TPM-mode via its config file. \
 *TSS2\_FAPI\_RC\_IO\_ERROR* if an error occurred while accessing the object store. \
 *TSS2\_FAPI\_RC\_NOT\_IMPLEMENTED* if the encryption algorithm is not available. \
 *TSS2\_FAPI\_RC\_TRY\_AGAIN* if an I/O operation is not finished yet and this function needs to be called again. \
 *TSS2\_FAPI\_RC\_PATH\_NOT\_FOUND* if a FAPI object path was not found during authorization. \
 *TSS2\_FAPI\_RC\_GENERAL\_FAILURE* if an internal error occurred. \
 *TSS2\_FAPI\_RC\_AUTHORIZATION\_UNKNOWN* if a required authorization callback is not set. \
 *TSS2\_FAPI\_RC\_AUTHORIZATION\_FAILED* if the authorization attempt fails. \
 *TSS2\_FAPI\_RC\_POLICY\_UNKNOWN* if policy search for a certain policy digest was not successful. \
 *TSS2\_ESYS\_RC\_\** possible error codes of ESAPI. \
 *TSS2\_FAPI\_RC\_NOT\_PROVISIONED* FAPI was not provisioned. \
 *TSS2\_FAPI\_RC\_BAD\_PATH* if the path is used in inappropriate context or contains illegal characters.

### TSS2\_RC Fapi\_Encrypt\_Async (FAPI\_CONTEXT \* context, char const \* keyPath, uint8\_t const \* plainText, size\_t plainTextSize)

Asynchronous function for Fapi\_Encrypt

Encrypt the provided data for the target key using the TPM encryption schemes as specified in the crypto profile. This function does not use the TPM; i.e. works in non-TPM mode.

Note, that the size of the plain text must not exceed the maximum supported size for payloads in a TPM2B\_MAX\_BUFFER, i.e TPM2\_MAX\_DIGEST\_BUFFER.

Call Fapi\_Encrypt\_Finish to finish the execution of this command.

**Parameters**

*context* The **FAPI\_CONTEXT** \
 *keyPath* The path to the encryption key \
 *plainText* The plainText data to encrypt \
 *plainTextSize* The size of the plainText in bytes

**Return values**

*TSS2\_RC\_SUCCESS* if the function call was a success. \
 *TSS2\_FAPI\_RC\_BAD\_REFERENCE* if context, keyPath or plainText is NULL. \
 *TSS2\_FAPI\_RC\_BAD\_CONTEXT* if context corruption is detected. \
 *TSS2\_FAPI\_RC\_KEY\_NOT\_FOUND* if keyPath does not map to a FAPI key. \
 *TSS2\_FAPI\_RC\_BAD\_KEY* if the key at keyPath is unsuitable for encryption. \
 *TSS2\_FAPI\_RC\_BAD\_VALUE* if plainTextSize is 0 or larger than TPM2\_MAX\_DIGEST\_BUFFER. \
 *TSS2\_FAPI\_RC\_BAD\_SEQUENCE* if the context has an asynchronous operation already pending. \
 *TSS2\_FAPI\_RC\_MEMORY* if the FAPI cannot allocate enough memory for internal operations or return parameters. \
 *TSS2\_FAPI\_RC\_NO\_TPM* if FAPI was initialized in no-TPM-mode via its config file.

### TSS2\_RC Fapi\_Encrypt\_Finish (FAPI\_CONTEXT \* context, uint8\_t \*\* cipherText, size\_t \* cipherTextSize)

Asynchronous finish function for Fapi\_Encrypt

This function should be called after a previous Fapi\_Encrypt\_Async.

**Parameters**

*context* The **FAPI\_CONTEXT** \
 *cipherText* The encoded ciphertext \
 *cipherTextSize* The size of the encoded cipher text.

**Return values**

*TSS2\_RC\_SUCCESS* if the function call was a success. \
 *TSS2\_FAPI\_RC\_BAD\_REFERENCE* if context or ciphertext is NULL. \
 *TSS2\_FAPI\_RC\_BAD\_CONTEXT* if context corruption is detected. \
 *TSS2\_FAPI\_RC\_BAD\_SEQUENCE* if the context has an asynchronous operation already pending. \
 *TSS2\_FAPI\_RC\_IO\_ERROR* if the data cannot be saved. \
 *TSS2\_FAPI\_RC\_MEMORY* if the FAPI cannot allocate enough memory for internal operations or return parameters. \
 *TSS2\_FAPI\_RC\_TRY\_AGAIN* if the asynchronous operation is not yet complete. Call this function again later. \
 *TSS2\_FAPI\_RC\_NOT\_IMPLEMENTED* if the encryption algorithm is not available. \
 *TSS2\_FAPI\_RC\_BAD\_VALUE* if an invalid value was passed into the function. \
 *TSS2\_FAPI\_RC\_PATH\_NOT\_FOUND* if a FAPI object path was not found during authorization. \
 *TSS2\_FAPI\_RC\_KEY\_NOT\_FOUND* if a key was not found. \
 *TSS2\_FAPI\_RC\_GENERAL\_FAILURE* if an internal error occurred. \
 *TSS2\_FAPI\_RC\_AUTHORIZATION\_UNKNOWN* if a required authorization callback is not set. \
 *TSS2\_FAPI\_RC\_AUTHORIZATION\_FAILED* if the authorization attempt fails. \
 *TSS2\_FAPI\_RC\_POLICY\_UNKNOWN* if policy search for a certain policy digest was not successful. \
 *TSS2\_ESYS\_RC\_\** possible error codes of ESAPI. \
 *TSS2\_FAPI\_RC\_NOT\_PROVISIONED* FAPI was not provisioned. \
 *TSS2\_FAPI\_RC\_BAD\_PATH* if the path is used in inappropriate context or contains illegal characters.

## Author

Generated automatically by Doxygen for tpm2-tss from the source code.