---
name: "crypto"
section: "9"
platform: "freebsd"
package: "base"
version: "16.0-CURRENT-20261027-61c70dc16a79"
release: "FreeBSD 16.0-CURRENT (2026-10-27)"
platforms: ["linux", "freebsd"]
url: "https://new.carta.tech/crypto/9"
---

# crypto(9)

API for cryptographic services in the kernel

## NAME

**crypto** – API for cryptographic services in the kernel

## SYNOPSIS

**#include \<opencrypto/cryptodev.h\>**

## DESCRIPTION

**crypto** is a framework for in-kernel cryptography. It permits in-kernel consumers to encrypt and decrypt data and also enables userland applications to use cryptographic hardware through the */dev/crypto* device.

**crypto** supports encryption and decryption operations using block and stream ciphers as well as computation and verification of message authentication codes (MACs). Consumers allocate sessions to describe a transform as discussed in [crypto\_session(9)](/crypto_session/9.md). Consumers then allocate request objects to describe each transformation such as encrypting a network packet or decrypting a disk sector. Requests are described in [crypto\_request(9)](/crypto_request/9.md).

Device drivers are responsible for processing requests submitted by consumers. [crypto\_driver(9)](/crypto_driver/9.md) describes the interfaces drivers use to register with the framework, helper routines the framework provides to facilitate request processing, and the interfaces drivers are required to provide.

### Callbacks

Since the consumers may not be associated with a process, drivers may not [sleep(9)](/sleep/9.md). The same holds for the framework. Thus, a callback mechanism is used to notify a consumer that a request has been completed (the callback is specified by the consumer on a per-request basis). The callback is invoked by the framework whether the request was successfully completed or not. Errors are reported to the callback function.

Session initialization does not use callbacks and returns errors synchronously.

### Session Migration

Operations may fail with a specific error code, EAGAIN, to indicate that a session handle has changed and that the request may be re-submitted immediately with the new session. The consumer should update its saved copy of the session handle to the value of *crp\_session* so that future requests use the new session.

### Supported Algorithms

More details on some algorithms may be found in [crypto(7)](/crypto/7.md).

The following authentication algorithms are supported:

- CRYPTO\_AES\_CCM\_CBC\_MAC

  - CRYPTO\_AES\_NIST\_GMAC

  - CRYPTO\_BLAKE2B

  - CRYPTO\_BLAKE2S

  - CRYPTO\_NULL\_HMAC

  - CRYPTO\_POLY1305

  - CRYPTO\_RIPEMD160

  - CRYPTO\_RIPEMD160\_HMAC

  - CRYPTO\_SHA1

  - CRYPTO\_SHA1\_HMAC

  - CRYPTO\_SHA2\_224

  - CRYPTO\_SHA2\_224\_HMAC

  - CRYPTO\_SHA2\_256

  - CRYPTO\_SHA2\_256\_HMAC

  - CRYPTO\_SHA2\_384

  - CRYPTO\_SHA2\_384\_HMAC

  - CRYPTO\_SHA2\_512

  - CRYPTO\_SHA2\_512\_HMAC

  The following encryption algorithms are supported:

- CRYPTO\_AES\_CBC

  - CRYPTO\_AES\_ICM

  - CRYPTO\_AES\_XTS

  - CRYPTO\_CAMELLIA\_CBC

  - CRYPTO\_CHACHA20

  - CRYPTO\_NULL\_CBC

  The following authenticated encryption with additional data (AEAD) algorithms are supported:

- CRYPTO\_AES\_CCM\_16

  - CRYPTO\_AES\_NIST\_GCM\_16

  - CRYPTO\_CHACHA20\_POLY1305

  The following compression algorithms are supported:

- CRYPTO\_DEFLATE\_COMP

  ## FILES

- *sys/opencrypto/crypto.c*

  most of the framework code

## SEE ALSO

[crypto(4)](/crypto/4.md), [ipsec(4)](/ipsec/4.md), [crypto(7)](/crypto/7.md), [crypto\_driver(9)](/crypto_driver/9.md), [crypto\_request(9)](/crypto_request/9.md), [crypto\_session(9)](/crypto_session/9.md), [sleep(9)](/sleep/9.md)

## HISTORY

The cryptographic framework first appeared in OpenBSD 2.7 and was written by Angelos D. Keromytis ⟨*angelos@openbsd.org*⟩.

## BUGS

The framework needs a mechanism for determining which driver is best for a specific set of algorithms associated with a session. Some type of benchmarking is in order here.