---
name: "kcapi_aead_stream_init_dec"
section: "3"
platform: "linux"
package: "libkcapi-dev"
version: "1.4.0-1+b2"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/kcapi_aead_stream_init_dec"
---

# kcapi\_aead\_stream\_init\_dec(3)

start a decryption operation (stream)

## NAME

kcapi\_aead\_stream\_init\_dec - start a decryption operation (stream)

## SYNOPSIS

**ssize\_t kcapi\_aead\_stream\_init\_dec(struct kcapi\_handle \*** *handle***, const uint8\_t \*** *iv***, struct iovec \*** *iov***, size\_t** *iovlen***);**

## ARGUMENTS

*handle*

\[in\] cipher handle

*iv*

\[in\] IV to be used for cipher operation

*iov*

\[in\] scatter/gather list with data to be encrypted. This is the pointer to the first iov entry if an array of iov entries is supplied. See [sendmsg(2)](/sendmsg/2.md) for details on how iov is to be used. This pointer may be NULL if no data to be encrypted is available at the point of the call.

*iovlen*

\[in\] number of scatter/gather list elements. If iov is NULL, this value must be zero.

## DESCRIPTION

A stream decryption operation is started with this call. Multiple successive **kcapi\_aead\_stream\_update** function calls can be invoked to send more ciphertext data to be encrypted. The kernel buffers the input until **kcapi\_aead\_stream\_op** picks up the decrypted data. Once ciphertext is decrypted during the **kcapi\_aead\_stream\_op** it is removed from the kernel buffer.

Note, unlike the corresponding symmetric cipher API, the function calls of **kcapi\_aead\_stream\_update** and **kcapi\_aead\_stream\_op** cannot be mixed! This due to the nature of AEAD where the cipher operation ensures the integrity of the entire data (decryption) or calculates a message digest over the entire data (encryption).

When using the stream API, the caller must ensure that data is sent in the correct order (regardless whether data is sent in multiple chunks using **kcapi\_aead\_stream\_init\_enc** or **kcapi\_cipher\_stream\_update**): (i) the complete associated data must be provided, followed by (ii) the plaintext. For decryption, also (iii) the tag value must be sent.

The IV buffer must be exactly **kcapi\_cipher\_ivsize** bytes in size.

*return* number of bytes sent to the kernel upon success; a negative errno-style error code if an error occurred

## AUTHOR

**Stephan Mueller** \<smueller@chronox.de\>

Author.

## COPYRIGHT