---
name: "krb5_encrypt"
section: "3"
platform: "linux"
package: "heimdal-dev"
version: "7.8.git20221117.28daf24+dfsg-9+deb13u1"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/krb5_encrypt"
---

# krb5\_encrypt(3)

encrypt and decrypt data, set and get encryption type parameters

## NAME

**krb5\_crypto\_getblocksize**, **krb5\_crypto\_getconfoundersize** **krb5\_crypto\_getenctype**, **krb5\_crypto\_getpadsize**, **krb5\_crypto\_overhead**, **krb5\_decrypt**, **krb5\_decrypt\_EncryptedData**, **krb5\_decrypt\_ivec**, **krb5\_decrypt\_ticket**, **krb5\_encrypt**, **krb5\_encrypt\_EncryptedData**, **krb5\_encrypt\_ivec**, **krb5\_enctype\_disable**, **krb5\_enctype\_keysize**, **krb5\_enctype\_to\_string**, **krb5\_enctype\_valid**, **krb5\_get\_wrapped\_length**, **krb5\_string\_to\_enctype** – encrypt and decrypt data, set and get encryption type parameters

## LIBRARY

Kerberos 5 Library (libkrb5, -lkrb5)

## SYNOPSIS

**#include \<krb5.h\>**

*krb5\_error\_code*\

**krb5\_encrypt**(*krb5\_context context*, *krb5\_crypto crypto*, *unsigned usage*, *void \*data*, *size\_t len*, *krb5\_data \*result*);

*krb5\_error\_code*\

**krb5\_encrypt\_EncryptedData**(*krb5\_context context*, *krb5\_crypto crypto*, *unsigned usage*, *void \*data*, *size\_t len*, *int kvno*, *EncryptedData \*result*);

*krb5\_error\_code*\

**krb5\_encrypt\_ivec**(*krb5\_context context*, *krb5\_crypto crypto*, *unsigned usage*, *void \*data*, *size\_t len*, *krb5\_data \*result*, *void \*ivec*);

*krb5\_error\_code*\

**krb5\_decrypt**(*krb5\_context context*, *krb5\_crypto crypto*, *unsigned usage*, *void \*data*, *size\_t len*, *krb5\_data \*result*);

*krb5\_error\_code*\

**krb5\_decrypt\_EncryptedData**(*krb5\_context context*, *krb5\_crypto crypto*, *unsigned usage*, *EncryptedData \*e*, *krb5\_data \*result*);

*krb5\_error\_code*\

**krb5\_decrypt\_ivec**(*krb5\_context context*, *krb5\_crypto crypto*, *unsigned usage*, *void \*data*, *size\_t len*, *krb5\_data \*result*, *void \*ivec*);

*krb5\_error\_code*\

**krb5\_decrypt\_ticket**(*krb5\_context context*, *Ticket \*ticket*, *krb5\_keyblock \*key*, *EncTicketPart \*out*, *krb5\_flags flags*);

*krb5\_error\_code*\

**krb5\_crypto\_getblocksize**(*krb5\_context context*, *size\_t \*blocksize*);

*krb5\_error\_code*\

**krb5\_crypto\_getenctype**(*krb5\_context context*, *krb5\_crypto crypto*, *krb5\_enctype \*enctype*);

*krb5\_error\_code*\

**krb5\_crypto\_getpadsize**(*krb5\_context context*, *size\_t*, *\*padsize"*);

*krb5\_error\_code*\

**krb5\_crypto\_getconfoundersize**(*krb5\_context context*, *krb5\_crypto crypto*, *size\_t*, *\*confoundersize"*);

*krb5\_error\_code*\

**krb5\_enctype\_keysize**(*krb5\_context context*, *krb5\_enctype type*, *size\_t \*keysize*);

*krb5\_error\_code*\

**krb5\_crypto\_overhead**(*krb5\_context context*, *size\_t*, *\*padsize"*);

*krb5\_error\_code*\

**krb5\_string\_to\_enctype**(*krb5\_context context*, *const char \*string*, *krb5\_enctype \*etype*);

*krb5\_error\_code*\

**krb5\_enctype\_to\_string**(*krb5\_context context*, *krb5\_enctype etype*, *char \*\*string*);

*krb5\_error\_code*\

**krb5\_enctype\_valid**(*krb5\_context context*, *krb5\_enctype etype*);

*void*\

**krb5\_enctype\_disable**(*krb5\_context context*, *krb5\_enctype etype*);

*size\_t*\

**krb5\_get\_wrapped\_length**(*krb5\_context context*, *krb5\_crypto crypto*, *size\_t data\_len*);

## DESCRIPTION

These functions are used to encrypt and decrypt data.

**krb5\_encrypt\_ivec**() puts the encrypted version of *data* (of size *len*) in *result*. If the encryption type supports using derived keys, *usage* should be the appropriate key-usage. *ivec* is a pointer to a initial IV, it is modified to the end IV at the end of the round. Ivec should be the size of If NULL is passed in, the default IV is used. **krb5\_encrypt**() does the same as **krb5\_encrypt\_ivec**() but with *ivec* being NULL. **krb5\_encrypt\_EncryptedData**() does the same as **krb5\_encrypt**(), but it puts the encrypted data in a *EncryptedData* structure instead. If *kvno* is not zero, it will be put in the (optional) *kvno* field in the *EncryptedData*.

**krb5\_decrypt\_ivec**(), **krb5\_decrypt**(), and **krb5\_decrypt\_EncryptedData**() works similarly.

**krb5\_decrypt\_ticket**() decrypts the encrypted part of *ticket* with *key*. **krb5\_decrypt\_ticket**() also verifies the timestamp in the ticket, invalid flag and if the KDC haven't verified the transited path, the transit path.

**krb5\_enctype\_keysize**(), **krb5\_crypto\_getconfoundersize**(), **krb5\_crypto\_getblocksize**(), **krb5\_crypto\_getenctype**(), **krb5\_crypto\_getpadsize**(), **krb5\_crypto\_overhead**() all returns various (sometimes) useful information from a crypto context. **krb5\_crypto\_overhead**() is the combination of krb5\_crypto\_getconfoundersize, krb5\_crypto\_getblocksize and krb5\_crypto\_getpadsize and return the maximum overhead size.

**krb5\_enctype\_to\_string**() converts a encryption type number to a string that can be printable and stored. The strings returned should be freed with [free(3)](/free/3.md).

**krb5\_string\_to\_enctype**() converts a encryption type strings to a encryption type number that can use used for other Kerberos crypto functions.

**krb5\_enctype\_valid**() returns 0 if the encrypt is supported and not disabled, otherwise and error code is returned.

**krb5\_enctype\_disable**() (globally, for all contextes) disables the *enctype*.

**krb5\_get\_wrapped\_length**() returns the size of an encrypted packet by *crypto* of length *data\_len*.

## SEE ALSO

[krb5\_create\_checksum(3)](/krb5_create_checksum/3.md), [krb5\_crypto\_init(3)](/krb5_crypto_init/3.md)