---
name: "mlx5dv_crypto_login"
section: "3"
platform: "linux"
package: "rdma-core"
version: "65.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/mlx5dv_crypto_login"
---

# mlx5dv\_crypto\_login(3)

Creates a crypto login session mlx5dv\_crypto\_login\_query\_state - Queries the state of the current crypto login session mlx5dv\_crypto\_logout - Logs out from the current crypto login session

## NAME

mlx5dv\_crypto\_login - Creates a crypto login session

mlx5dv\_crypto\_login\_query\_state - Queries the state of the current crypto login session

mlx5dv\_crypto\_logout - Logs out from the current crypto login session

## SYNOPSIS

-

  ```
  #include <infiniband/mlx5dv.h>
  int mlx5dv_crypto_login(struct ibv_context *context,
              struct mlx5dv_crypto_login_attr *login_attr);
  int mlx5dv_crypto_login_query_state(struct ibv_context *context,
                      enum mlx5dv_crypto_login_state *state);
  int mlx5dv_crypto_logout(struct ibv_context *context);
  ```

## DESCRIPTION

When using a crypto engine that is in wrapped import method, an active crypto login session must be present in order to create and query Data Encryption Keys (DEKs).

**mlx5dv\_crypto\_login()** Creates a crypto login session with the credential given in *login\_attr* and associates it with *context*. Only one active crypto login session can be associated per device context.

**mlx5dv\_crypto\_login\_query\_state()** queries the state of the crypto login session associated with *context* and returns the state in *state*, which indicates whether it is valid, invalid or doesn’t exist. A valid crypto login session can become invalid if the credential or the import KEK used in the crypto login session were deleted during the login session (for example by a crypto officer). In this case, **mlx5dv\_crypto\_logout()** should be called to destroy the current invalid crypto login session and if still necessary, **mlx5dv\_crypto\_login()** should be called to create a new crypto login session with valid credential and import KEK.

**mlx5dv\_crypto\_logout()** logs out from the current crypto login session associated with *context*.

Existing DEKs that were previously loaded to the device during a crypto login session don’t need an active crypto login session in order to be used (in MKey or during traffic).

## ARGUMENTS

### context

The device context to associate the crypto login session with.

### login\_attr

Crypto login attributes specify the credential to login with and the import KEK to be used for secured communications during the crypto login session.

-

  ```
  struct mlx5dv_crypto_login_attr {
      uint32_t credential_id;
      uint32_t import_kek_id;
      char credential[48];
      uint64_t comp_mask;
  };
  ```

- *credential\_id*

  An ID of a credential, from the credentials stored on the device, that indicates the credential that should be validated against the credential provided in *credential*.

- *import\_kek\_id*

  An ID of an import KEK, from the import KEKs stored on the device, that indicates the import KEK that will be used for unwrapping the credential provided in *credential* and also for all other secured communications during the crypto login session.

- *credential*

  The credential to login with. Must be provided wrapped by the AES key wrap algorithm using the import KEK indicated by *import\_kek\_id*.

- *comp\_mask*

  Reserved For future extension, must be 0 now.

### state

Indicates the state of the current crypto login session. can be one of MLX5DV\_CRYPTO\_LOGIN\_STATE\_VALID, MLX5DV\_CRYPTO\_LOGIN\_STATE\_NO\_LOGIN and MLX5DV\_CRYPTO\_LOGIN\_STATE\_INVALID.

## RETURN VALUE

**mlx5dv\_crypto\_login()** returns 0 on success and errno value on error.

**mlx5dv\_crypto\_login\_query\_state()** returns 0 on success and updates *state* with the queried state. On error, errno value is returned.

**mlx5dv\_crypto\_logout()** returns 0 on success and errno value on error.

## ERRORS

- EEXIST

  A crypto login session already exists.

- EINVAL

  Invalid attributes were provided, or one or more of *credential*, *credential\_id* and *import\_kek\_id* are invalid.

- ENOENT

  No crypto login session exists.

## AUTHORS

Avihai Horon ⟨avihaih@nvidia.com⟩\\c