1.\" $NetBSD: krb5_encrypt.3,v 1.1.1.3 2014/04/24 12:45:50 pettai Exp $ 2.\" 3.\" Copyright (c) 1999 - 2004 Kungliga Tekniska Högskolan 4.\" (Royal Institute of Technology, Stockholm, Sweden). 5.\" All rights reserved. 6.\" 7.\" Redistribution and use in source and binary forms, with or without 8.\" modification, are permitted provided that the following conditions 9.\" are met: 10.\" 11.\" 1. Redistributions of source code must retain the above copyright 12.\" notice, this list of conditions and the following disclaimer. 13.\" 14.\" 2. Redistributions in binary form must reproduce the above copyright 15.\" notice, this list of conditions and the following disclaimer in the 16.\" documentation and/or other materials provided with the distribution. 17.\" 18.\" 3. Neither the name of the Institute nor the names of its contributors 19.\" may be used to endorse or promote products derived from this software 20.\" without specific prior written permission. 21.\" 22.\" THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 23.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 24.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 25.\" ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 26.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 27.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 28.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 29.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 30.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 31.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 32.\" SUCH DAMAGE. 33.\" 34.\" Id 35.\" 36.Dd March 20, 2004 37.Dt KRB5_ENCRYPT 3 38.Os 39.Sh NAME 40.Nm krb5_crypto_getblocksize , 41.Nm krb5_crypto_getconfoundersize 42.Nm krb5_crypto_getenctype , 43.Nm krb5_crypto_getpadsize , 44.Nm krb5_crypto_overhead , 45.Nm krb5_decrypt , 46.Nm krb5_decrypt_EncryptedData , 47.Nm krb5_decrypt_ivec , 48.Nm krb5_decrypt_ticket , 49.Nm krb5_encrypt , 50.Nm krb5_encrypt_EncryptedData , 51.Nm krb5_encrypt_ivec , 52.Nm krb5_enctype_disable , 53.Nm krb5_enctype_keysize , 54.Nm krb5_enctype_to_string , 55.Nm krb5_enctype_valid , 56.Nm krb5_get_wrapped_length , 57.Nm krb5_string_to_enctype 58.Nd "encrypt and decrypt data, set and get encryption type parameters" 59.Sh LIBRARY 60Kerberos 5 Library (libkrb5, -lkrb5) 61.Sh SYNOPSIS 62.In krb5/krb5.h 63.Ft krb5_error_code 64.Fo krb5_encrypt 65.Fa "krb5_context context" 66.Fa "krb5_crypto crypto" 67.Fa "unsigned usage" 68.Fa "void *data" 69.Fa "size_t len" 70.Fa "krb5_data *result" 71.Fc 72.Ft krb5_error_code 73.Fo krb5_encrypt_EncryptedData 74.Fa "krb5_context context" 75.Fa "krb5_crypto crypto" 76.Fa "unsigned usage" 77.Fa "void *data" 78.Fa "size_t len" 79.Fa "int kvno" 80.Fa "EncryptedData *result" 81.Fc 82.Ft krb5_error_code 83.Fo krb5_encrypt_ivec 84.Fa "krb5_context context" 85.Fa "krb5_crypto crypto" 86.Fa "unsigned usage" 87.Fa "void *data" 88.Fa "size_t len" 89.Fa "krb5_data *result" 90.Fa "void *ivec" 91.Fc 92.Ft krb5_error_code 93.Fo krb5_decrypt 94.Fa "krb5_context context" 95.Fa "krb5_crypto crypto" 96.Fa "unsigned usage" 97.Fa "void *data" 98.Fa "size_t len" 99.Fa "krb5_data *result" 100.Fc 101.Ft krb5_error_code 102.Fo krb5_decrypt_EncryptedData 103.Fa "krb5_context context" 104.Fa "krb5_crypto crypto" 105.Fa "unsigned usage" 106.Fa "EncryptedData *e" 107.Fa "krb5_data *result" 108.Fc 109.Ft krb5_error_code 110.Fo krb5_decrypt_ivec 111.Fa "krb5_context context" 112.Fa "krb5_crypto crypto" 113.Fa "unsigned usage" 114.Fa "void *data" 115.Fa "size_t len" 116.Fa "krb5_data *result" 117.Fa "void *ivec" 118.Fc 119.Ft krb5_error_code 120.Fo krb5_decrypt_ticket 121.Fa "krb5_context context" 122.Fa "Ticket *ticket" 123.Fa "krb5_keyblock *key" 124.Fa "EncTicketPart *out" 125.Fa "krb5_flags flags" 126.Fc 127.Ft krb5_error_code 128.Fo krb5_crypto_getblocksize 129.Fa "krb5_context context" 130.Fa "size_t *blocksize" 131.Fc 132.Ft krb5_error_code 133.Fo krb5_crypto_getenctype 134.Fa "krb5_context context" 135.Fa "krb5_crypto crypto" 136.Fa "krb5_enctype *enctype" 137.Fc 138.Ft krb5_error_code 139.Fo krb5_crypto_getpadsize 140.Fa "krb5_context context" 141.Fa size_t *padsize" 142.Fc 143.Ft krb5_error_code 144.Fo krb5_crypto_getconfoundersize 145.Fa "krb5_context context" 146.Fa "krb5_crypto crypto" 147.Fa size_t *confoundersize" 148.Fc 149.Ft krb5_error_code 150.Fo krb5_enctype_keysize 151.Fa "krb5_context context" 152.Fa "krb5_enctype type" 153.Fa "size_t *keysize" 154.Fc 155.Ft krb5_error_code 156.Fo krb5_crypto_overhead 157.Fa "krb5_context context" 158.Fa size_t *padsize" 159.Fc 160.Ft krb5_error_code 161.Fo krb5_string_to_enctype 162.Fa "krb5_context context" 163.Fa "const char *string" 164.Fa "krb5_enctype *etype" 165.Fc 166.Ft krb5_error_code 167.Fo krb5_enctype_to_string 168.Fa "krb5_context context" 169.Fa "krb5_enctype etype" 170.Fa "char **string" 171.Fc 172.Ft krb5_error_code 173.Fo krb5_enctype_valid 174.Fa "krb5_context context" 175.Fa "krb5_enctype etype" 176.Fc 177.Ft void 178.Fo krb5_enctype_disable 179.Fa "krb5_context context" 180.Fa "krb5_enctype etype" 181.Fc 182.Ft size_t 183.Fo krb5_get_wrapped_length 184.Fa "krb5_context context" 185.Fa "krb5_crypto crypto" 186.Fa "size_t data_len" 187.Fc 188.Sh DESCRIPTION 189These functions are used to encrypt and decrypt data. 190.Pp 191.Fn krb5_encrypt_ivec 192puts the encrypted version of 193.Fa data 194(of size 195.Fa len ) 196in 197.Fa result . 198If the encryption type supports using derived keys, 199.Fa usage 200should be the appropriate key-usage. 201.Fa ivec 202is a pointer to a initial IV, it is modified to the end IV at the end of 203the round. 204Ivec should be the size of 205If 206.Dv NULL 207is passed in, the default IV is used. 208.Fn krb5_encrypt 209does the same as 210.Fn krb5_encrypt_ivec 211but with 212.Fa ivec 213being 214.Dv NULL . 215.Fn krb5_encrypt_EncryptedData 216does the same as 217.Fn krb5_encrypt , 218but it puts the encrypted data in a 219.Fa EncryptedData 220structure instead. If 221.Fa kvno 222is not zero, it will be put in the (optional) 223.Fa kvno 224field in the 225.Fa EncryptedData . 226.Pp 227.Fn krb5_decrypt_ivec , 228.Fn krb5_decrypt , 229and 230.Fn krb5_decrypt_EncryptedData 231works similarly. 232.Pp 233.Fn krb5_decrypt_ticket 234decrypts the encrypted part of 235.Fa ticket 236with 237.Fa key . 238.Fn krb5_decrypt_ticket 239also verifies the timestamp in the ticket, invalid flag and if the KDC 240haven't verified the transited path, the transit path. 241.Pp 242.Fn krb5_enctype_keysize , 243.Fn krb5_crypto_getconfoundersize , 244.Fn krb5_crypto_getblocksize , 245.Fn krb5_crypto_getenctype , 246.Fn krb5_crypto_getpadsize , 247.Fn krb5_crypto_overhead 248all returns various (sometimes) useful information from a crypto context. 249.Fn krb5_crypto_overhead 250is the combination of krb5_crypto_getconfoundersize, 251krb5_crypto_getblocksize and krb5_crypto_getpadsize and return the 252maximum overhead size. 253.Pp 254.Fn krb5_enctype_to_string 255converts a encryption type number to a string that can be printable 256and stored. The strings returned should be freed with 257.Xr free 3 . 258.Pp 259.Fn krb5_string_to_enctype 260converts a encryption type strings to a encryption type number that 261can use used for other Kerberos crypto functions. 262.Pp 263.Fn krb5_enctype_valid 264returns 0 if the encrypt is supported and not disabled, otherwise and 265error code is returned. 266.Pp 267.Fn krb5_enctype_disable 268(globally, for all contextes) disables the 269.Fa enctype . 270.Pp 271.Fn krb5_get_wrapped_length 272returns the size of an encrypted packet by 273.Fa crypto 274of length 275.Fa data_len . 276.\" .Sh EXAMPLE 277.\" .Sh BUGS 278.Sh SEE ALSO 279.Xr krb5_create_checksum 3 , 280.Xr krb5_crypto_init 3 281