DecryptMessage function (sspi.h)
The DecryptMessage (Digest) function decrypts a message. Some packages do not encrypt and decrypt messages but rather perform and check an integrity hash.
The Digest security support provider (SSP) provides encryption and decryption confidentiality for messages exchanged between client and server as a SASL mechanism only.
Syntax
SECURITY_STATUS SEC_ENTRY DecryptMessage(
[in] PCtxtHandle phContext,
[in, out] PSecBufferDesc pMessage,
[in] unsigned long MessageSeqNo,
[out] unsigned long *pfQOP
);
Parameters
[in] phContext
A handle to the security context to be used to decrypt the message.
[in, out] pMessage
A pointer to a SecBufferDesc structure. On input, the structure references one or more SecBuffer structures. At least one of these must be of type SECBUFFER_DATA. That buffer contains the encrypted message. The encrypted message is decrypted in place, overwriting the original contents of its buffer.
When using the Digest SSP, on input, the structure references one or more SecBuffer structures. One of these must be of type SECBUFFER_DATA or SECBUFFER_STREAM, and it must contain the encrypted message.
[in] MessageSeqNo
The sequence number expected by the transport application, if any. If the transport application does not maintain sequence numbers, this parameter must be set to zero.
When using the Digest SSP, this parameter must be set to zero. The Digest SSP manages sequence numbering internally.
[out] pfQOP
A pointer to a variable of type ULONG that receives package-specific flags that indicate the quality of protection.
This parameter can be one of the following flags.
| Value | Meaning |
|---|---|
|
The message was not encrypted, but a header or trailer was produced.
Note KERB_WRAP_NO_ENCRYPT has the same value and the same meaning.
|
|
When using the Digest SSP, use this flag when the security context is set to verify the signature only. For more information, see Quality of Protection. |
Return value
If the function verifies that the message was received in the correct sequence, the function returns SEC_E_OK.
If the function fails to decrypt the message, it returns one of the following error codes.
| Return code | Description |
|---|---|
|
The message buffer is too small. Used with the Digest SSP. |
|
The cipher chosen for the security context is not supported. Used with the Digest SSP. |
|
The data in the input buffer is incomplete. The application needs to read more data from the server and call DecryptMessage (Digest) again. |
|
A context handle that is not valid was specified in the phContext parameter. Used with the Digest SSP. |
|
The message has been altered. Used with the Digest SSP. |
|
The message was not received in the correct sequence. |
|
Neither confidentiality nor integrity are supported by the security context. Used with the Digest SSP. |
Remarks
Sometimes an application will read data from the remote party, attempt to decrypt it by using DecryptMessage (Digest), and discover that DecryptMessage (Digest) succeeded but the output buffers are empty. This is normal behavior, and applications must be able to deal with it.
Windows XP: This function was also known as UnsealMessage. Applications should now use DecryptMessage (Digest) only.
Requirements
| Requirement | Value |
|---|---|
| Minimum supported client | Windows XP [desktop apps only] |
| Minimum supported server | Windows Server 2003 [desktop apps only] |
| Target Platform | Windows |
| Header | sspi.h (include Security.h) |
| Library | Secur32.lib |
| DLL | Secur32.dll |