diff --git a/share/man/man9/crypto.9 b/share/man/man9/crypto.9
index ccafa23e8e61..01332b77b7ae 100644
--- a/share/man/man9/crypto.9
+++ b/share/man/man9/crypto.9
@@ -318,7 +318,7 @@ For MAC algorithms, this is where the result of the keyed hash will be
 inserted.
 .It Va crd_flags
 The following flags are defined:
-.Bl -tag -width ".Dv CRD_F_IV_EXPLICIT"
+.Bl -tag -width ".Dv CRD"
 .It Dv CRD_F_ENCRYPT
 For encryption algorithms, this bit is set when encryption is required
 (when not set, decryption is performed).
@@ -344,7 +344,7 @@ flag.
 For encryption algorithms, this bit is set when the IV is explicitly
 provided by the consumer in the
 .Va cri_iv
-fields.
+field.
 Otherwise, for encryption operations the IV is provided for by
 the driver used to perform the operation, whereas for decryption
 operations it is pointed to by the
@@ -355,6 +355,12 @@ This flag is typically used when the IV is calculated
 by the consumer, and does not precede the data (some
 .Xr ipsec 4
 configurations, and the encrypted swap are two such examples).
+.It Dv CRD_F_KEY_EXPLICIT
+For encryption algorithms, this bit is set when the key is explicitly
+provided by the consumer in the
+.Va cri_key
+field for the given operation.
+Otherwise, the key is taken from at newsession time from the same field.
 .It Dv CRD_F_COMP
 For compression algorithms, this bit is set when compression is required (when
 not set, decompression is performed).