Loading...
1#
2# Generic algorithms support
3#
4config XOR_BLOCKS
5 tristate
6
7#
8# async_tx api: hardware offloaded memory transfer/transform support
9#
10source "crypto/async_tx/Kconfig"
11
12#
13# Cryptographic API Configuration
14#
15menuconfig CRYPTO
16 tristate "Cryptographic API"
17 help
18 This option provides the core Cryptographic API.
19
20if CRYPTO
21
22comment "Crypto core or helper"
23
24config CRYPTO_FIPS
25 bool "FIPS 200 compliance"
26 depends on CRYPTO_ANSI_CPRNG && !CRYPTO_MANAGER_DISABLE_TESTS
27 help
28 This options enables the fips boot option which is
29 required if you want to system to operate in a FIPS 200
30 certification. You should say no unless you know what
31 this is.
32
33config CRYPTO_ALGAPI
34 tristate
35 select CRYPTO_ALGAPI2
36 help
37 This option provides the API for cryptographic algorithms.
38
39config CRYPTO_ALGAPI2
40 tristate
41
42config CRYPTO_AEAD
43 tristate
44 select CRYPTO_AEAD2
45 select CRYPTO_ALGAPI
46
47config CRYPTO_AEAD2
48 tristate
49 select CRYPTO_ALGAPI2
50
51config CRYPTO_BLKCIPHER
52 tristate
53 select CRYPTO_BLKCIPHER2
54 select CRYPTO_ALGAPI
55
56config CRYPTO_BLKCIPHER2
57 tristate
58 select CRYPTO_ALGAPI2
59 select CRYPTO_RNG2
60 select CRYPTO_WORKQUEUE
61
62config CRYPTO_HASH
63 tristate
64 select CRYPTO_HASH2
65 select CRYPTO_ALGAPI
66
67config CRYPTO_HASH2
68 tristate
69 select CRYPTO_ALGAPI2
70
71config CRYPTO_RNG
72 tristate
73 select CRYPTO_RNG2
74 select CRYPTO_ALGAPI
75
76config CRYPTO_RNG2
77 tristate
78 select CRYPTO_ALGAPI2
79
80config CRYPTO_PCOMP
81 tristate
82 select CRYPTO_PCOMP2
83 select CRYPTO_ALGAPI
84
85config CRYPTO_PCOMP2
86 tristate
87 select CRYPTO_ALGAPI2
88
89config CRYPTO_MANAGER
90 tristate "Cryptographic algorithm manager"
91 select CRYPTO_MANAGER2
92 help
93 Create default cryptographic template instantiations such as
94 cbc(aes).
95
96config CRYPTO_MANAGER2
97 def_tristate CRYPTO_MANAGER || (CRYPTO_MANAGER!=n && CRYPTO_ALGAPI=y)
98 select CRYPTO_AEAD2
99 select CRYPTO_HASH2
100 select CRYPTO_BLKCIPHER2
101 select CRYPTO_PCOMP2
102
103config CRYPTO_USER
104 tristate "Userspace cryptographic algorithm configuration"
105 depends on NET
106 select CRYPTO_MANAGER
107 help
108 Userspace configuration for cryptographic instantiations such as
109 cbc(aes).
110
111config CRYPTO_MANAGER_DISABLE_TESTS
112 bool "Disable run-time self tests"
113 default y
114 depends on CRYPTO_MANAGER2
115 help
116 Disable run-time self tests that normally take place at
117 algorithm registration.
118
119config CRYPTO_GF128MUL
120 tristate "GF(2^128) multiplication functions"
121 help
122 Efficient table driven implementation of multiplications in the
123 field GF(2^128). This is needed by some cypher modes. This
124 option will be selected automatically if you select such a
125 cipher mode. Only select this option by hand if you expect to load
126 an external module that requires these functions.
127
128config CRYPTO_NULL
129 tristate "Null algorithms"
130 select CRYPTO_ALGAPI
131 select CRYPTO_BLKCIPHER
132 select CRYPTO_HASH
133 help
134 These are 'Null' algorithms, used by IPsec, which do nothing.
135
136config CRYPTO_PCRYPT
137 tristate "Parallel crypto engine"
138 depends on SMP
139 select PADATA
140 select CRYPTO_MANAGER
141 select CRYPTO_AEAD
142 help
143 This converts an arbitrary crypto algorithm into a parallel
144 algorithm that executes in kernel threads.
145
146config CRYPTO_WORKQUEUE
147 tristate
148
149config CRYPTO_CRYPTD
150 tristate "Software async crypto daemon"
151 select CRYPTO_BLKCIPHER
152 select CRYPTO_HASH
153 select CRYPTO_MANAGER
154 select CRYPTO_WORKQUEUE
155 help
156 This is a generic software asynchronous crypto daemon that
157 converts an arbitrary synchronous software crypto algorithm
158 into an asynchronous algorithm that executes in a kernel thread.
159
160config CRYPTO_AUTHENC
161 tristate "Authenc support"
162 select CRYPTO_AEAD
163 select CRYPTO_BLKCIPHER
164 select CRYPTO_MANAGER
165 select CRYPTO_HASH
166 help
167 Authenc: Combined mode wrapper for IPsec.
168 This is required for IPSec.
169
170config CRYPTO_TEST
171 tristate "Testing module"
172 depends on m
173 select CRYPTO_MANAGER
174 help
175 Quick & dirty crypto test module.
176
177config CRYPTO_ABLK_HELPER
178 tristate
179 select CRYPTO_CRYPTD
180
181config CRYPTO_GLUE_HELPER_X86
182 tristate
183 depends on X86
184 select CRYPTO_ALGAPI
185
186comment "Authenticated Encryption with Associated Data"
187
188config CRYPTO_CCM
189 tristate "CCM support"
190 select CRYPTO_CTR
191 select CRYPTO_AEAD
192 help
193 Support for Counter with CBC MAC. Required for IPsec.
194
195config CRYPTO_GCM
196 tristate "GCM/GMAC support"
197 select CRYPTO_CTR
198 select CRYPTO_AEAD
199 select CRYPTO_GHASH
200 select CRYPTO_NULL
201 help
202 Support for Galois/Counter Mode (GCM) and Galois Message
203 Authentication Code (GMAC). Required for IPSec.
204
205config CRYPTO_SEQIV
206 tristate "Sequence Number IV Generator"
207 select CRYPTO_AEAD
208 select CRYPTO_BLKCIPHER
209 select CRYPTO_RNG
210 help
211 This IV generator generates an IV based on a sequence number by
212 xoring it with a salt. This algorithm is mainly useful for CTR
213
214comment "Block modes"
215
216config CRYPTO_CBC
217 tristate "CBC support"
218 select CRYPTO_BLKCIPHER
219 select CRYPTO_MANAGER
220 help
221 CBC: Cipher Block Chaining mode
222 This block cipher algorithm is required for IPSec.
223
224config CRYPTO_CTR
225 tristate "CTR support"
226 select CRYPTO_BLKCIPHER
227 select CRYPTO_SEQIV
228 select CRYPTO_MANAGER
229 help
230 CTR: Counter mode
231 This block cipher algorithm is required for IPSec.
232
233config CRYPTO_CTS
234 tristate "CTS support"
235 select CRYPTO_BLKCIPHER
236 help
237 CTS: Cipher Text Stealing
238 This is the Cipher Text Stealing mode as described by
239 Section 8 of rfc2040 and referenced by rfc3962.
240 (rfc3962 includes errata information in its Appendix A)
241 This mode is required for Kerberos gss mechanism support
242 for AES encryption.
243
244config CRYPTO_ECB
245 tristate "ECB support"
246 select CRYPTO_BLKCIPHER
247 select CRYPTO_MANAGER
248 help
249 ECB: Electronic CodeBook mode
250 This is the simplest block cipher algorithm. It simply encrypts
251 the input block by block.
252
253config CRYPTO_LRW
254 tristate "LRW support"
255 select CRYPTO_BLKCIPHER
256 select CRYPTO_MANAGER
257 select CRYPTO_GF128MUL
258 help
259 LRW: Liskov Rivest Wagner, a tweakable, non malleable, non movable
260 narrow block cipher mode for dm-crypt. Use it with cipher
261 specification string aes-lrw-benbi, the key must be 256, 320 or 384.
262 The first 128, 192 or 256 bits in the key are used for AES and the
263 rest is used to tie each cipher block to its logical position.
264
265config CRYPTO_PCBC
266 tristate "PCBC support"
267 select CRYPTO_BLKCIPHER
268 select CRYPTO_MANAGER
269 help
270 PCBC: Propagating Cipher Block Chaining mode
271 This block cipher algorithm is required for RxRPC.
272
273config CRYPTO_XTS
274 tristate "XTS support"
275 select CRYPTO_BLKCIPHER
276 select CRYPTO_MANAGER
277 select CRYPTO_GF128MUL
278 help
279 XTS: IEEE1619/D16 narrow block cipher use with aes-xts-plain,
280 key size 256, 384 or 512 bits. This implementation currently
281 can't handle a sectorsize which is not a multiple of 16 bytes.
282
283comment "Hash modes"
284
285config CRYPTO_CMAC
286 tristate "CMAC support"
287 select CRYPTO_HASH
288 select CRYPTO_MANAGER
289 help
290 Cipher-based Message Authentication Code (CMAC) specified by
291 The National Institute of Standards and Technology (NIST).
292
293 https://tools.ietf.org/html/rfc4493
294 http://csrc.nist.gov/publications/nistpubs/800-38B/SP_800-38B.pdf
295
296config CRYPTO_HMAC
297 tristate "HMAC support"
298 select CRYPTO_HASH
299 select CRYPTO_MANAGER
300 help
301 HMAC: Keyed-Hashing for Message Authentication (RFC2104).
302 This is required for IPSec.
303
304config CRYPTO_XCBC
305 tristate "XCBC support"
306 select CRYPTO_HASH
307 select CRYPTO_MANAGER
308 help
309 XCBC: Keyed-Hashing with encryption algorithm
310 http://www.ietf.org/rfc/rfc3566.txt
311 http://csrc.nist.gov/encryption/modes/proposedmodes/
312 xcbc-mac/xcbc-mac-spec.pdf
313
314config CRYPTO_VMAC
315 tristate "VMAC support"
316 select CRYPTO_HASH
317 select CRYPTO_MANAGER
318 help
319 VMAC is a message authentication algorithm designed for
320 very high speed on 64-bit architectures.
321
322 See also:
323 <http://fastcrypto.org/vmac>
324
325comment "Digest"
326
327config CRYPTO_CRC32C
328 tristate "CRC32c CRC algorithm"
329 select CRYPTO_HASH
330 select CRC32
331 help
332 Castagnoli, et al Cyclic Redundancy-Check Algorithm. Used
333 by iSCSI for header and data digests and by others.
334 See Castagnoli93. Module will be crc32c.
335
336config CRYPTO_CRC32C_INTEL
337 tristate "CRC32c INTEL hardware acceleration"
338 depends on X86
339 select CRYPTO_HASH
340 help
341 In Intel processor with SSE4.2 supported, the processor will
342 support CRC32C implementation using hardware accelerated CRC32
343 instruction. This option will create 'crc32c-intel' module,
344 which will enable any routine to use the CRC32 instruction to
345 gain performance compared with software implementation.
346 Module will be crc32c-intel.
347
348config CRYPTO_CRC32C_SPARC64
349 tristate "CRC32c CRC algorithm (SPARC64)"
350 depends on SPARC64
351 select CRYPTO_HASH
352 select CRC32
353 help
354 CRC32c CRC algorithm implemented using sparc64 crypto instructions,
355 when available.
356
357config CRYPTO_CRC32
358 tristate "CRC32 CRC algorithm"
359 select CRYPTO_HASH
360 select CRC32
361 help
362 CRC-32-IEEE 802.3 cyclic redundancy-check algorithm.
363 Shash crypto api wrappers to crc32_le function.
364
365config CRYPTO_CRC32_PCLMUL
366 tristate "CRC32 PCLMULQDQ hardware acceleration"
367 depends on X86
368 select CRYPTO_HASH
369 select CRC32
370 help
371 From Intel Westmere and AMD Bulldozer processor with SSE4.2
372 and PCLMULQDQ supported, the processor will support
373 CRC32 PCLMULQDQ implementation using hardware accelerated PCLMULQDQ
374 instruction. This option will create 'crc32-plcmul' module,
375 which will enable any routine to use the CRC-32-IEEE 802.3 checksum
376 and gain better performance as compared with the table implementation.
377
378config CRYPTO_CRCT10DIF
379 tristate "CRCT10DIF algorithm"
380 select CRYPTO_HASH
381 help
382 CRC T10 Data Integrity Field computation is being cast as
383 a crypto transform. This allows for faster crc t10 diff
384 transforms to be used if they are available.
385
386config CRYPTO_CRCT10DIF_PCLMUL
387 tristate "CRCT10DIF PCLMULQDQ hardware acceleration"
388 depends on X86 && 64BIT && CRC_T10DIF
389 select CRYPTO_HASH
390 help
391 For x86_64 processors with SSE4.2 and PCLMULQDQ supported,
392 CRC T10 DIF PCLMULQDQ computation can be hardware
393 accelerated PCLMULQDQ instruction. This option will create
394 'crct10dif-plcmul' module, which is faster when computing the
395 crct10dif checksum as compared with the generic table implementation.
396
397config CRYPTO_GHASH
398 tristate "GHASH digest algorithm"
399 select CRYPTO_GF128MUL
400 help
401 GHASH is message digest algorithm for GCM (Galois/Counter Mode).
402
403config CRYPTO_MD4
404 tristate "MD4 digest algorithm"
405 select CRYPTO_HASH
406 help
407 MD4 message digest algorithm (RFC1320).
408
409config CRYPTO_MD5
410 tristate "MD5 digest algorithm"
411 select CRYPTO_HASH
412 help
413 MD5 message digest algorithm (RFC1321).
414
415config CRYPTO_MD5_SPARC64
416 tristate "MD5 digest algorithm (SPARC64)"
417 depends on SPARC64
418 select CRYPTO_MD5
419 select CRYPTO_HASH
420 help
421 MD5 message digest algorithm (RFC1321) implemented
422 using sparc64 crypto instructions, when available.
423
424config CRYPTO_MICHAEL_MIC
425 tristate "Michael MIC keyed digest algorithm"
426 select CRYPTO_HASH
427 help
428 Michael MIC is used for message integrity protection in TKIP
429 (IEEE 802.11i). This algorithm is required for TKIP, but it
430 should not be used for other purposes because of the weakness
431 of the algorithm.
432
433config CRYPTO_RMD128
434 tristate "RIPEMD-128 digest algorithm"
435 select CRYPTO_HASH
436 help
437 RIPEMD-128 (ISO/IEC 10118-3:2004).
438
439 RIPEMD-128 is a 128-bit cryptographic hash function. It should only
440 be used as a secure replacement for RIPEMD. For other use cases,
441 RIPEMD-160 should be used.
442
443 Developed by Hans Dobbertin, Antoon Bosselaers and Bart Preneel.
444 See <http://homes.esat.kuleuven.be/~bosselae/ripemd160.html>
445
446config CRYPTO_RMD160
447 tristate "RIPEMD-160 digest algorithm"
448 select CRYPTO_HASH
449 help
450 RIPEMD-160 (ISO/IEC 10118-3:2004).
451
452 RIPEMD-160 is a 160-bit cryptographic hash function. It is intended
453 to be used as a secure replacement for the 128-bit hash functions
454 MD4, MD5 and it's predecessor RIPEMD
455 (not to be confused with RIPEMD-128).
456
457 It's speed is comparable to SHA1 and there are no known attacks
458 against RIPEMD-160.
459
460 Developed by Hans Dobbertin, Antoon Bosselaers and Bart Preneel.
461 See <http://homes.esat.kuleuven.be/~bosselae/ripemd160.html>
462
463config CRYPTO_RMD256
464 tristate "RIPEMD-256 digest algorithm"
465 select CRYPTO_HASH
466 help
467 RIPEMD-256 is an optional extension of RIPEMD-128 with a
468 256 bit hash. It is intended for applications that require
469 longer hash-results, without needing a larger security level
470 (than RIPEMD-128).
471
472 Developed by Hans Dobbertin, Antoon Bosselaers and Bart Preneel.
473 See <http://homes.esat.kuleuven.be/~bosselae/ripemd160.html>
474
475config CRYPTO_RMD320
476 tristate "RIPEMD-320 digest algorithm"
477 select CRYPTO_HASH
478 help
479 RIPEMD-320 is an optional extension of RIPEMD-160 with a
480 320 bit hash. It is intended for applications that require
481 longer hash-results, without needing a larger security level
482 (than RIPEMD-160).
483
484 Developed by Hans Dobbertin, Antoon Bosselaers and Bart Preneel.
485 See <http://homes.esat.kuleuven.be/~bosselae/ripemd160.html>
486
487config CRYPTO_SHA1
488 tristate "SHA1 digest algorithm"
489 select CRYPTO_HASH
490 help
491 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2).
492
493config CRYPTO_SHA1_SSSE3
494 tristate "SHA1 digest algorithm (SSSE3/AVX/AVX2)"
495 depends on X86 && 64BIT
496 select CRYPTO_SHA1
497 select CRYPTO_HASH
498 help
499 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2) implemented
500 using Supplemental SSE3 (SSSE3) instructions or Advanced Vector
501 Extensions (AVX/AVX2), when available.
502
503config CRYPTO_SHA256_SSSE3
504 tristate "SHA256 digest algorithm (SSSE3/AVX/AVX2)"
505 depends on X86 && 64BIT
506 select CRYPTO_SHA256
507 select CRYPTO_HASH
508 help
509 SHA-256 secure hash standard (DFIPS 180-2) implemented
510 using Supplemental SSE3 (SSSE3) instructions, or Advanced Vector
511 Extensions version 1 (AVX1), or Advanced Vector Extensions
512 version 2 (AVX2) instructions, when available.
513
514config CRYPTO_SHA512_SSSE3
515 tristate "SHA512 digest algorithm (SSSE3/AVX/AVX2)"
516 depends on X86 && 64BIT
517 select CRYPTO_SHA512
518 select CRYPTO_HASH
519 help
520 SHA-512 secure hash standard (DFIPS 180-2) implemented
521 using Supplemental SSE3 (SSSE3) instructions, or Advanced Vector
522 Extensions version 1 (AVX1), or Advanced Vector Extensions
523 version 2 (AVX2) instructions, when available.
524
525config CRYPTO_SHA1_SPARC64
526 tristate "SHA1 digest algorithm (SPARC64)"
527 depends on SPARC64
528 select CRYPTO_SHA1
529 select CRYPTO_HASH
530 help
531 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2) implemented
532 using sparc64 crypto instructions, when available.
533
534config CRYPTO_SHA1_ARM
535 tristate "SHA1 digest algorithm (ARM-asm)"
536 depends on ARM
537 select CRYPTO_SHA1
538 select CRYPTO_HASH
539 help
540 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2) implemented
541 using optimized ARM assembler.
542
543config CRYPTO_SHA1_PPC
544 tristate "SHA1 digest algorithm (powerpc)"
545 depends on PPC
546 help
547 This is the powerpc hardware accelerated implementation of the
548 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2).
549
550config CRYPTO_SHA256
551 tristate "SHA224 and SHA256 digest algorithm"
552 select CRYPTO_HASH
553 help
554 SHA256 secure hash standard (DFIPS 180-2).
555
556 This version of SHA implements a 256 bit hash with 128 bits of
557 security against collision attacks.
558
559 This code also includes SHA-224, a 224 bit hash with 112 bits
560 of security against collision attacks.
561
562config CRYPTO_SHA256_SPARC64
563 tristate "SHA224 and SHA256 digest algorithm (SPARC64)"
564 depends on SPARC64
565 select CRYPTO_SHA256
566 select CRYPTO_HASH
567 help
568 SHA-256 secure hash standard (DFIPS 180-2) implemented
569 using sparc64 crypto instructions, when available.
570
571config CRYPTO_SHA512
572 tristate "SHA384 and SHA512 digest algorithms"
573 select CRYPTO_HASH
574 help
575 SHA512 secure hash standard (DFIPS 180-2).
576
577 This version of SHA implements a 512 bit hash with 256 bits of
578 security against collision attacks.
579
580 This code also includes SHA-384, a 384 bit hash with 192 bits
581 of security against collision attacks.
582
583config CRYPTO_SHA512_SPARC64
584 tristate "SHA384 and SHA512 digest algorithm (SPARC64)"
585 depends on SPARC64
586 select CRYPTO_SHA512
587 select CRYPTO_HASH
588 help
589 SHA-512 secure hash standard (DFIPS 180-2) implemented
590 using sparc64 crypto instructions, when available.
591
592config CRYPTO_TGR192
593 tristate "Tiger digest algorithms"
594 select CRYPTO_HASH
595 help
596 Tiger hash algorithm 192, 160 and 128-bit hashes
597
598 Tiger is a hash function optimized for 64-bit processors while
599 still having decent performance on 32-bit processors.
600 Tiger was developed by Ross Anderson and Eli Biham.
601
602 See also:
603 <http://www.cs.technion.ac.il/~biham/Reports/Tiger/>.
604
605config CRYPTO_WP512
606 tristate "Whirlpool digest algorithms"
607 select CRYPTO_HASH
608 help
609 Whirlpool hash algorithm 512, 384 and 256-bit hashes
610
611 Whirlpool-512 is part of the NESSIE cryptographic primitives.
612 Whirlpool will be part of the ISO/IEC 10118-3:2003(E) standard
613
614 See also:
615 <http://www.larc.usp.br/~pbarreto/WhirlpoolPage.html>
616
617config CRYPTO_GHASH_CLMUL_NI_INTEL
618 tristate "GHASH digest algorithm (CLMUL-NI accelerated)"
619 depends on X86 && 64BIT
620 select CRYPTO_CRYPTD
621 help
622 GHASH is message digest algorithm for GCM (Galois/Counter Mode).
623 The implementation is accelerated by CLMUL-NI of Intel.
624
625comment "Ciphers"
626
627config CRYPTO_AES
628 tristate "AES cipher algorithms"
629 select CRYPTO_ALGAPI
630 help
631 AES cipher algorithms (FIPS-197). AES uses the Rijndael
632 algorithm.
633
634 Rijndael appears to be consistently a very good performer in
635 both hardware and software across a wide range of computing
636 environments regardless of its use in feedback or non-feedback
637 modes. Its key setup time is excellent, and its key agility is
638 good. Rijndael's very low memory requirements make it very well
639 suited for restricted-space environments, in which it also
640 demonstrates excellent performance. Rijndael's operations are
641 among the easiest to defend against power and timing attacks.
642
643 The AES specifies three key sizes: 128, 192 and 256 bits
644
645 See <http://csrc.nist.gov/CryptoToolkit/aes/> for more information.
646
647config CRYPTO_AES_586
648 tristate "AES cipher algorithms (i586)"
649 depends on (X86 || UML_X86) && !64BIT
650 select CRYPTO_ALGAPI
651 select CRYPTO_AES
652 help
653 AES cipher algorithms (FIPS-197). AES uses the Rijndael
654 algorithm.
655
656 Rijndael appears to be consistently a very good performer in
657 both hardware and software across a wide range of computing
658 environments regardless of its use in feedback or non-feedback
659 modes. Its key setup time is excellent, and its key agility is
660 good. Rijndael's very low memory requirements make it very well
661 suited for restricted-space environments, in which it also
662 demonstrates excellent performance. Rijndael's operations are
663 among the easiest to defend against power and timing attacks.
664
665 The AES specifies three key sizes: 128, 192 and 256 bits
666
667 See <http://csrc.nist.gov/encryption/aes/> for more information.
668
669config CRYPTO_AES_X86_64
670 tristate "AES cipher algorithms (x86_64)"
671 depends on (X86 || UML_X86) && 64BIT
672 select CRYPTO_ALGAPI
673 select CRYPTO_AES
674 help
675 AES cipher algorithms (FIPS-197). AES uses the Rijndael
676 algorithm.
677
678 Rijndael appears to be consistently a very good performer in
679 both hardware and software across a wide range of computing
680 environments regardless of its use in feedback or non-feedback
681 modes. Its key setup time is excellent, and its key agility is
682 good. Rijndael's very low memory requirements make it very well
683 suited for restricted-space environments, in which it also
684 demonstrates excellent performance. Rijndael's operations are
685 among the easiest to defend against power and timing attacks.
686
687 The AES specifies three key sizes: 128, 192 and 256 bits
688
689 See <http://csrc.nist.gov/encryption/aes/> for more information.
690
691config CRYPTO_AES_NI_INTEL
692 tristate "AES cipher algorithms (AES-NI)"
693 depends on X86
694 select CRYPTO_AES_X86_64 if 64BIT
695 select CRYPTO_AES_586 if !64BIT
696 select CRYPTO_CRYPTD
697 select CRYPTO_ABLK_HELPER
698 select CRYPTO_ALGAPI
699 select CRYPTO_GLUE_HELPER_X86 if 64BIT
700 select CRYPTO_LRW
701 select CRYPTO_XTS
702 help
703 Use Intel AES-NI instructions for AES algorithm.
704
705 AES cipher algorithms (FIPS-197). AES uses the Rijndael
706 algorithm.
707
708 Rijndael appears to be consistently a very good performer in
709 both hardware and software across a wide range of computing
710 environments regardless of its use in feedback or non-feedback
711 modes. Its key setup time is excellent, and its key agility is
712 good. Rijndael's very low memory requirements make it very well
713 suited for restricted-space environments, in which it also
714 demonstrates excellent performance. Rijndael's operations are
715 among the easiest to defend against power and timing attacks.
716
717 The AES specifies three key sizes: 128, 192 and 256 bits
718
719 See <http://csrc.nist.gov/encryption/aes/> for more information.
720
721 In addition to AES cipher algorithm support, the acceleration
722 for some popular block cipher mode is supported too, including
723 ECB, CBC, LRW, PCBC, XTS. The 64 bit version has additional
724 acceleration for CTR.
725
726config CRYPTO_AES_SPARC64
727 tristate "AES cipher algorithms (SPARC64)"
728 depends on SPARC64
729 select CRYPTO_CRYPTD
730 select CRYPTO_ALGAPI
731 help
732 Use SPARC64 crypto opcodes for AES algorithm.
733
734 AES cipher algorithms (FIPS-197). AES uses the Rijndael
735 algorithm.
736
737 Rijndael appears to be consistently a very good performer in
738 both hardware and software across a wide range of computing
739 environments regardless of its use in feedback or non-feedback
740 modes. Its key setup time is excellent, and its key agility is
741 good. Rijndael's very low memory requirements make it very well
742 suited for restricted-space environments, in which it also
743 demonstrates excellent performance. Rijndael's operations are
744 among the easiest to defend against power and timing attacks.
745
746 The AES specifies three key sizes: 128, 192 and 256 bits
747
748 See <http://csrc.nist.gov/encryption/aes/> for more information.
749
750 In addition to AES cipher algorithm support, the acceleration
751 for some popular block cipher mode is supported too, including
752 ECB and CBC.
753
754config CRYPTO_AES_ARM
755 tristate "AES cipher algorithms (ARM-asm)"
756 depends on ARM
757 select CRYPTO_ALGAPI
758 select CRYPTO_AES
759 help
760 Use optimized AES assembler routines for ARM platforms.
761
762 AES cipher algorithms (FIPS-197). AES uses the Rijndael
763 algorithm.
764
765 Rijndael appears to be consistently a very good performer in
766 both hardware and software across a wide range of computing
767 environments regardless of its use in feedback or non-feedback
768 modes. Its key setup time is excellent, and its key agility is
769 good. Rijndael's very low memory requirements make it very well
770 suited for restricted-space environments, in which it also
771 demonstrates excellent performance. Rijndael's operations are
772 among the easiest to defend against power and timing attacks.
773
774 The AES specifies three key sizes: 128, 192 and 256 bits
775
776 See <http://csrc.nist.gov/encryption/aes/> for more information.
777
778config CRYPTO_AES_ARM_BS
779 tristate "Bit sliced AES using NEON instructions"
780 depends on ARM && KERNEL_MODE_NEON
781 select CRYPTO_ALGAPI
782 select CRYPTO_AES_ARM
783 select CRYPTO_ABLK_HELPER
784 help
785 Use a faster and more secure NEON based implementation of AES in CBC,
786 CTR and XTS modes
787
788 Bit sliced AES gives around 45% speedup on Cortex-A15 for CTR mode
789 and for XTS mode encryption, CBC and XTS mode decryption speedup is
790 around 25%. (CBC encryption speed is not affected by this driver.)
791 This implementation does not rely on any lookup tables so it is
792 believed to be invulnerable to cache timing attacks.
793
794config CRYPTO_ANUBIS
795 tristate "Anubis cipher algorithm"
796 select CRYPTO_ALGAPI
797 help
798 Anubis cipher algorithm.
799
800 Anubis is a variable key length cipher which can use keys from
801 128 bits to 320 bits in length. It was evaluated as a entrant
802 in the NESSIE competition.
803
804 See also:
805 <https://www.cosic.esat.kuleuven.be/nessie/reports/>
806 <http://www.larc.usp.br/~pbarreto/AnubisPage.html>
807
808config CRYPTO_ARC4
809 tristate "ARC4 cipher algorithm"
810 select CRYPTO_BLKCIPHER
811 help
812 ARC4 cipher algorithm.
813
814 ARC4 is a stream cipher using keys ranging from 8 bits to 2048
815 bits in length. This algorithm is required for driver-based
816 WEP, but it should not be for other purposes because of the
817 weakness of the algorithm.
818
819config CRYPTO_BLOWFISH
820 tristate "Blowfish cipher algorithm"
821 select CRYPTO_ALGAPI
822 select CRYPTO_BLOWFISH_COMMON
823 help
824 Blowfish cipher algorithm, by Bruce Schneier.
825
826 This is a variable key length cipher which can use keys from 32
827 bits to 448 bits in length. It's fast, simple and specifically
828 designed for use on "large microprocessors".
829
830 See also:
831 <http://www.schneier.com/blowfish.html>
832
833config CRYPTO_BLOWFISH_COMMON
834 tristate
835 help
836 Common parts of the Blowfish cipher algorithm shared by the
837 generic c and the assembler implementations.
838
839 See also:
840 <http://www.schneier.com/blowfish.html>
841
842config CRYPTO_BLOWFISH_X86_64
843 tristate "Blowfish cipher algorithm (x86_64)"
844 depends on X86 && 64BIT
845 select CRYPTO_ALGAPI
846 select CRYPTO_BLOWFISH_COMMON
847 help
848 Blowfish cipher algorithm (x86_64), by Bruce Schneier.
849
850 This is a variable key length cipher which can use keys from 32
851 bits to 448 bits in length. It's fast, simple and specifically
852 designed for use on "large microprocessors".
853
854 See also:
855 <http://www.schneier.com/blowfish.html>
856
857config CRYPTO_CAMELLIA
858 tristate "Camellia cipher algorithms"
859 depends on CRYPTO
860 select CRYPTO_ALGAPI
861 help
862 Camellia cipher algorithms module.
863
864 Camellia is a symmetric key block cipher developed jointly
865 at NTT and Mitsubishi Electric Corporation.
866
867 The Camellia specifies three key sizes: 128, 192 and 256 bits.
868
869 See also:
870 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
871
872config CRYPTO_CAMELLIA_X86_64
873 tristate "Camellia cipher algorithm (x86_64)"
874 depends on X86 && 64BIT
875 depends on CRYPTO
876 select CRYPTO_ALGAPI
877 select CRYPTO_GLUE_HELPER_X86
878 select CRYPTO_LRW
879 select CRYPTO_XTS
880 help
881 Camellia cipher algorithm module (x86_64).
882
883 Camellia is a symmetric key block cipher developed jointly
884 at NTT and Mitsubishi Electric Corporation.
885
886 The Camellia specifies three key sizes: 128, 192 and 256 bits.
887
888 See also:
889 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
890
891config CRYPTO_CAMELLIA_AESNI_AVX_X86_64
892 tristate "Camellia cipher algorithm (x86_64/AES-NI/AVX)"
893 depends on X86 && 64BIT
894 depends on CRYPTO
895 select CRYPTO_ALGAPI
896 select CRYPTO_CRYPTD
897 select CRYPTO_ABLK_HELPER
898 select CRYPTO_GLUE_HELPER_X86
899 select CRYPTO_CAMELLIA_X86_64
900 select CRYPTO_LRW
901 select CRYPTO_XTS
902 help
903 Camellia cipher algorithm module (x86_64/AES-NI/AVX).
904
905 Camellia is a symmetric key block cipher developed jointly
906 at NTT and Mitsubishi Electric Corporation.
907
908 The Camellia specifies three key sizes: 128, 192 and 256 bits.
909
910 See also:
911 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
912
913config CRYPTO_CAMELLIA_AESNI_AVX2_X86_64
914 tristate "Camellia cipher algorithm (x86_64/AES-NI/AVX2)"
915 depends on X86 && 64BIT
916 depends on CRYPTO
917 select CRYPTO_ALGAPI
918 select CRYPTO_CRYPTD
919 select CRYPTO_ABLK_HELPER
920 select CRYPTO_GLUE_HELPER_X86
921 select CRYPTO_CAMELLIA_X86_64
922 select CRYPTO_CAMELLIA_AESNI_AVX_X86_64
923 select CRYPTO_LRW
924 select CRYPTO_XTS
925 help
926 Camellia cipher algorithm module (x86_64/AES-NI/AVX2).
927
928 Camellia is a symmetric key block cipher developed jointly
929 at NTT and Mitsubishi Electric Corporation.
930
931 The Camellia specifies three key sizes: 128, 192 and 256 bits.
932
933 See also:
934 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
935
936config CRYPTO_CAMELLIA_SPARC64
937 tristate "Camellia cipher algorithm (SPARC64)"
938 depends on SPARC64
939 depends on CRYPTO
940 select CRYPTO_ALGAPI
941 help
942 Camellia cipher algorithm module (SPARC64).
943
944 Camellia is a symmetric key block cipher developed jointly
945 at NTT and Mitsubishi Electric Corporation.
946
947 The Camellia specifies three key sizes: 128, 192 and 256 bits.
948
949 See also:
950 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
951
952config CRYPTO_CAST_COMMON
953 tristate
954 help
955 Common parts of the CAST cipher algorithms shared by the
956 generic c and the assembler implementations.
957
958config CRYPTO_CAST5
959 tristate "CAST5 (CAST-128) cipher algorithm"
960 select CRYPTO_ALGAPI
961 select CRYPTO_CAST_COMMON
962 help
963 The CAST5 encryption algorithm (synonymous with CAST-128) is
964 described in RFC2144.
965
966config CRYPTO_CAST5_AVX_X86_64
967 tristate "CAST5 (CAST-128) cipher algorithm (x86_64/AVX)"
968 depends on X86 && 64BIT
969 select CRYPTO_ALGAPI
970 select CRYPTO_CRYPTD
971 select CRYPTO_ABLK_HELPER
972 select CRYPTO_CAST_COMMON
973 select CRYPTO_CAST5
974 help
975 The CAST5 encryption algorithm (synonymous with CAST-128) is
976 described in RFC2144.
977
978 This module provides the Cast5 cipher algorithm that processes
979 sixteen blocks parallel using the AVX instruction set.
980
981config CRYPTO_CAST6
982 tristate "CAST6 (CAST-256) cipher algorithm"
983 select CRYPTO_ALGAPI
984 select CRYPTO_CAST_COMMON
985 help
986 The CAST6 encryption algorithm (synonymous with CAST-256) is
987 described in RFC2612.
988
989config CRYPTO_CAST6_AVX_X86_64
990 tristate "CAST6 (CAST-256) cipher algorithm (x86_64/AVX)"
991 depends on X86 && 64BIT
992 select CRYPTO_ALGAPI
993 select CRYPTO_CRYPTD
994 select CRYPTO_ABLK_HELPER
995 select CRYPTO_GLUE_HELPER_X86
996 select CRYPTO_CAST_COMMON
997 select CRYPTO_CAST6
998 select CRYPTO_LRW
999 select CRYPTO_XTS
1000 help
1001 The CAST6 encryption algorithm (synonymous with CAST-256) is
1002 described in RFC2612.
1003
1004 This module provides the Cast6 cipher algorithm that processes
1005 eight blocks parallel using the AVX instruction set.
1006
1007config CRYPTO_DES
1008 tristate "DES and Triple DES EDE cipher algorithms"
1009 select CRYPTO_ALGAPI
1010 help
1011 DES cipher algorithm (FIPS 46-2), and Triple DES EDE (FIPS 46-3).
1012
1013config CRYPTO_DES_SPARC64
1014 tristate "DES and Triple DES EDE cipher algorithms (SPARC64)"
1015 depends on SPARC64
1016 select CRYPTO_ALGAPI
1017 select CRYPTO_DES
1018 help
1019 DES cipher algorithm (FIPS 46-2), and Triple DES EDE (FIPS 46-3),
1020 optimized using SPARC64 crypto opcodes.
1021
1022config CRYPTO_FCRYPT
1023 tristate "FCrypt cipher algorithm"
1024 select CRYPTO_ALGAPI
1025 select CRYPTO_BLKCIPHER
1026 help
1027 FCrypt algorithm used by RxRPC.
1028
1029config CRYPTO_KHAZAD
1030 tristate "Khazad cipher algorithm"
1031 select CRYPTO_ALGAPI
1032 help
1033 Khazad cipher algorithm.
1034
1035 Khazad was a finalist in the initial NESSIE competition. It is
1036 an algorithm optimized for 64-bit processors with good performance
1037 on 32-bit processors. Khazad uses an 128 bit key size.
1038
1039 See also:
1040 <http://www.larc.usp.br/~pbarreto/KhazadPage.html>
1041
1042config CRYPTO_SALSA20
1043 tristate "Salsa20 stream cipher algorithm"
1044 select CRYPTO_BLKCIPHER
1045 help
1046 Salsa20 stream cipher algorithm.
1047
1048 Salsa20 is a stream cipher submitted to eSTREAM, the ECRYPT
1049 Stream Cipher Project. See <http://www.ecrypt.eu.org/stream/>
1050
1051 The Salsa20 stream cipher algorithm is designed by Daniel J.
1052 Bernstein <djb@cr.yp.to>. See <http://cr.yp.to/snuffle.html>
1053
1054config CRYPTO_SALSA20_586
1055 tristate "Salsa20 stream cipher algorithm (i586)"
1056 depends on (X86 || UML_X86) && !64BIT
1057 select CRYPTO_BLKCIPHER
1058 help
1059 Salsa20 stream cipher algorithm.
1060
1061 Salsa20 is a stream cipher submitted to eSTREAM, the ECRYPT
1062 Stream Cipher Project. See <http://www.ecrypt.eu.org/stream/>
1063
1064 The Salsa20 stream cipher algorithm is designed by Daniel J.
1065 Bernstein <djb@cr.yp.to>. See <http://cr.yp.to/snuffle.html>
1066
1067config CRYPTO_SALSA20_X86_64
1068 tristate "Salsa20 stream cipher algorithm (x86_64)"
1069 depends on (X86 || UML_X86) && 64BIT
1070 select CRYPTO_BLKCIPHER
1071 help
1072 Salsa20 stream cipher algorithm.
1073
1074 Salsa20 is a stream cipher submitted to eSTREAM, the ECRYPT
1075 Stream Cipher Project. See <http://www.ecrypt.eu.org/stream/>
1076
1077 The Salsa20 stream cipher algorithm is designed by Daniel J.
1078 Bernstein <djb@cr.yp.to>. See <http://cr.yp.to/snuffle.html>
1079
1080config CRYPTO_SEED
1081 tristate "SEED cipher algorithm"
1082 select CRYPTO_ALGAPI
1083 help
1084 SEED cipher algorithm (RFC4269).
1085
1086 SEED is a 128-bit symmetric key block cipher that has been
1087 developed by KISA (Korea Information Security Agency) as a
1088 national standard encryption algorithm of the Republic of Korea.
1089 It is a 16 round block cipher with the key size of 128 bit.
1090
1091 See also:
1092 <http://www.kisa.or.kr/kisa/seed/jsp/seed_eng.jsp>
1093
1094config CRYPTO_SERPENT
1095 tristate "Serpent cipher algorithm"
1096 select CRYPTO_ALGAPI
1097 help
1098 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1099
1100 Keys are allowed to be from 0 to 256 bits in length, in steps
1101 of 8 bits. Also includes the 'Tnepres' algorithm, a reversed
1102 variant of Serpent for compatibility with old kerneli.org code.
1103
1104 See also:
1105 <http://www.cl.cam.ac.uk/~rja14/serpent.html>
1106
1107config CRYPTO_SERPENT_SSE2_X86_64
1108 tristate "Serpent cipher algorithm (x86_64/SSE2)"
1109 depends on X86 && 64BIT
1110 select CRYPTO_ALGAPI
1111 select CRYPTO_CRYPTD
1112 select CRYPTO_ABLK_HELPER
1113 select CRYPTO_GLUE_HELPER_X86
1114 select CRYPTO_SERPENT
1115 select CRYPTO_LRW
1116 select CRYPTO_XTS
1117 help
1118 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1119
1120 Keys are allowed to be from 0 to 256 bits in length, in steps
1121 of 8 bits.
1122
1123 This module provides Serpent cipher algorithm that processes eigth
1124 blocks parallel using SSE2 instruction set.
1125
1126 See also:
1127 <http://www.cl.cam.ac.uk/~rja14/serpent.html>
1128
1129config CRYPTO_SERPENT_SSE2_586
1130 tristate "Serpent cipher algorithm (i586/SSE2)"
1131 depends on X86 && !64BIT
1132 select CRYPTO_ALGAPI
1133 select CRYPTO_CRYPTD
1134 select CRYPTO_ABLK_HELPER
1135 select CRYPTO_GLUE_HELPER_X86
1136 select CRYPTO_SERPENT
1137 select CRYPTO_LRW
1138 select CRYPTO_XTS
1139 help
1140 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1141
1142 Keys are allowed to be from 0 to 256 bits in length, in steps
1143 of 8 bits.
1144
1145 This module provides Serpent cipher algorithm that processes four
1146 blocks parallel using SSE2 instruction set.
1147
1148 See also:
1149 <http://www.cl.cam.ac.uk/~rja14/serpent.html>
1150
1151config CRYPTO_SERPENT_AVX_X86_64
1152 tristate "Serpent cipher algorithm (x86_64/AVX)"
1153 depends on X86 && 64BIT
1154 select CRYPTO_ALGAPI
1155 select CRYPTO_CRYPTD
1156 select CRYPTO_ABLK_HELPER
1157 select CRYPTO_GLUE_HELPER_X86
1158 select CRYPTO_SERPENT
1159 select CRYPTO_LRW
1160 select CRYPTO_XTS
1161 help
1162 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1163
1164 Keys are allowed to be from 0 to 256 bits in length, in steps
1165 of 8 bits.
1166
1167 This module provides the Serpent cipher algorithm that processes
1168 eight blocks parallel using the AVX instruction set.
1169
1170 See also:
1171 <http://www.cl.cam.ac.uk/~rja14/serpent.html>
1172
1173config CRYPTO_SERPENT_AVX2_X86_64
1174 tristate "Serpent cipher algorithm (x86_64/AVX2)"
1175 depends on X86 && 64BIT
1176 select CRYPTO_ALGAPI
1177 select CRYPTO_CRYPTD
1178 select CRYPTO_ABLK_HELPER
1179 select CRYPTO_GLUE_HELPER_X86
1180 select CRYPTO_SERPENT
1181 select CRYPTO_SERPENT_AVX_X86_64
1182 select CRYPTO_LRW
1183 select CRYPTO_XTS
1184 help
1185 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1186
1187 Keys are allowed to be from 0 to 256 bits in length, in steps
1188 of 8 bits.
1189
1190 This module provides Serpent cipher algorithm that processes 16
1191 blocks parallel using AVX2 instruction set.
1192
1193 See also:
1194 <http://www.cl.cam.ac.uk/~rja14/serpent.html>
1195
1196config CRYPTO_TEA
1197 tristate "TEA, XTEA and XETA cipher algorithms"
1198 select CRYPTO_ALGAPI
1199 help
1200 TEA cipher algorithm.
1201
1202 Tiny Encryption Algorithm is a simple cipher that uses
1203 many rounds for security. It is very fast and uses
1204 little memory.
1205
1206 Xtendend Tiny Encryption Algorithm is a modification to
1207 the TEA algorithm to address a potential key weakness
1208 in the TEA algorithm.
1209
1210 Xtendend Encryption Tiny Algorithm is a mis-implementation
1211 of the XTEA algorithm for compatibility purposes.
1212
1213config CRYPTO_TWOFISH
1214 tristate "Twofish cipher algorithm"
1215 select CRYPTO_ALGAPI
1216 select CRYPTO_TWOFISH_COMMON
1217 help
1218 Twofish cipher algorithm.
1219
1220 Twofish was submitted as an AES (Advanced Encryption Standard)
1221 candidate cipher by researchers at CounterPane Systems. It is a
1222 16 round block cipher supporting key sizes of 128, 192, and 256
1223 bits.
1224
1225 See also:
1226 <http://www.schneier.com/twofish.html>
1227
1228config CRYPTO_TWOFISH_COMMON
1229 tristate
1230 help
1231 Common parts of the Twofish cipher algorithm shared by the
1232 generic c and the assembler implementations.
1233
1234config CRYPTO_TWOFISH_586
1235 tristate "Twofish cipher algorithms (i586)"
1236 depends on (X86 || UML_X86) && !64BIT
1237 select CRYPTO_ALGAPI
1238 select CRYPTO_TWOFISH_COMMON
1239 help
1240 Twofish cipher algorithm.
1241
1242 Twofish was submitted as an AES (Advanced Encryption Standard)
1243 candidate cipher by researchers at CounterPane Systems. It is a
1244 16 round block cipher supporting key sizes of 128, 192, and 256
1245 bits.
1246
1247 See also:
1248 <http://www.schneier.com/twofish.html>
1249
1250config CRYPTO_TWOFISH_X86_64
1251 tristate "Twofish cipher algorithm (x86_64)"
1252 depends on (X86 || UML_X86) && 64BIT
1253 select CRYPTO_ALGAPI
1254 select CRYPTO_TWOFISH_COMMON
1255 help
1256 Twofish cipher algorithm (x86_64).
1257
1258 Twofish was submitted as an AES (Advanced Encryption Standard)
1259 candidate cipher by researchers at CounterPane Systems. It is a
1260 16 round block cipher supporting key sizes of 128, 192, and 256
1261 bits.
1262
1263 See also:
1264 <http://www.schneier.com/twofish.html>
1265
1266config CRYPTO_TWOFISH_X86_64_3WAY
1267 tristate "Twofish cipher algorithm (x86_64, 3-way parallel)"
1268 depends on X86 && 64BIT
1269 select CRYPTO_ALGAPI
1270 select CRYPTO_TWOFISH_COMMON
1271 select CRYPTO_TWOFISH_X86_64
1272 select CRYPTO_GLUE_HELPER_X86
1273 select CRYPTO_LRW
1274 select CRYPTO_XTS
1275 help
1276 Twofish cipher algorithm (x86_64, 3-way parallel).
1277
1278 Twofish was submitted as an AES (Advanced Encryption Standard)
1279 candidate cipher by researchers at CounterPane Systems. It is a
1280 16 round block cipher supporting key sizes of 128, 192, and 256
1281 bits.
1282
1283 This module provides Twofish cipher algorithm that processes three
1284 blocks parallel, utilizing resources of out-of-order CPUs better.
1285
1286 See also:
1287 <http://www.schneier.com/twofish.html>
1288
1289config CRYPTO_TWOFISH_AVX_X86_64
1290 tristate "Twofish cipher algorithm (x86_64/AVX)"
1291 depends on X86 && 64BIT
1292 select CRYPTO_ALGAPI
1293 select CRYPTO_CRYPTD
1294 select CRYPTO_ABLK_HELPER
1295 select CRYPTO_GLUE_HELPER_X86
1296 select CRYPTO_TWOFISH_COMMON
1297 select CRYPTO_TWOFISH_X86_64
1298 select CRYPTO_TWOFISH_X86_64_3WAY
1299 select CRYPTO_LRW
1300 select CRYPTO_XTS
1301 help
1302 Twofish cipher algorithm (x86_64/AVX).
1303
1304 Twofish was submitted as an AES (Advanced Encryption Standard)
1305 candidate cipher by researchers at CounterPane Systems. It is a
1306 16 round block cipher supporting key sizes of 128, 192, and 256
1307 bits.
1308
1309 This module provides the Twofish cipher algorithm that processes
1310 eight blocks parallel using the AVX Instruction Set.
1311
1312 See also:
1313 <http://www.schneier.com/twofish.html>
1314
1315comment "Compression"
1316
1317config CRYPTO_DEFLATE
1318 tristate "Deflate compression algorithm"
1319 select CRYPTO_ALGAPI
1320 select ZLIB_INFLATE
1321 select ZLIB_DEFLATE
1322 help
1323 This is the Deflate algorithm (RFC1951), specified for use in
1324 IPSec with the IPCOMP protocol (RFC3173, RFC2394).
1325
1326 You will most probably want this if using IPSec.
1327
1328config CRYPTO_ZLIB
1329 tristate "Zlib compression algorithm"
1330 select CRYPTO_PCOMP
1331 select ZLIB_INFLATE
1332 select ZLIB_DEFLATE
1333 select NLATTR
1334 help
1335 This is the zlib algorithm.
1336
1337config CRYPTO_LZO
1338 tristate "LZO compression algorithm"
1339 select CRYPTO_ALGAPI
1340 select LZO_COMPRESS
1341 select LZO_DECOMPRESS
1342 help
1343 This is the LZO algorithm.
1344
1345config CRYPTO_842
1346 tristate "842 compression algorithm"
1347 depends on CRYPTO_DEV_NX_COMPRESS
1348 # 842 uses lzo if the hardware becomes unavailable
1349 select LZO_COMPRESS
1350 select LZO_DECOMPRESS
1351 help
1352 This is the 842 algorithm.
1353
1354config CRYPTO_LZ4
1355 tristate "LZ4 compression algorithm"
1356 select CRYPTO_ALGAPI
1357 select LZ4_COMPRESS
1358 select LZ4_DECOMPRESS
1359 help
1360 This is the LZ4 algorithm.
1361
1362config CRYPTO_LZ4HC
1363 tristate "LZ4HC compression algorithm"
1364 select CRYPTO_ALGAPI
1365 select LZ4HC_COMPRESS
1366 select LZ4_DECOMPRESS
1367 help
1368 This is the LZ4 high compression mode algorithm.
1369
1370comment "Random Number Generation"
1371
1372config CRYPTO_ANSI_CPRNG
1373 tristate "Pseudo Random Number Generation for Cryptographic modules"
1374 default m
1375 select CRYPTO_AES
1376 select CRYPTO_RNG
1377 help
1378 This option enables the generic pseudo random number generator
1379 for cryptographic modules. Uses the Algorithm specified in
1380 ANSI X9.31 A.2.4. Note that this option must be enabled if
1381 CRYPTO_FIPS is selected
1382
1383config CRYPTO_USER_API
1384 tristate
1385
1386config CRYPTO_USER_API_HASH
1387 tristate "User-space interface for hash algorithms"
1388 depends on NET
1389 select CRYPTO_HASH
1390 select CRYPTO_USER_API
1391 help
1392 This option enables the user-spaces interface for hash
1393 algorithms.
1394
1395config CRYPTO_USER_API_SKCIPHER
1396 tristate "User-space interface for symmetric key cipher algorithms"
1397 depends on NET
1398 select CRYPTO_BLKCIPHER
1399 select CRYPTO_USER_API
1400 help
1401 This option enables the user-spaces interface for symmetric
1402 key cipher algorithms.
1403
1404config CRYPTO_HASH_INFO
1405 bool
1406
1407source "drivers/crypto/Kconfig"
1408source crypto/asymmetric_keys/Kconfig
1409
1410endif # if CRYPTO
1# SPDX-License-Identifier: GPL-2.0
2#
3# Generic algorithms support
4#
5config XOR_BLOCKS
6 tristate
7
8#
9# async_tx api: hardware offloaded memory transfer/transform support
10#
11source "crypto/async_tx/Kconfig"
12
13#
14# Cryptographic API Configuration
15#
16menuconfig CRYPTO
17 tristate "Cryptographic API"
18 select CRYPTO_LIB_UTILS
19 help
20 This option provides the core Cryptographic API.
21
22if CRYPTO
23
24menu "Crypto core or helper"
25
26config CRYPTO_FIPS
27 bool "FIPS 200 compliance"
28 depends on (CRYPTO_ANSI_CPRNG || CRYPTO_DRBG) && !CRYPTO_MANAGER_DISABLE_TESTS
29 depends on (MODULE_SIG || !MODULES)
30 help
31 This option enables the fips boot option which is
32 required if you want the system to operate in a FIPS 200
33 certification. You should say no unless you know what
34 this is.
35
36config CRYPTO_FIPS_NAME
37 string "FIPS Module Name"
38 default "Linux Kernel Cryptographic API"
39 depends on CRYPTO_FIPS
40 help
41 This option sets the FIPS Module name reported by the Crypto API via
42 the /proc/sys/crypto/fips_name file.
43
44config CRYPTO_FIPS_CUSTOM_VERSION
45 bool "Use Custom FIPS Module Version"
46 depends on CRYPTO_FIPS
47 default n
48
49config CRYPTO_FIPS_VERSION
50 string "FIPS Module Version"
51 default "(none)"
52 depends on CRYPTO_FIPS_CUSTOM_VERSION
53 help
54 This option provides the ability to override the FIPS Module Version.
55 By default the KERNELRELEASE value is used.
56
57config CRYPTO_ALGAPI
58 tristate
59 select CRYPTO_ALGAPI2
60 help
61 This option provides the API for cryptographic algorithms.
62
63config CRYPTO_ALGAPI2
64 tristate
65
66config CRYPTO_AEAD
67 tristate
68 select CRYPTO_AEAD2
69 select CRYPTO_ALGAPI
70
71config CRYPTO_AEAD2
72 tristate
73 select CRYPTO_ALGAPI2
74
75config CRYPTO_SIG
76 tristate
77 select CRYPTO_SIG2
78 select CRYPTO_ALGAPI
79
80config CRYPTO_SIG2
81 tristate
82 select CRYPTO_ALGAPI2
83
84config CRYPTO_SKCIPHER
85 tristate
86 select CRYPTO_SKCIPHER2
87 select CRYPTO_ALGAPI
88 select CRYPTO_ECB
89
90config CRYPTO_SKCIPHER2
91 tristate
92 select CRYPTO_ALGAPI2
93
94config CRYPTO_HASH
95 tristate
96 select CRYPTO_HASH2
97 select CRYPTO_ALGAPI
98
99config CRYPTO_HASH2
100 tristate
101 select CRYPTO_ALGAPI2
102
103config CRYPTO_RNG
104 tristate
105 select CRYPTO_RNG2
106 select CRYPTO_ALGAPI
107
108config CRYPTO_RNG2
109 tristate
110 select CRYPTO_ALGAPI2
111
112config CRYPTO_RNG_DEFAULT
113 tristate
114 select CRYPTO_DRBG_MENU
115
116config CRYPTO_AKCIPHER2
117 tristate
118 select CRYPTO_ALGAPI2
119
120config CRYPTO_AKCIPHER
121 tristate
122 select CRYPTO_AKCIPHER2
123 select CRYPTO_ALGAPI
124
125config CRYPTO_KPP2
126 tristate
127 select CRYPTO_ALGAPI2
128
129config CRYPTO_KPP
130 tristate
131 select CRYPTO_ALGAPI
132 select CRYPTO_KPP2
133
134config CRYPTO_ACOMP2
135 tristate
136 select CRYPTO_ALGAPI2
137 select SGL_ALLOC
138
139config CRYPTO_ACOMP
140 tristate
141 select CRYPTO_ALGAPI
142 select CRYPTO_ACOMP2
143
144config CRYPTO_MANAGER
145 tristate "Cryptographic algorithm manager"
146 select CRYPTO_MANAGER2
147 help
148 Create default cryptographic template instantiations such as
149 cbc(aes).
150
151config CRYPTO_MANAGER2
152 def_tristate CRYPTO_MANAGER || (CRYPTO_MANAGER!=n && CRYPTO_ALGAPI=y)
153 select CRYPTO_ACOMP2
154 select CRYPTO_AEAD2
155 select CRYPTO_AKCIPHER2
156 select CRYPTO_SIG2
157 select CRYPTO_HASH2
158 select CRYPTO_KPP2
159 select CRYPTO_RNG2
160 select CRYPTO_SKCIPHER2
161
162config CRYPTO_USER
163 tristate "Userspace cryptographic algorithm configuration"
164 depends on NET
165 select CRYPTO_MANAGER
166 help
167 Userspace configuration for cryptographic instantiations such as
168 cbc(aes).
169
170config CRYPTO_MANAGER_DISABLE_TESTS
171 bool "Disable run-time self tests"
172 default y
173 help
174 Disable run-time self tests that normally take place at
175 algorithm registration.
176
177config CRYPTO_MANAGER_EXTRA_TESTS
178 bool "Enable extra run-time crypto self tests"
179 depends on DEBUG_KERNEL && !CRYPTO_MANAGER_DISABLE_TESTS && CRYPTO_MANAGER
180 help
181 Enable extra run-time self tests of registered crypto algorithms,
182 including randomized fuzz tests.
183
184 This is intended for developer use only, as these tests take much
185 longer to run than the normal self tests.
186
187config CRYPTO_NULL
188 tristate "Null algorithms"
189 select CRYPTO_NULL2
190 help
191 These are 'Null' algorithms, used by IPsec, which do nothing.
192
193config CRYPTO_NULL2
194 tristate
195 select CRYPTO_ALGAPI2
196 select CRYPTO_SKCIPHER2
197 select CRYPTO_HASH2
198
199config CRYPTO_PCRYPT
200 tristate "Parallel crypto engine"
201 depends on SMP
202 select PADATA
203 select CRYPTO_MANAGER
204 select CRYPTO_AEAD
205 help
206 This converts an arbitrary crypto algorithm into a parallel
207 algorithm that executes in kernel threads.
208
209config CRYPTO_CRYPTD
210 tristate "Software async crypto daemon"
211 select CRYPTO_SKCIPHER
212 select CRYPTO_HASH
213 select CRYPTO_MANAGER
214 help
215 This is a generic software asynchronous crypto daemon that
216 converts an arbitrary synchronous software crypto algorithm
217 into an asynchronous algorithm that executes in a kernel thread.
218
219config CRYPTO_AUTHENC
220 tristate "Authenc support"
221 select CRYPTO_AEAD
222 select CRYPTO_SKCIPHER
223 select CRYPTO_MANAGER
224 select CRYPTO_HASH
225 select CRYPTO_NULL
226 help
227 Authenc: Combined mode wrapper for IPsec.
228
229 This is required for IPSec ESP (XFRM_ESP).
230
231config CRYPTO_TEST
232 tristate "Testing module"
233 depends on m || EXPERT
234 select CRYPTO_MANAGER
235 help
236 Quick & dirty crypto test module.
237
238config CRYPTO_SIMD
239 tristate
240 select CRYPTO_CRYPTD
241
242config CRYPTO_ENGINE
243 tristate
244
245endmenu
246
247menu "Public-key cryptography"
248
249config CRYPTO_RSA
250 tristate "RSA (Rivest-Shamir-Adleman)"
251 select CRYPTO_AKCIPHER
252 select CRYPTO_MANAGER
253 select CRYPTO_SIG
254 select MPILIB
255 select ASN1
256 help
257 RSA (Rivest-Shamir-Adleman) public key algorithm (RFC8017)
258
259config CRYPTO_DH
260 tristate "DH (Diffie-Hellman)"
261 select CRYPTO_KPP
262 select MPILIB
263 help
264 DH (Diffie-Hellman) key exchange algorithm
265
266config CRYPTO_DH_RFC7919_GROUPS
267 bool "RFC 7919 FFDHE groups"
268 depends on CRYPTO_DH
269 select CRYPTO_RNG_DEFAULT
270 help
271 FFDHE (Finite-Field-based Diffie-Hellman Ephemeral) groups
272 defined in RFC7919.
273
274 Support these finite-field groups in DH key exchanges:
275 - ffdhe2048, ffdhe3072, ffdhe4096, ffdhe6144, ffdhe8192
276
277 If unsure, say N.
278
279config CRYPTO_ECC
280 tristate
281 select CRYPTO_RNG_DEFAULT
282
283config CRYPTO_ECDH
284 tristate "ECDH (Elliptic Curve Diffie-Hellman)"
285 select CRYPTO_ECC
286 select CRYPTO_KPP
287 help
288 ECDH (Elliptic Curve Diffie-Hellman) key exchange algorithm
289 using curves P-192, P-256, and P-384 (FIPS 186)
290
291config CRYPTO_ECDSA
292 tristate "ECDSA (Elliptic Curve Digital Signature Algorithm)"
293 select CRYPTO_ECC
294 select CRYPTO_SIG
295 select ASN1
296 help
297 ECDSA (Elliptic Curve Digital Signature Algorithm) (FIPS 186,
298 ISO/IEC 14888-3)
299 using curves P-192, P-256, P-384 and P-521
300
301 Only signature verification is implemented.
302
303config CRYPTO_ECRDSA
304 tristate "EC-RDSA (Elliptic Curve Russian Digital Signature Algorithm)"
305 select CRYPTO_ECC
306 select CRYPTO_SIG
307 select CRYPTO_STREEBOG
308 select OID_REGISTRY
309 select ASN1
310 help
311 Elliptic Curve Russian Digital Signature Algorithm (GOST R 34.10-2012,
312 RFC 7091, ISO/IEC 14888-3)
313
314 One of the Russian cryptographic standard algorithms (called GOST
315 algorithms). Only signature verification is implemented.
316
317config CRYPTO_CURVE25519
318 tristate "Curve25519"
319 select CRYPTO_KPP
320 select CRYPTO_LIB_CURVE25519_GENERIC
321 help
322 Curve25519 elliptic curve (RFC7748)
323
324endmenu
325
326menu "Block ciphers"
327
328config CRYPTO_AES
329 tristate "AES (Advanced Encryption Standard)"
330 select CRYPTO_ALGAPI
331 select CRYPTO_LIB_AES
332 help
333 AES cipher algorithms (Rijndael)(FIPS-197, ISO/IEC 18033-3)
334
335 Rijndael appears to be consistently a very good performer in
336 both hardware and software across a wide range of computing
337 environments regardless of its use in feedback or non-feedback
338 modes. Its key setup time is excellent, and its key agility is
339 good. Rijndael's very low memory requirements make it very well
340 suited for restricted-space environments, in which it also
341 demonstrates excellent performance. Rijndael's operations are
342 among the easiest to defend against power and timing attacks.
343
344 The AES specifies three key sizes: 128, 192 and 256 bits
345
346config CRYPTO_AES_TI
347 tristate "AES (Advanced Encryption Standard) (fixed time)"
348 select CRYPTO_ALGAPI
349 select CRYPTO_LIB_AES
350 help
351 AES cipher algorithms (Rijndael)(FIPS-197, ISO/IEC 18033-3)
352
353 This is a generic implementation of AES that attempts to eliminate
354 data dependent latencies as much as possible without affecting
355 performance too much. It is intended for use by the generic CCM
356 and GCM drivers, and other CTR or CMAC/XCBC based modes that rely
357 solely on encryption (although decryption is supported as well, but
358 with a more dramatic performance hit)
359
360 Instead of using 16 lookup tables of 1 KB each, (8 for encryption and
361 8 for decryption), this implementation only uses just two S-boxes of
362 256 bytes each, and attempts to eliminate data dependent latencies by
363 prefetching the entire table into the cache at the start of each
364 block. Interrupts are also disabled to avoid races where cachelines
365 are evicted when the CPU is interrupted to do something else.
366
367config CRYPTO_ANUBIS
368 tristate "Anubis"
369 depends on CRYPTO_USER_API_ENABLE_OBSOLETE
370 select CRYPTO_ALGAPI
371 help
372 Anubis cipher algorithm
373
374 Anubis is a variable key length cipher which can use keys from
375 128 bits to 320 bits in length. It was evaluated as a entrant
376 in the NESSIE competition.
377
378 See https://web.archive.org/web/20160606112246/http://www.larc.usp.br/~pbarreto/AnubisPage.html
379 for further information.
380
381config CRYPTO_ARIA
382 tristate "ARIA"
383 select CRYPTO_ALGAPI
384 help
385 ARIA cipher algorithm (RFC5794)
386
387 ARIA is a standard encryption algorithm of the Republic of Korea.
388 The ARIA specifies three key sizes and rounds.
389 128-bit: 12 rounds.
390 192-bit: 14 rounds.
391 256-bit: 16 rounds.
392
393 See:
394 https://seed.kisa.or.kr/kisa/algorithm/EgovAriaInfo.do
395
396config CRYPTO_BLOWFISH
397 tristate "Blowfish"
398 select CRYPTO_ALGAPI
399 select CRYPTO_BLOWFISH_COMMON
400 help
401 Blowfish cipher algorithm, by Bruce Schneier
402
403 This is a variable key length cipher which can use keys from 32
404 bits to 448 bits in length. It's fast, simple and specifically
405 designed for use on "large microprocessors".
406
407 See https://www.schneier.com/blowfish.html for further information.
408
409config CRYPTO_BLOWFISH_COMMON
410 tristate
411 help
412 Common parts of the Blowfish cipher algorithm shared by the
413 generic c and the assembler implementations.
414
415config CRYPTO_CAMELLIA
416 tristate "Camellia"
417 select CRYPTO_ALGAPI
418 help
419 Camellia cipher algorithms (ISO/IEC 18033-3)
420
421 Camellia is a symmetric key block cipher developed jointly
422 at NTT and Mitsubishi Electric Corporation.
423
424 The Camellia specifies three key sizes: 128, 192 and 256 bits.
425
426 See https://info.isl.ntt.co.jp/crypt/eng/camellia/ for further information.
427
428config CRYPTO_CAST_COMMON
429 tristate
430 help
431 Common parts of the CAST cipher algorithms shared by the
432 generic c and the assembler implementations.
433
434config CRYPTO_CAST5
435 tristate "CAST5 (CAST-128)"
436 select CRYPTO_ALGAPI
437 select CRYPTO_CAST_COMMON
438 help
439 CAST5 (CAST-128) cipher algorithm (RFC2144, ISO/IEC 18033-3)
440
441config CRYPTO_CAST6
442 tristate "CAST6 (CAST-256)"
443 select CRYPTO_ALGAPI
444 select CRYPTO_CAST_COMMON
445 help
446 CAST6 (CAST-256) encryption algorithm (RFC2612)
447
448config CRYPTO_DES
449 tristate "DES and Triple DES EDE"
450 select CRYPTO_ALGAPI
451 select CRYPTO_LIB_DES
452 help
453 DES (Data Encryption Standard)(FIPS 46-2, ISO/IEC 18033-3) and
454 Triple DES EDE (Encrypt/Decrypt/Encrypt) (FIPS 46-3, ISO/IEC 18033-3)
455 cipher algorithms
456
457config CRYPTO_FCRYPT
458 tristate "FCrypt"
459 select CRYPTO_ALGAPI
460 select CRYPTO_SKCIPHER
461 help
462 FCrypt algorithm used by RxRPC
463
464 See https://ota.polyonymo.us/fcrypt-paper.txt
465
466config CRYPTO_KHAZAD
467 tristate "Khazad"
468 depends on CRYPTO_USER_API_ENABLE_OBSOLETE
469 select CRYPTO_ALGAPI
470 help
471 Khazad cipher algorithm
472
473 Khazad was a finalist in the initial NESSIE competition. It is
474 an algorithm optimized for 64-bit processors with good performance
475 on 32-bit processors. Khazad uses an 128 bit key size.
476
477 See https://web.archive.org/web/20171011071731/http://www.larc.usp.br/~pbarreto/KhazadPage.html
478 for further information.
479
480config CRYPTO_SEED
481 tristate "SEED"
482 depends on CRYPTO_USER_API_ENABLE_OBSOLETE
483 select CRYPTO_ALGAPI
484 help
485 SEED cipher algorithm (RFC4269, ISO/IEC 18033-3)
486
487 SEED is a 128-bit symmetric key block cipher that has been
488 developed by KISA (Korea Information Security Agency) as a
489 national standard encryption algorithm of the Republic of Korea.
490 It is a 16 round block cipher with the key size of 128 bit.
491
492 See https://seed.kisa.or.kr/kisa/algorithm/EgovSeedInfo.do
493 for further information.
494
495config CRYPTO_SERPENT
496 tristate "Serpent"
497 select CRYPTO_ALGAPI
498 help
499 Serpent cipher algorithm, by Anderson, Biham & Knudsen
500
501 Keys are allowed to be from 0 to 256 bits in length, in steps
502 of 8 bits.
503
504 See https://www.cl.cam.ac.uk/~rja14/serpent.html for further information.
505
506config CRYPTO_SM4
507 tristate
508
509config CRYPTO_SM4_GENERIC
510 tristate "SM4 (ShangMi 4)"
511 select CRYPTO_ALGAPI
512 select CRYPTO_SM4
513 help
514 SM4 cipher algorithms (OSCCA GB/T 32907-2016,
515 ISO/IEC 18033-3:2010/Amd 1:2021)
516
517 SM4 (GBT.32907-2016) is a cryptographic standard issued by the
518 Organization of State Commercial Administration of China (OSCCA)
519 as an authorized cryptographic algorithms for the use within China.
520
521 SMS4 was originally created for use in protecting wireless
522 networks, and is mandated in the Chinese National Standard for
523 Wireless LAN WAPI (Wired Authentication and Privacy Infrastructure)
524 (GB.15629.11-2003).
525
526 The latest SM4 standard (GBT.32907-2016) was proposed by OSCCA and
527 standardized through TC 260 of the Standardization Administration
528 of the People's Republic of China (SAC).
529
530 The input, output, and key of SMS4 are each 128 bits.
531
532 See https://eprint.iacr.org/2008/329.pdf for further information.
533
534 If unsure, say N.
535
536config CRYPTO_TEA
537 tristate "TEA, XTEA and XETA"
538 depends on CRYPTO_USER_API_ENABLE_OBSOLETE
539 select CRYPTO_ALGAPI
540 help
541 TEA (Tiny Encryption Algorithm) cipher algorithms
542
543 Tiny Encryption Algorithm is a simple cipher that uses
544 many rounds for security. It is very fast and uses
545 little memory.
546
547 Xtendend Tiny Encryption Algorithm is a modification to
548 the TEA algorithm to address a potential key weakness
549 in the TEA algorithm.
550
551 Xtendend Encryption Tiny Algorithm is a mis-implementation
552 of the XTEA algorithm for compatibility purposes.
553
554config CRYPTO_TWOFISH
555 tristate "Twofish"
556 select CRYPTO_ALGAPI
557 select CRYPTO_TWOFISH_COMMON
558 help
559 Twofish cipher algorithm
560
561 Twofish was submitted as an AES (Advanced Encryption Standard)
562 candidate cipher by researchers at CounterPane Systems. It is a
563 16 round block cipher supporting key sizes of 128, 192, and 256
564 bits.
565
566 See https://www.schneier.com/twofish.html for further information.
567
568config CRYPTO_TWOFISH_COMMON
569 tristate
570 help
571 Common parts of the Twofish cipher algorithm shared by the
572 generic c and the assembler implementations.
573
574endmenu
575
576menu "Length-preserving ciphers and modes"
577
578config CRYPTO_ADIANTUM
579 tristate "Adiantum"
580 select CRYPTO_CHACHA20
581 select CRYPTO_LIB_POLY1305_GENERIC
582 select CRYPTO_NHPOLY1305
583 select CRYPTO_MANAGER
584 help
585 Adiantum tweakable, length-preserving encryption mode
586
587 Designed for fast and secure disk encryption, especially on
588 CPUs without dedicated crypto instructions. It encrypts
589 each sector using the XChaCha12 stream cipher, two passes of
590 an ε-almost-∆-universal hash function, and an invocation of
591 the AES-256 block cipher on a single 16-byte block. On CPUs
592 without AES instructions, Adiantum is much faster than
593 AES-XTS.
594
595 Adiantum's security is provably reducible to that of its
596 underlying stream and block ciphers, subject to a security
597 bound. Unlike XTS, Adiantum is a true wide-block encryption
598 mode, so it actually provides an even stronger notion of
599 security than XTS, subject to the security bound.
600
601 If unsure, say N.
602
603config CRYPTO_ARC4
604 tristate "ARC4 (Alleged Rivest Cipher 4)"
605 depends on CRYPTO_USER_API_ENABLE_OBSOLETE
606 select CRYPTO_SKCIPHER
607 select CRYPTO_LIB_ARC4
608 help
609 ARC4 cipher algorithm
610
611 ARC4 is a stream cipher using keys ranging from 8 bits to 2048
612 bits in length. This algorithm is required for driver-based
613 WEP, but it should not be for other purposes because of the
614 weakness of the algorithm.
615
616config CRYPTO_CHACHA20
617 tristate "ChaCha"
618 select CRYPTO_LIB_CHACHA_GENERIC
619 select CRYPTO_SKCIPHER
620 help
621 The ChaCha20, XChaCha20, and XChaCha12 stream cipher algorithms
622
623 ChaCha20 is a 256-bit high-speed stream cipher designed by Daniel J.
624 Bernstein and further specified in RFC7539 for use in IETF protocols.
625 This is the portable C implementation of ChaCha20. See
626 https://cr.yp.to/chacha/chacha-20080128.pdf for further information.
627
628 XChaCha20 is the application of the XSalsa20 construction to ChaCha20
629 rather than to Salsa20. XChaCha20 extends ChaCha20's nonce length
630 from 64 bits (or 96 bits using the RFC7539 convention) to 192 bits,
631 while provably retaining ChaCha20's security. See
632 https://cr.yp.to/snuffle/xsalsa-20081128.pdf for further information.
633
634 XChaCha12 is XChaCha20 reduced to 12 rounds, with correspondingly
635 reduced security margin but increased performance. It can be needed
636 in some performance-sensitive scenarios.
637
638config CRYPTO_CBC
639 tristate "CBC (Cipher Block Chaining)"
640 select CRYPTO_SKCIPHER
641 select CRYPTO_MANAGER
642 help
643 CBC (Cipher Block Chaining) mode (NIST SP800-38A)
644
645 This block cipher mode is required for IPSec ESP (XFRM_ESP).
646
647config CRYPTO_CTR
648 tristate "CTR (Counter)"
649 select CRYPTO_SKCIPHER
650 select CRYPTO_MANAGER
651 help
652 CTR (Counter) mode (NIST SP800-38A)
653
654config CRYPTO_CTS
655 tristate "CTS (Cipher Text Stealing)"
656 select CRYPTO_SKCIPHER
657 select CRYPTO_MANAGER
658 help
659 CBC-CS3 variant of CTS (Cipher Text Stealing) (NIST
660 Addendum to SP800-38A (October 2010))
661
662 This mode is required for Kerberos gss mechanism support
663 for AES encryption.
664
665config CRYPTO_ECB
666 tristate "ECB (Electronic Codebook)"
667 select CRYPTO_SKCIPHER2
668 select CRYPTO_MANAGER
669 help
670 ECB (Electronic Codebook) mode (NIST SP800-38A)
671
672config CRYPTO_HCTR2
673 tristate "HCTR2"
674 select CRYPTO_XCTR
675 select CRYPTO_POLYVAL
676 select CRYPTO_MANAGER
677 help
678 HCTR2 length-preserving encryption mode
679
680 A mode for storage encryption that is efficient on processors with
681 instructions to accelerate AES and carryless multiplication, e.g.
682 x86 processors with AES-NI and CLMUL, and ARM processors with the
683 ARMv8 crypto extensions.
684
685 See https://eprint.iacr.org/2021/1441
686
687config CRYPTO_KEYWRAP
688 tristate "KW (AES Key Wrap)"
689 select CRYPTO_SKCIPHER
690 select CRYPTO_MANAGER
691 help
692 KW (AES Key Wrap) authenticated encryption mode (NIST SP800-38F
693 and RFC3394) without padding.
694
695config CRYPTO_LRW
696 tristate "LRW (Liskov Rivest Wagner)"
697 select CRYPTO_LIB_GF128MUL
698 select CRYPTO_SKCIPHER
699 select CRYPTO_MANAGER
700 select CRYPTO_ECB
701 help
702 LRW (Liskov Rivest Wagner) mode
703
704 A tweakable, non malleable, non movable
705 narrow block cipher mode for dm-crypt. Use it with cipher
706 specification string aes-lrw-benbi, the key must be 256, 320 or 384.
707 The first 128, 192 or 256 bits in the key are used for AES and the
708 rest is used to tie each cipher block to its logical position.
709
710 See https://people.csail.mit.edu/rivest/pubs/LRW02.pdf
711
712config CRYPTO_PCBC
713 tristate "PCBC (Propagating Cipher Block Chaining)"
714 select CRYPTO_SKCIPHER
715 select CRYPTO_MANAGER
716 help
717 PCBC (Propagating Cipher Block Chaining) mode
718
719 This block cipher mode is required for RxRPC.
720
721config CRYPTO_XCTR
722 tristate
723 select CRYPTO_SKCIPHER
724 select CRYPTO_MANAGER
725 help
726 XCTR (XOR Counter) mode for HCTR2
727
728 This blockcipher mode is a variant of CTR mode using XORs and little-endian
729 addition rather than big-endian arithmetic.
730
731 XCTR mode is used to implement HCTR2.
732
733config CRYPTO_XTS
734 tristate "XTS (XOR Encrypt XOR with ciphertext stealing)"
735 select CRYPTO_SKCIPHER
736 select CRYPTO_MANAGER
737 select CRYPTO_ECB
738 help
739 XTS (XOR Encrypt XOR with ciphertext stealing) mode (NIST SP800-38E
740 and IEEE 1619)
741
742 Use with aes-xts-plain, key size 256, 384 or 512 bits. This
743 implementation currently can't handle a sectorsize which is not a
744 multiple of 16 bytes.
745
746config CRYPTO_NHPOLY1305
747 tristate
748 select CRYPTO_HASH
749 select CRYPTO_LIB_POLY1305_GENERIC
750
751endmenu
752
753menu "AEAD (authenticated encryption with associated data) ciphers"
754
755config CRYPTO_AEGIS128
756 tristate "AEGIS-128"
757 select CRYPTO_AEAD
758 select CRYPTO_AES # for AES S-box tables
759 help
760 AEGIS-128 AEAD algorithm
761
762config CRYPTO_AEGIS128_SIMD
763 bool "AEGIS-128 (arm NEON, arm64 NEON)"
764 depends on CRYPTO_AEGIS128 && ((ARM || ARM64) && KERNEL_MODE_NEON)
765 default y
766 help
767 AEGIS-128 AEAD algorithm
768
769 Architecture: arm or arm64 using:
770 - NEON (Advanced SIMD) extension
771
772config CRYPTO_CHACHA20POLY1305
773 tristate "ChaCha20-Poly1305"
774 select CRYPTO_CHACHA20
775 select CRYPTO_POLY1305
776 select CRYPTO_AEAD
777 select CRYPTO_MANAGER
778 help
779 ChaCha20 stream cipher and Poly1305 authenticator combined
780 mode (RFC8439)
781
782config CRYPTO_CCM
783 tristate "CCM (Counter with Cipher Block Chaining-MAC)"
784 select CRYPTO_CTR
785 select CRYPTO_HASH
786 select CRYPTO_AEAD
787 select CRYPTO_MANAGER
788 help
789 CCM (Counter with Cipher Block Chaining-Message Authentication Code)
790 authenticated encryption mode (NIST SP800-38C)
791
792config CRYPTO_GCM
793 tristate "GCM (Galois/Counter Mode) and GMAC (GCM MAC)"
794 select CRYPTO_CTR
795 select CRYPTO_AEAD
796 select CRYPTO_GHASH
797 select CRYPTO_NULL
798 select CRYPTO_MANAGER
799 help
800 GCM (Galois/Counter Mode) authenticated encryption mode and GMAC
801 (GCM Message Authentication Code) (NIST SP800-38D)
802
803 This is required for IPSec ESP (XFRM_ESP).
804
805config CRYPTO_GENIV
806 tristate
807 select CRYPTO_AEAD
808 select CRYPTO_NULL
809 select CRYPTO_MANAGER
810 select CRYPTO_RNG_DEFAULT
811
812config CRYPTO_SEQIV
813 tristate "Sequence Number IV Generator"
814 select CRYPTO_GENIV
815 help
816 Sequence Number IV generator
817
818 This IV generator generates an IV based on a sequence number by
819 xoring it with a salt. This algorithm is mainly useful for CTR.
820
821 This is required for IPsec ESP (XFRM_ESP).
822
823config CRYPTO_ECHAINIV
824 tristate "Encrypted Chain IV Generator"
825 select CRYPTO_GENIV
826 help
827 Encrypted Chain IV generator
828
829 This IV generator generates an IV based on the encryption of
830 a sequence number xored with a salt. This is the default
831 algorithm for CBC.
832
833config CRYPTO_ESSIV
834 tristate "Encrypted Salt-Sector IV Generator"
835 select CRYPTO_AUTHENC
836 help
837 Encrypted Salt-Sector IV generator
838
839 This IV generator is used in some cases by fscrypt and/or
840 dm-crypt. It uses the hash of the block encryption key as the
841 symmetric key for a block encryption pass applied to the input
842 IV, making low entropy IV sources more suitable for block
843 encryption.
844
845 This driver implements a crypto API template that can be
846 instantiated either as an skcipher or as an AEAD (depending on the
847 type of the first template argument), and which defers encryption
848 and decryption requests to the encapsulated cipher after applying
849 ESSIV to the input IV. Note that in the AEAD case, it is assumed
850 that the keys are presented in the same format used by the authenc
851 template, and that the IV appears at the end of the authenticated
852 associated data (AAD) region (which is how dm-crypt uses it.)
853
854 Note that the use of ESSIV is not recommended for new deployments,
855 and so this only needs to be enabled when interoperability with
856 existing encrypted volumes of filesystems is required, or when
857 building for a particular system that requires it (e.g., when
858 the SoC in question has accelerated CBC but not XTS, making CBC
859 combined with ESSIV the only feasible mode for h/w accelerated
860 block encryption)
861
862endmenu
863
864menu "Hashes, digests, and MACs"
865
866config CRYPTO_BLAKE2B
867 tristate "BLAKE2b"
868 select CRYPTO_HASH
869 help
870 BLAKE2b cryptographic hash function (RFC 7693)
871
872 BLAKE2b is optimized for 64-bit platforms and can produce digests
873 of any size between 1 and 64 bytes. The keyed hash is also implemented.
874
875 This module provides the following algorithms:
876 - blake2b-160
877 - blake2b-256
878 - blake2b-384
879 - blake2b-512
880
881 Used by the btrfs filesystem.
882
883 See https://blake2.net for further information.
884
885config CRYPTO_CMAC
886 tristate "CMAC (Cipher-based MAC)"
887 select CRYPTO_HASH
888 select CRYPTO_MANAGER
889 help
890 CMAC (Cipher-based Message Authentication Code) authentication
891 mode (NIST SP800-38B and IETF RFC4493)
892
893config CRYPTO_GHASH
894 tristate "GHASH"
895 select CRYPTO_HASH
896 select CRYPTO_LIB_GF128MUL
897 help
898 GCM GHASH function (NIST SP800-38D)
899
900config CRYPTO_HMAC
901 tristate "HMAC (Keyed-Hash MAC)"
902 select CRYPTO_HASH
903 select CRYPTO_MANAGER
904 help
905 HMAC (Keyed-Hash Message Authentication Code) (FIPS 198 and
906 RFC2104)
907
908 This is required for IPsec AH (XFRM_AH) and IPsec ESP (XFRM_ESP).
909
910config CRYPTO_MD4
911 tristate "MD4"
912 select CRYPTO_HASH
913 help
914 MD4 message digest algorithm (RFC1320)
915
916config CRYPTO_MD5
917 tristate "MD5"
918 select CRYPTO_HASH
919 help
920 MD5 message digest algorithm (RFC1321)
921
922config CRYPTO_MICHAEL_MIC
923 tristate "Michael MIC"
924 select CRYPTO_HASH
925 help
926 Michael MIC (Message Integrity Code) (IEEE 802.11i)
927
928 Defined by the IEEE 802.11i TKIP (Temporal Key Integrity Protocol),
929 known as WPA (Wif-Fi Protected Access).
930
931 This algorithm is required for TKIP, but it should not be used for
932 other purposes because of the weakness of the algorithm.
933
934config CRYPTO_POLYVAL
935 tristate
936 select CRYPTO_HASH
937 select CRYPTO_LIB_GF128MUL
938 help
939 POLYVAL hash function for HCTR2
940
941 This is used in HCTR2. It is not a general-purpose
942 cryptographic hash function.
943
944config CRYPTO_POLY1305
945 tristate "Poly1305"
946 select CRYPTO_HASH
947 select CRYPTO_LIB_POLY1305_GENERIC
948 help
949 Poly1305 authenticator algorithm (RFC7539)
950
951 Poly1305 is an authenticator algorithm designed by Daniel J. Bernstein.
952 It is used for the ChaCha20-Poly1305 AEAD, specified in RFC7539 for use
953 in IETF protocols. This is the portable C implementation of Poly1305.
954
955config CRYPTO_RMD160
956 tristate "RIPEMD-160"
957 select CRYPTO_HASH
958 help
959 RIPEMD-160 hash function (ISO/IEC 10118-3)
960
961 RIPEMD-160 is a 160-bit cryptographic hash function. It is intended
962 to be used as a secure replacement for the 128-bit hash functions
963 MD4, MD5 and its predecessor RIPEMD
964 (not to be confused with RIPEMD-128).
965
966 Its speed is comparable to SHA-1 and there are no known attacks
967 against RIPEMD-160.
968
969 Developed by Hans Dobbertin, Antoon Bosselaers and Bart Preneel.
970 See https://homes.esat.kuleuven.be/~bosselae/ripemd160.html
971 for further information.
972
973config CRYPTO_SHA1
974 tristate "SHA-1"
975 select CRYPTO_HASH
976 select CRYPTO_LIB_SHA1
977 help
978 SHA-1 secure hash algorithm (FIPS 180, ISO/IEC 10118-3)
979
980config CRYPTO_SHA256
981 tristate "SHA-224 and SHA-256"
982 select CRYPTO_HASH
983 select CRYPTO_LIB_SHA256
984 help
985 SHA-224 and SHA-256 secure hash algorithms (FIPS 180, ISO/IEC 10118-3)
986
987 This is required for IPsec AH (XFRM_AH) and IPsec ESP (XFRM_ESP).
988 Used by the btrfs filesystem, Ceph, NFS, and SMB.
989
990config CRYPTO_SHA512
991 tristate "SHA-384 and SHA-512"
992 select CRYPTO_HASH
993 help
994 SHA-384 and SHA-512 secure hash algorithms (FIPS 180, ISO/IEC 10118-3)
995
996config CRYPTO_SHA3
997 tristate "SHA-3"
998 select CRYPTO_HASH
999 help
1000 SHA-3 secure hash algorithms (FIPS 202, ISO/IEC 10118-3)
1001
1002config CRYPTO_SM3
1003 tristate
1004
1005config CRYPTO_SM3_GENERIC
1006 tristate "SM3 (ShangMi 3)"
1007 select CRYPTO_HASH
1008 select CRYPTO_SM3
1009 help
1010 SM3 (ShangMi 3) secure hash function (OSCCA GM/T 0004-2012, ISO/IEC 10118-3)
1011
1012 This is part of the Chinese Commercial Cryptography suite.
1013
1014 References:
1015 http://www.oscca.gov.cn/UpFile/20101222141857786.pdf
1016 https://datatracker.ietf.org/doc/html/draft-shen-sm3-hash
1017
1018config CRYPTO_STREEBOG
1019 tristate "Streebog"
1020 select CRYPTO_HASH
1021 help
1022 Streebog Hash Function (GOST R 34.11-2012, RFC 6986, ISO/IEC 10118-3)
1023
1024 This is one of the Russian cryptographic standard algorithms (called
1025 GOST algorithms). This setting enables two hash algorithms with
1026 256 and 512 bits output.
1027
1028 References:
1029 https://tc26.ru/upload/iblock/fed/feddbb4d26b685903faa2ba11aea43f6.pdf
1030 https://tools.ietf.org/html/rfc6986
1031
1032config CRYPTO_VMAC
1033 tristate "VMAC"
1034 select CRYPTO_HASH
1035 select CRYPTO_MANAGER
1036 help
1037 VMAC is a message authentication algorithm designed for
1038 very high speed on 64-bit architectures.
1039
1040 See https://fastcrypto.org/vmac for further information.
1041
1042config CRYPTO_WP512
1043 tristate "Whirlpool"
1044 select CRYPTO_HASH
1045 help
1046 Whirlpool hash function (ISO/IEC 10118-3)
1047
1048 512, 384 and 256-bit hashes.
1049
1050 Whirlpool-512 is part of the NESSIE cryptographic primitives.
1051
1052 See https://web.archive.org/web/20171129084214/http://www.larc.usp.br/~pbarreto/WhirlpoolPage.html
1053 for further information.
1054
1055config CRYPTO_XCBC
1056 tristate "XCBC-MAC (Extended Cipher Block Chaining MAC)"
1057 select CRYPTO_HASH
1058 select CRYPTO_MANAGER
1059 help
1060 XCBC-MAC (Extended Cipher Block Chaining Message Authentication
1061 Code) (RFC3566)
1062
1063config CRYPTO_XXHASH
1064 tristate "xxHash"
1065 select CRYPTO_HASH
1066 select XXHASH
1067 help
1068 xxHash non-cryptographic hash algorithm
1069
1070 Extremely fast, working at speeds close to RAM limits.
1071
1072 Used by the btrfs filesystem.
1073
1074endmenu
1075
1076menu "CRCs (cyclic redundancy checks)"
1077
1078config CRYPTO_CRC32C
1079 tristate "CRC32c"
1080 select CRYPTO_HASH
1081 select CRC32
1082 help
1083 CRC32c CRC algorithm with the iSCSI polynomial (RFC 3385 and RFC 3720)
1084
1085 A 32-bit CRC (cyclic redundancy check) with a polynomial defined
1086 by G. Castagnoli, S. Braeuer and M. Herrman in "Optimization of Cyclic
1087 Redundancy-Check Codes with 24 and 32 Parity Bits", IEEE Transactions
1088 on Communications, Vol. 41, No. 6, June 1993, selected for use with
1089 iSCSI.
1090
1091 Used by btrfs, ext4, jbd2, NVMeoF/TCP, and iSCSI.
1092
1093config CRYPTO_CRC32
1094 tristate "CRC32"
1095 select CRYPTO_HASH
1096 select CRC32
1097 help
1098 CRC32 CRC algorithm (IEEE 802.3)
1099
1100 Used by RoCEv2 and f2fs.
1101
1102config CRYPTO_CRCT10DIF
1103 tristate "CRCT10DIF"
1104 select CRYPTO_HASH
1105 help
1106 CRC16 CRC algorithm used for the T10 (SCSI) Data Integrity Field (DIF)
1107
1108 CRC algorithm used by the SCSI Block Commands standard.
1109
1110config CRYPTO_CRC64_ROCKSOFT
1111 tristate "CRC64 based on Rocksoft Model algorithm"
1112 depends on CRC64
1113 select CRYPTO_HASH
1114 help
1115 CRC64 CRC algorithm based on the Rocksoft Model CRC Algorithm
1116
1117 Used by the NVMe implementation of T10 DIF (BLK_DEV_INTEGRITY)
1118
1119 See https://zlib.net/crc_v3.txt
1120
1121endmenu
1122
1123menu "Compression"
1124
1125config CRYPTO_DEFLATE
1126 tristate "Deflate"
1127 select CRYPTO_ALGAPI
1128 select CRYPTO_ACOMP2
1129 select ZLIB_INFLATE
1130 select ZLIB_DEFLATE
1131 help
1132 Deflate compression algorithm (RFC1951)
1133
1134 Used by IPSec with the IPCOMP protocol (RFC3173, RFC2394)
1135
1136config CRYPTO_LZO
1137 tristate "LZO"
1138 select CRYPTO_ALGAPI
1139 select CRYPTO_ACOMP2
1140 select LZO_COMPRESS
1141 select LZO_DECOMPRESS
1142 help
1143 LZO compression algorithm
1144
1145 See https://www.oberhumer.com/opensource/lzo/ for further information.
1146
1147config CRYPTO_842
1148 tristate "842"
1149 select CRYPTO_ALGAPI
1150 select CRYPTO_ACOMP2
1151 select 842_COMPRESS
1152 select 842_DECOMPRESS
1153 help
1154 842 compression algorithm by IBM
1155
1156 See https://github.com/plauth/lib842 for further information.
1157
1158config CRYPTO_LZ4
1159 tristate "LZ4"
1160 select CRYPTO_ALGAPI
1161 select CRYPTO_ACOMP2
1162 select LZ4_COMPRESS
1163 select LZ4_DECOMPRESS
1164 help
1165 LZ4 compression algorithm
1166
1167 See https://github.com/lz4/lz4 for further information.
1168
1169config CRYPTO_LZ4HC
1170 tristate "LZ4HC"
1171 select CRYPTO_ALGAPI
1172 select CRYPTO_ACOMP2
1173 select LZ4HC_COMPRESS
1174 select LZ4_DECOMPRESS
1175 help
1176 LZ4 high compression mode algorithm
1177
1178 See https://github.com/lz4/lz4 for further information.
1179
1180config CRYPTO_ZSTD
1181 tristate "Zstd"
1182 select CRYPTO_ALGAPI
1183 select CRYPTO_ACOMP2
1184 select ZSTD_COMPRESS
1185 select ZSTD_DECOMPRESS
1186 help
1187 zstd compression algorithm
1188
1189 See https://github.com/facebook/zstd for further information.
1190
1191endmenu
1192
1193menu "Random number generation"
1194
1195config CRYPTO_ANSI_CPRNG
1196 tristate "ANSI PRNG (Pseudo Random Number Generator)"
1197 select CRYPTO_AES
1198 select CRYPTO_RNG
1199 help
1200 Pseudo RNG (random number generator) (ANSI X9.31 Appendix A.2.4)
1201
1202 This uses the AES cipher algorithm.
1203
1204 Note that this option must be enabled if CRYPTO_FIPS is selected
1205
1206menuconfig CRYPTO_DRBG_MENU
1207 tristate "NIST SP800-90A DRBG (Deterministic Random Bit Generator)"
1208 help
1209 DRBG (Deterministic Random Bit Generator) (NIST SP800-90A)
1210
1211 In the following submenu, one or more of the DRBG types must be selected.
1212
1213if CRYPTO_DRBG_MENU
1214
1215config CRYPTO_DRBG_HMAC
1216 bool
1217 default y
1218 select CRYPTO_HMAC
1219 select CRYPTO_SHA512
1220
1221config CRYPTO_DRBG_HASH
1222 bool "Hash_DRBG"
1223 select CRYPTO_SHA256
1224 help
1225 Hash_DRBG variant as defined in NIST SP800-90A.
1226
1227 This uses the SHA-1, SHA-256, SHA-384, or SHA-512 hash algorithms.
1228
1229config CRYPTO_DRBG_CTR
1230 bool "CTR_DRBG"
1231 select CRYPTO_AES
1232 select CRYPTO_CTR
1233 help
1234 CTR_DRBG variant as defined in NIST SP800-90A.
1235
1236 This uses the AES cipher algorithm with the counter block mode.
1237
1238config CRYPTO_DRBG
1239 tristate
1240 default CRYPTO_DRBG_MENU
1241 select CRYPTO_RNG
1242 select CRYPTO_JITTERENTROPY
1243
1244endif # if CRYPTO_DRBG_MENU
1245
1246config CRYPTO_JITTERENTROPY
1247 tristate "CPU Jitter Non-Deterministic RNG (Random Number Generator)"
1248 select CRYPTO_RNG
1249 select CRYPTO_SHA3
1250 help
1251 CPU Jitter RNG (Random Number Generator) from the Jitterentropy library
1252
1253 A non-physical non-deterministic ("true") RNG (e.g., an entropy source
1254 compliant with NIST SP800-90B) intended to provide a seed to a
1255 deterministic RNG (e.g., per NIST SP800-90C).
1256 This RNG does not perform any cryptographic whitening of the generated
1257 random numbers.
1258
1259 See https://www.chronox.de/jent/
1260
1261if CRYPTO_JITTERENTROPY
1262if CRYPTO_FIPS && EXPERT
1263
1264choice
1265 prompt "CPU Jitter RNG Memory Size"
1266 default CRYPTO_JITTERENTROPY_MEMSIZE_2
1267 help
1268 The Jitter RNG measures the execution time of memory accesses.
1269 Multiple consecutive memory accesses are performed. If the memory
1270 size fits into a cache (e.g. L1), only the memory access timing
1271 to that cache is measured. The closer the cache is to the CPU
1272 the less variations are measured and thus the less entropy is
1273 obtained. Thus, if the memory size fits into the L1 cache, the
1274 obtained entropy is less than if the memory size fits within
1275 L1 + L2, which in turn is less if the memory fits into
1276 L1 + L2 + L3. Thus, by selecting a different memory size,
1277 the entropy rate produced by the Jitter RNG can be modified.
1278
1279 config CRYPTO_JITTERENTROPY_MEMSIZE_2
1280 bool "2048 Bytes (default)"
1281
1282 config CRYPTO_JITTERENTROPY_MEMSIZE_128
1283 bool "128 kBytes"
1284
1285 config CRYPTO_JITTERENTROPY_MEMSIZE_1024
1286 bool "1024 kBytes"
1287
1288 config CRYPTO_JITTERENTROPY_MEMSIZE_8192
1289 bool "8192 kBytes"
1290endchoice
1291
1292config CRYPTO_JITTERENTROPY_MEMORY_BLOCKS
1293 int
1294 default 64 if CRYPTO_JITTERENTROPY_MEMSIZE_2
1295 default 512 if CRYPTO_JITTERENTROPY_MEMSIZE_128
1296 default 1024 if CRYPTO_JITTERENTROPY_MEMSIZE_1024
1297 default 4096 if CRYPTO_JITTERENTROPY_MEMSIZE_8192
1298
1299config CRYPTO_JITTERENTROPY_MEMORY_BLOCKSIZE
1300 int
1301 default 32 if CRYPTO_JITTERENTROPY_MEMSIZE_2
1302 default 256 if CRYPTO_JITTERENTROPY_MEMSIZE_128
1303 default 1024 if CRYPTO_JITTERENTROPY_MEMSIZE_1024
1304 default 2048 if CRYPTO_JITTERENTROPY_MEMSIZE_8192
1305
1306config CRYPTO_JITTERENTROPY_OSR
1307 int "CPU Jitter RNG Oversampling Rate"
1308 range 1 15
1309 default 3
1310 help
1311 The Jitter RNG allows the specification of an oversampling rate (OSR).
1312 The Jitter RNG operation requires a fixed amount of timing
1313 measurements to produce one output block of random numbers. The
1314 OSR value is multiplied with the amount of timing measurements to
1315 generate one output block. Thus, the timing measurement is oversampled
1316 by the OSR factor. The oversampling allows the Jitter RNG to operate
1317 on hardware whose timers deliver limited amount of entropy (e.g.
1318 the timer is coarse) by setting the OSR to a higher value. The
1319 trade-off, however, is that the Jitter RNG now requires more time
1320 to generate random numbers.
1321
1322config CRYPTO_JITTERENTROPY_TESTINTERFACE
1323 bool "CPU Jitter RNG Test Interface"
1324 help
1325 The test interface allows a privileged process to capture
1326 the raw unconditioned high resolution time stamp noise that
1327 is collected by the Jitter RNG for statistical analysis. As
1328 this data is used at the same time to generate random bits,
1329 the Jitter RNG operates in an insecure mode as long as the
1330 recording is enabled. This interface therefore is only
1331 intended for testing purposes and is not suitable for
1332 production systems.
1333
1334 The raw noise data can be obtained using the jent_raw_hires
1335 debugfs file. Using the option
1336 jitterentropy_testing.boot_raw_hires_test=1 the raw noise of
1337 the first 1000 entropy events since boot can be sampled.
1338
1339 If unsure, select N.
1340
1341endif # if CRYPTO_FIPS && EXPERT
1342
1343if !(CRYPTO_FIPS && EXPERT)
1344
1345config CRYPTO_JITTERENTROPY_MEMORY_BLOCKS
1346 int
1347 default 64
1348
1349config CRYPTO_JITTERENTROPY_MEMORY_BLOCKSIZE
1350 int
1351 default 32
1352
1353config CRYPTO_JITTERENTROPY_OSR
1354 int
1355 default 1
1356
1357config CRYPTO_JITTERENTROPY_TESTINTERFACE
1358 bool
1359
1360endif # if !(CRYPTO_FIPS && EXPERT)
1361endif # if CRYPTO_JITTERENTROPY
1362
1363config CRYPTO_KDF800108_CTR
1364 tristate
1365 select CRYPTO_HMAC
1366 select CRYPTO_SHA256
1367
1368endmenu
1369menu "Userspace interface"
1370
1371config CRYPTO_USER_API
1372 tristate
1373
1374config CRYPTO_USER_API_HASH
1375 tristate "Hash algorithms"
1376 depends on NET
1377 select CRYPTO_HASH
1378 select CRYPTO_USER_API
1379 help
1380 Enable the userspace interface for hash algorithms.
1381
1382 See Documentation/crypto/userspace-if.rst and
1383 https://www.chronox.de/libkcapi/html/index.html
1384
1385config CRYPTO_USER_API_SKCIPHER
1386 tristate "Symmetric key cipher algorithms"
1387 depends on NET
1388 select CRYPTO_SKCIPHER
1389 select CRYPTO_USER_API
1390 help
1391 Enable the userspace interface for symmetric key cipher algorithms.
1392
1393 See Documentation/crypto/userspace-if.rst and
1394 https://www.chronox.de/libkcapi/html/index.html
1395
1396config CRYPTO_USER_API_RNG
1397 tristate "RNG (random number generator) algorithms"
1398 depends on NET
1399 select CRYPTO_RNG
1400 select CRYPTO_USER_API
1401 help
1402 Enable the userspace interface for RNG (random number generator)
1403 algorithms.
1404
1405 See Documentation/crypto/userspace-if.rst and
1406 https://www.chronox.de/libkcapi/html/index.html
1407
1408config CRYPTO_USER_API_RNG_CAVP
1409 bool "Enable CAVP testing of DRBG"
1410 depends on CRYPTO_USER_API_RNG && CRYPTO_DRBG
1411 help
1412 Enable extra APIs in the userspace interface for NIST CAVP
1413 (Cryptographic Algorithm Validation Program) testing:
1414 - resetting DRBG entropy
1415 - providing Additional Data
1416
1417 This should only be enabled for CAVP testing. You should say
1418 no unless you know what this is.
1419
1420config CRYPTO_USER_API_AEAD
1421 tristate "AEAD cipher algorithms"
1422 depends on NET
1423 select CRYPTO_AEAD
1424 select CRYPTO_SKCIPHER
1425 select CRYPTO_NULL
1426 select CRYPTO_USER_API
1427 help
1428 Enable the userspace interface for AEAD cipher algorithms.
1429
1430 See Documentation/crypto/userspace-if.rst and
1431 https://www.chronox.de/libkcapi/html/index.html
1432
1433config CRYPTO_USER_API_ENABLE_OBSOLETE
1434 bool "Obsolete cryptographic algorithms"
1435 depends on CRYPTO_USER_API
1436 default y
1437 help
1438 Allow obsolete cryptographic algorithms to be selected that have
1439 already been phased out from internal use by the kernel, and are
1440 only useful for userspace clients that still rely on them.
1441
1442endmenu
1443
1444config CRYPTO_HASH_INFO
1445 bool
1446
1447if !KMSAN # avoid false positives from assembly
1448if ARM
1449source "arch/arm/crypto/Kconfig"
1450endif
1451if ARM64
1452source "arch/arm64/crypto/Kconfig"
1453endif
1454if LOONGARCH
1455source "arch/loongarch/crypto/Kconfig"
1456endif
1457if MIPS
1458source "arch/mips/crypto/Kconfig"
1459endif
1460if PPC
1461source "arch/powerpc/crypto/Kconfig"
1462endif
1463if RISCV
1464source "arch/riscv/crypto/Kconfig"
1465endif
1466if S390
1467source "arch/s390/crypto/Kconfig"
1468endif
1469if SPARC
1470source "arch/sparc/crypto/Kconfig"
1471endif
1472if X86
1473source "arch/x86/crypto/Kconfig"
1474endif
1475endif
1476
1477source "drivers/crypto/Kconfig"
1478source "crypto/asymmetric_keys/Kconfig"
1479source "certs/Kconfig"
1480
1481endif # if CRYPTO