Loading...
1#
2# Generic algorithms support
3#
4config XOR_BLOCKS
5 tristate
6
7#
8# async_tx api: hardware offloaded memory transfer/transform support
9#
10source "crypto/async_tx/Kconfig"
11
12#
13# Cryptographic API Configuration
14#
15menuconfig CRYPTO
16 tristate "Cryptographic API"
17 help
18 This option provides the core Cryptographic API.
19
20if CRYPTO
21
22comment "Crypto core or helper"
23
24config CRYPTO_FIPS
25 bool "FIPS 200 compliance"
26 depends on CRYPTO_ANSI_CPRNG && !CRYPTO_MANAGER_DISABLE_TESTS
27 help
28 This options enables the fips boot option which is
29 required if you want to system to operate in a FIPS 200
30 certification. You should say no unless you know what
31 this is.
32
33config CRYPTO_ALGAPI
34 tristate
35 select CRYPTO_ALGAPI2
36 help
37 This option provides the API for cryptographic algorithms.
38
39config CRYPTO_ALGAPI2
40 tristate
41
42config CRYPTO_AEAD
43 tristate
44 select CRYPTO_AEAD2
45 select CRYPTO_ALGAPI
46
47config CRYPTO_AEAD2
48 tristate
49 select CRYPTO_ALGAPI2
50
51config CRYPTO_BLKCIPHER
52 tristate
53 select CRYPTO_BLKCIPHER2
54 select CRYPTO_ALGAPI
55
56config CRYPTO_BLKCIPHER2
57 tristate
58 select CRYPTO_ALGAPI2
59 select CRYPTO_RNG2
60 select CRYPTO_WORKQUEUE
61
62config CRYPTO_HASH
63 tristate
64 select CRYPTO_HASH2
65 select CRYPTO_ALGAPI
66
67config CRYPTO_HASH2
68 tristate
69 select CRYPTO_ALGAPI2
70
71config CRYPTO_RNG
72 tristate
73 select CRYPTO_RNG2
74 select CRYPTO_ALGAPI
75
76config CRYPTO_RNG2
77 tristate
78 select CRYPTO_ALGAPI2
79
80config CRYPTO_PCOMP
81 tristate
82 select CRYPTO_PCOMP2
83 select CRYPTO_ALGAPI
84
85config CRYPTO_PCOMP2
86 tristate
87 select CRYPTO_ALGAPI2
88
89config CRYPTO_MANAGER
90 tristate "Cryptographic algorithm manager"
91 select CRYPTO_MANAGER2
92 help
93 Create default cryptographic template instantiations such as
94 cbc(aes).
95
96config CRYPTO_MANAGER2
97 def_tristate CRYPTO_MANAGER || (CRYPTO_MANAGER!=n && CRYPTO_ALGAPI=y)
98 select CRYPTO_AEAD2
99 select CRYPTO_HASH2
100 select CRYPTO_BLKCIPHER2
101 select CRYPTO_PCOMP2
102
103config CRYPTO_USER
104 tristate "Userspace cryptographic algorithm configuration"
105 depends on NET
106 select CRYPTO_MANAGER
107 help
108 Userspace configuration for cryptographic instantiations such as
109 cbc(aes).
110
111config CRYPTO_MANAGER_DISABLE_TESTS
112 bool "Disable run-time self tests"
113 default y
114 depends on CRYPTO_MANAGER2
115 help
116 Disable run-time self tests that normally take place at
117 algorithm registration.
118
119config CRYPTO_GF128MUL
120 tristate "GF(2^128) multiplication functions"
121 help
122 Efficient table driven implementation of multiplications in the
123 field GF(2^128). This is needed by some cypher modes. This
124 option will be selected automatically if you select such a
125 cipher mode. Only select this option by hand if you expect to load
126 an external module that requires these functions.
127
128config CRYPTO_NULL
129 tristate "Null algorithms"
130 select CRYPTO_ALGAPI
131 select CRYPTO_BLKCIPHER
132 select CRYPTO_HASH
133 help
134 These are 'Null' algorithms, used by IPsec, which do nothing.
135
136config CRYPTO_PCRYPT
137 tristate "Parallel crypto engine"
138 depends on SMP
139 select PADATA
140 select CRYPTO_MANAGER
141 select CRYPTO_AEAD
142 help
143 This converts an arbitrary crypto algorithm into a parallel
144 algorithm that executes in kernel threads.
145
146config CRYPTO_WORKQUEUE
147 tristate
148
149config CRYPTO_CRYPTD
150 tristate "Software async crypto daemon"
151 select CRYPTO_BLKCIPHER
152 select CRYPTO_HASH
153 select CRYPTO_MANAGER
154 select CRYPTO_WORKQUEUE
155 help
156 This is a generic software asynchronous crypto daemon that
157 converts an arbitrary synchronous software crypto algorithm
158 into an asynchronous algorithm that executes in a kernel thread.
159
160config CRYPTO_AUTHENC
161 tristate "Authenc support"
162 select CRYPTO_AEAD
163 select CRYPTO_BLKCIPHER
164 select CRYPTO_MANAGER
165 select CRYPTO_HASH
166 help
167 Authenc: Combined mode wrapper for IPsec.
168 This is required for IPSec.
169
170config CRYPTO_TEST
171 tristate "Testing module"
172 depends on m
173 select CRYPTO_MANAGER
174 help
175 Quick & dirty crypto test module.
176
177config CRYPTO_ABLK_HELPER
178 tristate
179 select CRYPTO_CRYPTD
180
181config CRYPTO_GLUE_HELPER_X86
182 tristate
183 depends on X86
184 select CRYPTO_ALGAPI
185
186comment "Authenticated Encryption with Associated Data"
187
188config CRYPTO_CCM
189 tristate "CCM support"
190 select CRYPTO_CTR
191 select CRYPTO_AEAD
192 help
193 Support for Counter with CBC MAC. Required for IPsec.
194
195config CRYPTO_GCM
196 tristate "GCM/GMAC support"
197 select CRYPTO_CTR
198 select CRYPTO_AEAD
199 select CRYPTO_GHASH
200 select CRYPTO_NULL
201 help
202 Support for Galois/Counter Mode (GCM) and Galois Message
203 Authentication Code (GMAC). Required for IPSec.
204
205config CRYPTO_SEQIV
206 tristate "Sequence Number IV Generator"
207 select CRYPTO_AEAD
208 select CRYPTO_BLKCIPHER
209 select CRYPTO_RNG
210 help
211 This IV generator generates an IV based on a sequence number by
212 xoring it with a salt. This algorithm is mainly useful for CTR
213
214comment "Block modes"
215
216config CRYPTO_CBC
217 tristate "CBC support"
218 select CRYPTO_BLKCIPHER
219 select CRYPTO_MANAGER
220 help
221 CBC: Cipher Block Chaining mode
222 This block cipher algorithm is required for IPSec.
223
224config CRYPTO_CTR
225 tristate "CTR support"
226 select CRYPTO_BLKCIPHER
227 select CRYPTO_SEQIV
228 select CRYPTO_MANAGER
229 help
230 CTR: Counter mode
231 This block cipher algorithm is required for IPSec.
232
233config CRYPTO_CTS
234 tristate "CTS support"
235 select CRYPTO_BLKCIPHER
236 help
237 CTS: Cipher Text Stealing
238 This is the Cipher Text Stealing mode as described by
239 Section 8 of rfc2040 and referenced by rfc3962.
240 (rfc3962 includes errata information in its Appendix A)
241 This mode is required for Kerberos gss mechanism support
242 for AES encryption.
243
244config CRYPTO_ECB
245 tristate "ECB support"
246 select CRYPTO_BLKCIPHER
247 select CRYPTO_MANAGER
248 help
249 ECB: Electronic CodeBook mode
250 This is the simplest block cipher algorithm. It simply encrypts
251 the input block by block.
252
253config CRYPTO_LRW
254 tristate "LRW support"
255 select CRYPTO_BLKCIPHER
256 select CRYPTO_MANAGER
257 select CRYPTO_GF128MUL
258 help
259 LRW: Liskov Rivest Wagner, a tweakable, non malleable, non movable
260 narrow block cipher mode for dm-crypt. Use it with cipher
261 specification string aes-lrw-benbi, the key must be 256, 320 or 384.
262 The first 128, 192 or 256 bits in the key are used for AES and the
263 rest is used to tie each cipher block to its logical position.
264
265config CRYPTO_PCBC
266 tristate "PCBC support"
267 select CRYPTO_BLKCIPHER
268 select CRYPTO_MANAGER
269 help
270 PCBC: Propagating Cipher Block Chaining mode
271 This block cipher algorithm is required for RxRPC.
272
273config CRYPTO_XTS
274 tristate "XTS support"
275 select CRYPTO_BLKCIPHER
276 select CRYPTO_MANAGER
277 select CRYPTO_GF128MUL
278 help
279 XTS: IEEE1619/D16 narrow block cipher use with aes-xts-plain,
280 key size 256, 384 or 512 bits. This implementation currently
281 can't handle a sectorsize which is not a multiple of 16 bytes.
282
283comment "Hash modes"
284
285config CRYPTO_CMAC
286 tristate "CMAC support"
287 select CRYPTO_HASH
288 select CRYPTO_MANAGER
289 help
290 Cipher-based Message Authentication Code (CMAC) specified by
291 The National Institute of Standards and Technology (NIST).
292
293 https://tools.ietf.org/html/rfc4493
294 http://csrc.nist.gov/publications/nistpubs/800-38B/SP_800-38B.pdf
295
296config CRYPTO_HMAC
297 tristate "HMAC support"
298 select CRYPTO_HASH
299 select CRYPTO_MANAGER
300 help
301 HMAC: Keyed-Hashing for Message Authentication (RFC2104).
302 This is required for IPSec.
303
304config CRYPTO_XCBC
305 tristate "XCBC support"
306 select CRYPTO_HASH
307 select CRYPTO_MANAGER
308 help
309 XCBC: Keyed-Hashing with encryption algorithm
310 http://www.ietf.org/rfc/rfc3566.txt
311 http://csrc.nist.gov/encryption/modes/proposedmodes/
312 xcbc-mac/xcbc-mac-spec.pdf
313
314config CRYPTO_VMAC
315 tristate "VMAC support"
316 select CRYPTO_HASH
317 select CRYPTO_MANAGER
318 help
319 VMAC is a message authentication algorithm designed for
320 very high speed on 64-bit architectures.
321
322 See also:
323 <http://fastcrypto.org/vmac>
324
325comment "Digest"
326
327config CRYPTO_CRC32C
328 tristate "CRC32c CRC algorithm"
329 select CRYPTO_HASH
330 select CRC32
331 help
332 Castagnoli, et al Cyclic Redundancy-Check Algorithm. Used
333 by iSCSI for header and data digests and by others.
334 See Castagnoli93. Module will be crc32c.
335
336config CRYPTO_CRC32C_INTEL
337 tristate "CRC32c INTEL hardware acceleration"
338 depends on X86
339 select CRYPTO_HASH
340 help
341 In Intel processor with SSE4.2 supported, the processor will
342 support CRC32C implementation using hardware accelerated CRC32
343 instruction. This option will create 'crc32c-intel' module,
344 which will enable any routine to use the CRC32 instruction to
345 gain performance compared with software implementation.
346 Module will be crc32c-intel.
347
348config CRYPTO_CRC32C_SPARC64
349 tristate "CRC32c CRC algorithm (SPARC64)"
350 depends on SPARC64
351 select CRYPTO_HASH
352 select CRC32
353 help
354 CRC32c CRC algorithm implemented using sparc64 crypto instructions,
355 when available.
356
357config CRYPTO_CRC32
358 tristate "CRC32 CRC algorithm"
359 select CRYPTO_HASH
360 select CRC32
361 help
362 CRC-32-IEEE 802.3 cyclic redundancy-check algorithm.
363 Shash crypto api wrappers to crc32_le function.
364
365config CRYPTO_CRC32_PCLMUL
366 tristate "CRC32 PCLMULQDQ hardware acceleration"
367 depends on X86
368 select CRYPTO_HASH
369 select CRC32
370 help
371 From Intel Westmere and AMD Bulldozer processor with SSE4.2
372 and PCLMULQDQ supported, the processor will support
373 CRC32 PCLMULQDQ implementation using hardware accelerated PCLMULQDQ
374 instruction. This option will create 'crc32-plcmul' module,
375 which will enable any routine to use the CRC-32-IEEE 802.3 checksum
376 and gain better performance as compared with the table implementation.
377
378config CRYPTO_CRCT10DIF
379 tristate "CRCT10DIF algorithm"
380 select CRYPTO_HASH
381 help
382 CRC T10 Data Integrity Field computation is being cast as
383 a crypto transform. This allows for faster crc t10 diff
384 transforms to be used if they are available.
385
386config CRYPTO_CRCT10DIF_PCLMUL
387 tristate "CRCT10DIF PCLMULQDQ hardware acceleration"
388 depends on X86 && 64BIT && CRC_T10DIF
389 select CRYPTO_HASH
390 help
391 For x86_64 processors with SSE4.2 and PCLMULQDQ supported,
392 CRC T10 DIF PCLMULQDQ computation can be hardware
393 accelerated PCLMULQDQ instruction. This option will create
394 'crct10dif-plcmul' module, which is faster when computing the
395 crct10dif checksum as compared with the generic table implementation.
396
397config CRYPTO_GHASH
398 tristate "GHASH digest algorithm"
399 select CRYPTO_GF128MUL
400 help
401 GHASH is message digest algorithm for GCM (Galois/Counter Mode).
402
403config CRYPTO_MD4
404 tristate "MD4 digest algorithm"
405 select CRYPTO_HASH
406 help
407 MD4 message digest algorithm (RFC1320).
408
409config CRYPTO_MD5
410 tristate "MD5 digest algorithm"
411 select CRYPTO_HASH
412 help
413 MD5 message digest algorithm (RFC1321).
414
415config CRYPTO_MD5_SPARC64
416 tristate "MD5 digest algorithm (SPARC64)"
417 depends on SPARC64
418 select CRYPTO_MD5
419 select CRYPTO_HASH
420 help
421 MD5 message digest algorithm (RFC1321) implemented
422 using sparc64 crypto instructions, when available.
423
424config CRYPTO_MICHAEL_MIC
425 tristate "Michael MIC keyed digest algorithm"
426 select CRYPTO_HASH
427 help
428 Michael MIC is used for message integrity protection in TKIP
429 (IEEE 802.11i). This algorithm is required for TKIP, but it
430 should not be used for other purposes because of the weakness
431 of the algorithm.
432
433config CRYPTO_RMD128
434 tristate "RIPEMD-128 digest algorithm"
435 select CRYPTO_HASH
436 help
437 RIPEMD-128 (ISO/IEC 10118-3:2004).
438
439 RIPEMD-128 is a 128-bit cryptographic hash function. It should only
440 be used as a secure replacement for RIPEMD. For other use cases,
441 RIPEMD-160 should be used.
442
443 Developed by Hans Dobbertin, Antoon Bosselaers and Bart Preneel.
444 See <http://homes.esat.kuleuven.be/~bosselae/ripemd160.html>
445
446config CRYPTO_RMD160
447 tristate "RIPEMD-160 digest algorithm"
448 select CRYPTO_HASH
449 help
450 RIPEMD-160 (ISO/IEC 10118-3:2004).
451
452 RIPEMD-160 is a 160-bit cryptographic hash function. It is intended
453 to be used as a secure replacement for the 128-bit hash functions
454 MD4, MD5 and it's predecessor RIPEMD
455 (not to be confused with RIPEMD-128).
456
457 It's speed is comparable to SHA1 and there are no known attacks
458 against RIPEMD-160.
459
460 Developed by Hans Dobbertin, Antoon Bosselaers and Bart Preneel.
461 See <http://homes.esat.kuleuven.be/~bosselae/ripemd160.html>
462
463config CRYPTO_RMD256
464 tristate "RIPEMD-256 digest algorithm"
465 select CRYPTO_HASH
466 help
467 RIPEMD-256 is an optional extension of RIPEMD-128 with a
468 256 bit hash. It is intended for applications that require
469 longer hash-results, without needing a larger security level
470 (than RIPEMD-128).
471
472 Developed by Hans Dobbertin, Antoon Bosselaers and Bart Preneel.
473 See <http://homes.esat.kuleuven.be/~bosselae/ripemd160.html>
474
475config CRYPTO_RMD320
476 tristate "RIPEMD-320 digest algorithm"
477 select CRYPTO_HASH
478 help
479 RIPEMD-320 is an optional extension of RIPEMD-160 with a
480 320 bit hash. It is intended for applications that require
481 longer hash-results, without needing a larger security level
482 (than RIPEMD-160).
483
484 Developed by Hans Dobbertin, Antoon Bosselaers and Bart Preneel.
485 See <http://homes.esat.kuleuven.be/~bosselae/ripemd160.html>
486
487config CRYPTO_SHA1
488 tristate "SHA1 digest algorithm"
489 select CRYPTO_HASH
490 help
491 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2).
492
493config CRYPTO_SHA1_SSSE3
494 tristate "SHA1 digest algorithm (SSSE3/AVX/AVX2)"
495 depends on X86 && 64BIT
496 select CRYPTO_SHA1
497 select CRYPTO_HASH
498 help
499 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2) implemented
500 using Supplemental SSE3 (SSSE3) instructions or Advanced Vector
501 Extensions (AVX/AVX2), when available.
502
503config CRYPTO_SHA256_SSSE3
504 tristate "SHA256 digest algorithm (SSSE3/AVX/AVX2)"
505 depends on X86 && 64BIT
506 select CRYPTO_SHA256
507 select CRYPTO_HASH
508 help
509 SHA-256 secure hash standard (DFIPS 180-2) implemented
510 using Supplemental SSE3 (SSSE3) instructions, or Advanced Vector
511 Extensions version 1 (AVX1), or Advanced Vector Extensions
512 version 2 (AVX2) instructions, when available.
513
514config CRYPTO_SHA512_SSSE3
515 tristate "SHA512 digest algorithm (SSSE3/AVX/AVX2)"
516 depends on X86 && 64BIT
517 select CRYPTO_SHA512
518 select CRYPTO_HASH
519 help
520 SHA-512 secure hash standard (DFIPS 180-2) implemented
521 using Supplemental SSE3 (SSSE3) instructions, or Advanced Vector
522 Extensions version 1 (AVX1), or Advanced Vector Extensions
523 version 2 (AVX2) instructions, when available.
524
525config CRYPTO_SHA1_SPARC64
526 tristate "SHA1 digest algorithm (SPARC64)"
527 depends on SPARC64
528 select CRYPTO_SHA1
529 select CRYPTO_HASH
530 help
531 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2) implemented
532 using sparc64 crypto instructions, when available.
533
534config CRYPTO_SHA1_ARM
535 tristate "SHA1 digest algorithm (ARM-asm)"
536 depends on ARM
537 select CRYPTO_SHA1
538 select CRYPTO_HASH
539 help
540 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2) implemented
541 using optimized ARM assembler.
542
543config CRYPTO_SHA1_PPC
544 tristate "SHA1 digest algorithm (powerpc)"
545 depends on PPC
546 help
547 This is the powerpc hardware accelerated implementation of the
548 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2).
549
550config CRYPTO_SHA256
551 tristate "SHA224 and SHA256 digest algorithm"
552 select CRYPTO_HASH
553 help
554 SHA256 secure hash standard (DFIPS 180-2).
555
556 This version of SHA implements a 256 bit hash with 128 bits of
557 security against collision attacks.
558
559 This code also includes SHA-224, a 224 bit hash with 112 bits
560 of security against collision attacks.
561
562config CRYPTO_SHA256_SPARC64
563 tristate "SHA224 and SHA256 digest algorithm (SPARC64)"
564 depends on SPARC64
565 select CRYPTO_SHA256
566 select CRYPTO_HASH
567 help
568 SHA-256 secure hash standard (DFIPS 180-2) implemented
569 using sparc64 crypto instructions, when available.
570
571config CRYPTO_SHA512
572 tristate "SHA384 and SHA512 digest algorithms"
573 select CRYPTO_HASH
574 help
575 SHA512 secure hash standard (DFIPS 180-2).
576
577 This version of SHA implements a 512 bit hash with 256 bits of
578 security against collision attacks.
579
580 This code also includes SHA-384, a 384 bit hash with 192 bits
581 of security against collision attacks.
582
583config CRYPTO_SHA512_SPARC64
584 tristate "SHA384 and SHA512 digest algorithm (SPARC64)"
585 depends on SPARC64
586 select CRYPTO_SHA512
587 select CRYPTO_HASH
588 help
589 SHA-512 secure hash standard (DFIPS 180-2) implemented
590 using sparc64 crypto instructions, when available.
591
592config CRYPTO_TGR192
593 tristate "Tiger digest algorithms"
594 select CRYPTO_HASH
595 help
596 Tiger hash algorithm 192, 160 and 128-bit hashes
597
598 Tiger is a hash function optimized for 64-bit processors while
599 still having decent performance on 32-bit processors.
600 Tiger was developed by Ross Anderson and Eli Biham.
601
602 See also:
603 <http://www.cs.technion.ac.il/~biham/Reports/Tiger/>.
604
605config CRYPTO_WP512
606 tristate "Whirlpool digest algorithms"
607 select CRYPTO_HASH
608 help
609 Whirlpool hash algorithm 512, 384 and 256-bit hashes
610
611 Whirlpool-512 is part of the NESSIE cryptographic primitives.
612 Whirlpool will be part of the ISO/IEC 10118-3:2003(E) standard
613
614 See also:
615 <http://www.larc.usp.br/~pbarreto/WhirlpoolPage.html>
616
617config CRYPTO_GHASH_CLMUL_NI_INTEL
618 tristate "GHASH digest algorithm (CLMUL-NI accelerated)"
619 depends on X86 && 64BIT
620 select CRYPTO_CRYPTD
621 help
622 GHASH is message digest algorithm for GCM (Galois/Counter Mode).
623 The implementation is accelerated by CLMUL-NI of Intel.
624
625comment "Ciphers"
626
627config CRYPTO_AES
628 tristate "AES cipher algorithms"
629 select CRYPTO_ALGAPI
630 help
631 AES cipher algorithms (FIPS-197). AES uses the Rijndael
632 algorithm.
633
634 Rijndael appears to be consistently a very good performer in
635 both hardware and software across a wide range of computing
636 environments regardless of its use in feedback or non-feedback
637 modes. Its key setup time is excellent, and its key agility is
638 good. Rijndael's very low memory requirements make it very well
639 suited for restricted-space environments, in which it also
640 demonstrates excellent performance. Rijndael's operations are
641 among the easiest to defend against power and timing attacks.
642
643 The AES specifies three key sizes: 128, 192 and 256 bits
644
645 See <http://csrc.nist.gov/CryptoToolkit/aes/> for more information.
646
647config CRYPTO_AES_586
648 tristate "AES cipher algorithms (i586)"
649 depends on (X86 || UML_X86) && !64BIT
650 select CRYPTO_ALGAPI
651 select CRYPTO_AES
652 help
653 AES cipher algorithms (FIPS-197). AES uses the Rijndael
654 algorithm.
655
656 Rijndael appears to be consistently a very good performer in
657 both hardware and software across a wide range of computing
658 environments regardless of its use in feedback or non-feedback
659 modes. Its key setup time is excellent, and its key agility is
660 good. Rijndael's very low memory requirements make it very well
661 suited for restricted-space environments, in which it also
662 demonstrates excellent performance. Rijndael's operations are
663 among the easiest to defend against power and timing attacks.
664
665 The AES specifies three key sizes: 128, 192 and 256 bits
666
667 See <http://csrc.nist.gov/encryption/aes/> for more information.
668
669config CRYPTO_AES_X86_64
670 tristate "AES cipher algorithms (x86_64)"
671 depends on (X86 || UML_X86) && 64BIT
672 select CRYPTO_ALGAPI
673 select CRYPTO_AES
674 help
675 AES cipher algorithms (FIPS-197). AES uses the Rijndael
676 algorithm.
677
678 Rijndael appears to be consistently a very good performer in
679 both hardware and software across a wide range of computing
680 environments regardless of its use in feedback or non-feedback
681 modes. Its key setup time is excellent, and its key agility is
682 good. Rijndael's very low memory requirements make it very well
683 suited for restricted-space environments, in which it also
684 demonstrates excellent performance. Rijndael's operations are
685 among the easiest to defend against power and timing attacks.
686
687 The AES specifies three key sizes: 128, 192 and 256 bits
688
689 See <http://csrc.nist.gov/encryption/aes/> for more information.
690
691config CRYPTO_AES_NI_INTEL
692 tristate "AES cipher algorithms (AES-NI)"
693 depends on X86
694 select CRYPTO_AES_X86_64 if 64BIT
695 select CRYPTO_AES_586 if !64BIT
696 select CRYPTO_CRYPTD
697 select CRYPTO_ABLK_HELPER
698 select CRYPTO_ALGAPI
699 select CRYPTO_GLUE_HELPER_X86 if 64BIT
700 select CRYPTO_LRW
701 select CRYPTO_XTS
702 help
703 Use Intel AES-NI instructions for AES algorithm.
704
705 AES cipher algorithms (FIPS-197). AES uses the Rijndael
706 algorithm.
707
708 Rijndael appears to be consistently a very good performer in
709 both hardware and software across a wide range of computing
710 environments regardless of its use in feedback or non-feedback
711 modes. Its key setup time is excellent, and its key agility is
712 good. Rijndael's very low memory requirements make it very well
713 suited for restricted-space environments, in which it also
714 demonstrates excellent performance. Rijndael's operations are
715 among the easiest to defend against power and timing attacks.
716
717 The AES specifies three key sizes: 128, 192 and 256 bits
718
719 See <http://csrc.nist.gov/encryption/aes/> for more information.
720
721 In addition to AES cipher algorithm support, the acceleration
722 for some popular block cipher mode is supported too, including
723 ECB, CBC, LRW, PCBC, XTS. The 64 bit version has additional
724 acceleration for CTR.
725
726config CRYPTO_AES_SPARC64
727 tristate "AES cipher algorithms (SPARC64)"
728 depends on SPARC64
729 select CRYPTO_CRYPTD
730 select CRYPTO_ALGAPI
731 help
732 Use SPARC64 crypto opcodes for AES algorithm.
733
734 AES cipher algorithms (FIPS-197). AES uses the Rijndael
735 algorithm.
736
737 Rijndael appears to be consistently a very good performer in
738 both hardware and software across a wide range of computing
739 environments regardless of its use in feedback or non-feedback
740 modes. Its key setup time is excellent, and its key agility is
741 good. Rijndael's very low memory requirements make it very well
742 suited for restricted-space environments, in which it also
743 demonstrates excellent performance. Rijndael's operations are
744 among the easiest to defend against power and timing attacks.
745
746 The AES specifies three key sizes: 128, 192 and 256 bits
747
748 See <http://csrc.nist.gov/encryption/aes/> for more information.
749
750 In addition to AES cipher algorithm support, the acceleration
751 for some popular block cipher mode is supported too, including
752 ECB and CBC.
753
754config CRYPTO_AES_ARM
755 tristate "AES cipher algorithms (ARM-asm)"
756 depends on ARM
757 select CRYPTO_ALGAPI
758 select CRYPTO_AES
759 help
760 Use optimized AES assembler routines for ARM platforms.
761
762 AES cipher algorithms (FIPS-197). AES uses the Rijndael
763 algorithm.
764
765 Rijndael appears to be consistently a very good performer in
766 both hardware and software across a wide range of computing
767 environments regardless of its use in feedback or non-feedback
768 modes. Its key setup time is excellent, and its key agility is
769 good. Rijndael's very low memory requirements make it very well
770 suited for restricted-space environments, in which it also
771 demonstrates excellent performance. Rijndael's operations are
772 among the easiest to defend against power and timing attacks.
773
774 The AES specifies three key sizes: 128, 192 and 256 bits
775
776 See <http://csrc.nist.gov/encryption/aes/> for more information.
777
778config CRYPTO_AES_ARM_BS
779 tristate "Bit sliced AES using NEON instructions"
780 depends on ARM && KERNEL_MODE_NEON
781 select CRYPTO_ALGAPI
782 select CRYPTO_AES_ARM
783 select CRYPTO_ABLK_HELPER
784 help
785 Use a faster and more secure NEON based implementation of AES in CBC,
786 CTR and XTS modes
787
788 Bit sliced AES gives around 45% speedup on Cortex-A15 for CTR mode
789 and for XTS mode encryption, CBC and XTS mode decryption speedup is
790 around 25%. (CBC encryption speed is not affected by this driver.)
791 This implementation does not rely on any lookup tables so it is
792 believed to be invulnerable to cache timing attacks.
793
794config CRYPTO_ANUBIS
795 tristate "Anubis cipher algorithm"
796 select CRYPTO_ALGAPI
797 help
798 Anubis cipher algorithm.
799
800 Anubis is a variable key length cipher which can use keys from
801 128 bits to 320 bits in length. It was evaluated as a entrant
802 in the NESSIE competition.
803
804 See also:
805 <https://www.cosic.esat.kuleuven.be/nessie/reports/>
806 <http://www.larc.usp.br/~pbarreto/AnubisPage.html>
807
808config CRYPTO_ARC4
809 tristate "ARC4 cipher algorithm"
810 select CRYPTO_BLKCIPHER
811 help
812 ARC4 cipher algorithm.
813
814 ARC4 is a stream cipher using keys ranging from 8 bits to 2048
815 bits in length. This algorithm is required for driver-based
816 WEP, but it should not be for other purposes because of the
817 weakness of the algorithm.
818
819config CRYPTO_BLOWFISH
820 tristate "Blowfish cipher algorithm"
821 select CRYPTO_ALGAPI
822 select CRYPTO_BLOWFISH_COMMON
823 help
824 Blowfish cipher algorithm, by Bruce Schneier.
825
826 This is a variable key length cipher which can use keys from 32
827 bits to 448 bits in length. It's fast, simple and specifically
828 designed for use on "large microprocessors".
829
830 See also:
831 <http://www.schneier.com/blowfish.html>
832
833config CRYPTO_BLOWFISH_COMMON
834 tristate
835 help
836 Common parts of the Blowfish cipher algorithm shared by the
837 generic c and the assembler implementations.
838
839 See also:
840 <http://www.schneier.com/blowfish.html>
841
842config CRYPTO_BLOWFISH_X86_64
843 tristate "Blowfish cipher algorithm (x86_64)"
844 depends on X86 && 64BIT
845 select CRYPTO_ALGAPI
846 select CRYPTO_BLOWFISH_COMMON
847 help
848 Blowfish cipher algorithm (x86_64), by Bruce Schneier.
849
850 This is a variable key length cipher which can use keys from 32
851 bits to 448 bits in length. It's fast, simple and specifically
852 designed for use on "large microprocessors".
853
854 See also:
855 <http://www.schneier.com/blowfish.html>
856
857config CRYPTO_CAMELLIA
858 tristate "Camellia cipher algorithms"
859 depends on CRYPTO
860 select CRYPTO_ALGAPI
861 help
862 Camellia cipher algorithms module.
863
864 Camellia is a symmetric key block cipher developed jointly
865 at NTT and Mitsubishi Electric Corporation.
866
867 The Camellia specifies three key sizes: 128, 192 and 256 bits.
868
869 See also:
870 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
871
872config CRYPTO_CAMELLIA_X86_64
873 tristate "Camellia cipher algorithm (x86_64)"
874 depends on X86 && 64BIT
875 depends on CRYPTO
876 select CRYPTO_ALGAPI
877 select CRYPTO_GLUE_HELPER_X86
878 select CRYPTO_LRW
879 select CRYPTO_XTS
880 help
881 Camellia cipher algorithm module (x86_64).
882
883 Camellia is a symmetric key block cipher developed jointly
884 at NTT and Mitsubishi Electric Corporation.
885
886 The Camellia specifies three key sizes: 128, 192 and 256 bits.
887
888 See also:
889 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
890
891config CRYPTO_CAMELLIA_AESNI_AVX_X86_64
892 tristate "Camellia cipher algorithm (x86_64/AES-NI/AVX)"
893 depends on X86 && 64BIT
894 depends on CRYPTO
895 select CRYPTO_ALGAPI
896 select CRYPTO_CRYPTD
897 select CRYPTO_ABLK_HELPER
898 select CRYPTO_GLUE_HELPER_X86
899 select CRYPTO_CAMELLIA_X86_64
900 select CRYPTO_LRW
901 select CRYPTO_XTS
902 help
903 Camellia cipher algorithm module (x86_64/AES-NI/AVX).
904
905 Camellia is a symmetric key block cipher developed jointly
906 at NTT and Mitsubishi Electric Corporation.
907
908 The Camellia specifies three key sizes: 128, 192 and 256 bits.
909
910 See also:
911 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
912
913config CRYPTO_CAMELLIA_AESNI_AVX2_X86_64
914 tristate "Camellia cipher algorithm (x86_64/AES-NI/AVX2)"
915 depends on X86 && 64BIT
916 depends on CRYPTO
917 select CRYPTO_ALGAPI
918 select CRYPTO_CRYPTD
919 select CRYPTO_ABLK_HELPER
920 select CRYPTO_GLUE_HELPER_X86
921 select CRYPTO_CAMELLIA_X86_64
922 select CRYPTO_CAMELLIA_AESNI_AVX_X86_64
923 select CRYPTO_LRW
924 select CRYPTO_XTS
925 help
926 Camellia cipher algorithm module (x86_64/AES-NI/AVX2).
927
928 Camellia is a symmetric key block cipher developed jointly
929 at NTT and Mitsubishi Electric Corporation.
930
931 The Camellia specifies three key sizes: 128, 192 and 256 bits.
932
933 See also:
934 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
935
936config CRYPTO_CAMELLIA_SPARC64
937 tristate "Camellia cipher algorithm (SPARC64)"
938 depends on SPARC64
939 depends on CRYPTO
940 select CRYPTO_ALGAPI
941 help
942 Camellia cipher algorithm module (SPARC64).
943
944 Camellia is a symmetric key block cipher developed jointly
945 at NTT and Mitsubishi Electric Corporation.
946
947 The Camellia specifies three key sizes: 128, 192 and 256 bits.
948
949 See also:
950 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
951
952config CRYPTO_CAST_COMMON
953 tristate
954 help
955 Common parts of the CAST cipher algorithms shared by the
956 generic c and the assembler implementations.
957
958config CRYPTO_CAST5
959 tristate "CAST5 (CAST-128) cipher algorithm"
960 select CRYPTO_ALGAPI
961 select CRYPTO_CAST_COMMON
962 help
963 The CAST5 encryption algorithm (synonymous with CAST-128) is
964 described in RFC2144.
965
966config CRYPTO_CAST5_AVX_X86_64
967 tristate "CAST5 (CAST-128) cipher algorithm (x86_64/AVX)"
968 depends on X86 && 64BIT
969 select CRYPTO_ALGAPI
970 select CRYPTO_CRYPTD
971 select CRYPTO_ABLK_HELPER
972 select CRYPTO_CAST_COMMON
973 select CRYPTO_CAST5
974 help
975 The CAST5 encryption algorithm (synonymous with CAST-128) is
976 described in RFC2144.
977
978 This module provides the Cast5 cipher algorithm that processes
979 sixteen blocks parallel using the AVX instruction set.
980
981config CRYPTO_CAST6
982 tristate "CAST6 (CAST-256) cipher algorithm"
983 select CRYPTO_ALGAPI
984 select CRYPTO_CAST_COMMON
985 help
986 The CAST6 encryption algorithm (synonymous with CAST-256) is
987 described in RFC2612.
988
989config CRYPTO_CAST6_AVX_X86_64
990 tristate "CAST6 (CAST-256) cipher algorithm (x86_64/AVX)"
991 depends on X86 && 64BIT
992 select CRYPTO_ALGAPI
993 select CRYPTO_CRYPTD
994 select CRYPTO_ABLK_HELPER
995 select CRYPTO_GLUE_HELPER_X86
996 select CRYPTO_CAST_COMMON
997 select CRYPTO_CAST6
998 select CRYPTO_LRW
999 select CRYPTO_XTS
1000 help
1001 The CAST6 encryption algorithm (synonymous with CAST-256) is
1002 described in RFC2612.
1003
1004 This module provides the Cast6 cipher algorithm that processes
1005 eight blocks parallel using the AVX instruction set.
1006
1007config CRYPTO_DES
1008 tristate "DES and Triple DES EDE cipher algorithms"
1009 select CRYPTO_ALGAPI
1010 help
1011 DES cipher algorithm (FIPS 46-2), and Triple DES EDE (FIPS 46-3).
1012
1013config CRYPTO_DES_SPARC64
1014 tristate "DES and Triple DES EDE cipher algorithms (SPARC64)"
1015 depends on SPARC64
1016 select CRYPTO_ALGAPI
1017 select CRYPTO_DES
1018 help
1019 DES cipher algorithm (FIPS 46-2), and Triple DES EDE (FIPS 46-3),
1020 optimized using SPARC64 crypto opcodes.
1021
1022config CRYPTO_FCRYPT
1023 tristate "FCrypt cipher algorithm"
1024 select CRYPTO_ALGAPI
1025 select CRYPTO_BLKCIPHER
1026 help
1027 FCrypt algorithm used by RxRPC.
1028
1029config CRYPTO_KHAZAD
1030 tristate "Khazad cipher algorithm"
1031 select CRYPTO_ALGAPI
1032 help
1033 Khazad cipher algorithm.
1034
1035 Khazad was a finalist in the initial NESSIE competition. It is
1036 an algorithm optimized for 64-bit processors with good performance
1037 on 32-bit processors. Khazad uses an 128 bit key size.
1038
1039 See also:
1040 <http://www.larc.usp.br/~pbarreto/KhazadPage.html>
1041
1042config CRYPTO_SALSA20
1043 tristate "Salsa20 stream cipher algorithm"
1044 select CRYPTO_BLKCIPHER
1045 help
1046 Salsa20 stream cipher algorithm.
1047
1048 Salsa20 is a stream cipher submitted to eSTREAM, the ECRYPT
1049 Stream Cipher Project. See <http://www.ecrypt.eu.org/stream/>
1050
1051 The Salsa20 stream cipher algorithm is designed by Daniel J.
1052 Bernstein <djb@cr.yp.to>. See <http://cr.yp.to/snuffle.html>
1053
1054config CRYPTO_SALSA20_586
1055 tristate "Salsa20 stream cipher algorithm (i586)"
1056 depends on (X86 || UML_X86) && !64BIT
1057 select CRYPTO_BLKCIPHER
1058 help
1059 Salsa20 stream cipher algorithm.
1060
1061 Salsa20 is a stream cipher submitted to eSTREAM, the ECRYPT
1062 Stream Cipher Project. See <http://www.ecrypt.eu.org/stream/>
1063
1064 The Salsa20 stream cipher algorithm is designed by Daniel J.
1065 Bernstein <djb@cr.yp.to>. See <http://cr.yp.to/snuffle.html>
1066
1067config CRYPTO_SALSA20_X86_64
1068 tristate "Salsa20 stream cipher algorithm (x86_64)"
1069 depends on (X86 || UML_X86) && 64BIT
1070 select CRYPTO_BLKCIPHER
1071 help
1072 Salsa20 stream cipher algorithm.
1073
1074 Salsa20 is a stream cipher submitted to eSTREAM, the ECRYPT
1075 Stream Cipher Project. See <http://www.ecrypt.eu.org/stream/>
1076
1077 The Salsa20 stream cipher algorithm is designed by Daniel J.
1078 Bernstein <djb@cr.yp.to>. See <http://cr.yp.to/snuffle.html>
1079
1080config CRYPTO_SEED
1081 tristate "SEED cipher algorithm"
1082 select CRYPTO_ALGAPI
1083 help
1084 SEED cipher algorithm (RFC4269).
1085
1086 SEED is a 128-bit symmetric key block cipher that has been
1087 developed by KISA (Korea Information Security Agency) as a
1088 national standard encryption algorithm of the Republic of Korea.
1089 It is a 16 round block cipher with the key size of 128 bit.
1090
1091 See also:
1092 <http://www.kisa.or.kr/kisa/seed/jsp/seed_eng.jsp>
1093
1094config CRYPTO_SERPENT
1095 tristate "Serpent cipher algorithm"
1096 select CRYPTO_ALGAPI
1097 help
1098 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1099
1100 Keys are allowed to be from 0 to 256 bits in length, in steps
1101 of 8 bits. Also includes the 'Tnepres' algorithm, a reversed
1102 variant of Serpent for compatibility with old kerneli.org code.
1103
1104 See also:
1105 <http://www.cl.cam.ac.uk/~rja14/serpent.html>
1106
1107config CRYPTO_SERPENT_SSE2_X86_64
1108 tristate "Serpent cipher algorithm (x86_64/SSE2)"
1109 depends on X86 && 64BIT
1110 select CRYPTO_ALGAPI
1111 select CRYPTO_CRYPTD
1112 select CRYPTO_ABLK_HELPER
1113 select CRYPTO_GLUE_HELPER_X86
1114 select CRYPTO_SERPENT
1115 select CRYPTO_LRW
1116 select CRYPTO_XTS
1117 help
1118 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1119
1120 Keys are allowed to be from 0 to 256 bits in length, in steps
1121 of 8 bits.
1122
1123 This module provides Serpent cipher algorithm that processes eigth
1124 blocks parallel using SSE2 instruction set.
1125
1126 See also:
1127 <http://www.cl.cam.ac.uk/~rja14/serpent.html>
1128
1129config CRYPTO_SERPENT_SSE2_586
1130 tristate "Serpent cipher algorithm (i586/SSE2)"
1131 depends on X86 && !64BIT
1132 select CRYPTO_ALGAPI
1133 select CRYPTO_CRYPTD
1134 select CRYPTO_ABLK_HELPER
1135 select CRYPTO_GLUE_HELPER_X86
1136 select CRYPTO_SERPENT
1137 select CRYPTO_LRW
1138 select CRYPTO_XTS
1139 help
1140 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1141
1142 Keys are allowed to be from 0 to 256 bits in length, in steps
1143 of 8 bits.
1144
1145 This module provides Serpent cipher algorithm that processes four
1146 blocks parallel using SSE2 instruction set.
1147
1148 See also:
1149 <http://www.cl.cam.ac.uk/~rja14/serpent.html>
1150
1151config CRYPTO_SERPENT_AVX_X86_64
1152 tristate "Serpent cipher algorithm (x86_64/AVX)"
1153 depends on X86 && 64BIT
1154 select CRYPTO_ALGAPI
1155 select CRYPTO_CRYPTD
1156 select CRYPTO_ABLK_HELPER
1157 select CRYPTO_GLUE_HELPER_X86
1158 select CRYPTO_SERPENT
1159 select CRYPTO_LRW
1160 select CRYPTO_XTS
1161 help
1162 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1163
1164 Keys are allowed to be from 0 to 256 bits in length, in steps
1165 of 8 bits.
1166
1167 This module provides the Serpent cipher algorithm that processes
1168 eight blocks parallel using the AVX instruction set.
1169
1170 See also:
1171 <http://www.cl.cam.ac.uk/~rja14/serpent.html>
1172
1173config CRYPTO_SERPENT_AVX2_X86_64
1174 tristate "Serpent cipher algorithm (x86_64/AVX2)"
1175 depends on X86 && 64BIT
1176 select CRYPTO_ALGAPI
1177 select CRYPTO_CRYPTD
1178 select CRYPTO_ABLK_HELPER
1179 select CRYPTO_GLUE_HELPER_X86
1180 select CRYPTO_SERPENT
1181 select CRYPTO_SERPENT_AVX_X86_64
1182 select CRYPTO_LRW
1183 select CRYPTO_XTS
1184 help
1185 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1186
1187 Keys are allowed to be from 0 to 256 bits in length, in steps
1188 of 8 bits.
1189
1190 This module provides Serpent cipher algorithm that processes 16
1191 blocks parallel using AVX2 instruction set.
1192
1193 See also:
1194 <http://www.cl.cam.ac.uk/~rja14/serpent.html>
1195
1196config CRYPTO_TEA
1197 tristate "TEA, XTEA and XETA cipher algorithms"
1198 select CRYPTO_ALGAPI
1199 help
1200 TEA cipher algorithm.
1201
1202 Tiny Encryption Algorithm is a simple cipher that uses
1203 many rounds for security. It is very fast and uses
1204 little memory.
1205
1206 Xtendend Tiny Encryption Algorithm is a modification to
1207 the TEA algorithm to address a potential key weakness
1208 in the TEA algorithm.
1209
1210 Xtendend Encryption Tiny Algorithm is a mis-implementation
1211 of the XTEA algorithm for compatibility purposes.
1212
1213config CRYPTO_TWOFISH
1214 tristate "Twofish cipher algorithm"
1215 select CRYPTO_ALGAPI
1216 select CRYPTO_TWOFISH_COMMON
1217 help
1218 Twofish cipher algorithm.
1219
1220 Twofish was submitted as an AES (Advanced Encryption Standard)
1221 candidate cipher by researchers at CounterPane Systems. It is a
1222 16 round block cipher supporting key sizes of 128, 192, and 256
1223 bits.
1224
1225 See also:
1226 <http://www.schneier.com/twofish.html>
1227
1228config CRYPTO_TWOFISH_COMMON
1229 tristate
1230 help
1231 Common parts of the Twofish cipher algorithm shared by the
1232 generic c and the assembler implementations.
1233
1234config CRYPTO_TWOFISH_586
1235 tristate "Twofish cipher algorithms (i586)"
1236 depends on (X86 || UML_X86) && !64BIT
1237 select CRYPTO_ALGAPI
1238 select CRYPTO_TWOFISH_COMMON
1239 help
1240 Twofish cipher algorithm.
1241
1242 Twofish was submitted as an AES (Advanced Encryption Standard)
1243 candidate cipher by researchers at CounterPane Systems. It is a
1244 16 round block cipher supporting key sizes of 128, 192, and 256
1245 bits.
1246
1247 See also:
1248 <http://www.schneier.com/twofish.html>
1249
1250config CRYPTO_TWOFISH_X86_64
1251 tristate "Twofish cipher algorithm (x86_64)"
1252 depends on (X86 || UML_X86) && 64BIT
1253 select CRYPTO_ALGAPI
1254 select CRYPTO_TWOFISH_COMMON
1255 help
1256 Twofish cipher algorithm (x86_64).
1257
1258 Twofish was submitted as an AES (Advanced Encryption Standard)
1259 candidate cipher by researchers at CounterPane Systems. It is a
1260 16 round block cipher supporting key sizes of 128, 192, and 256
1261 bits.
1262
1263 See also:
1264 <http://www.schneier.com/twofish.html>
1265
1266config CRYPTO_TWOFISH_X86_64_3WAY
1267 tristate "Twofish cipher algorithm (x86_64, 3-way parallel)"
1268 depends on X86 && 64BIT
1269 select CRYPTO_ALGAPI
1270 select CRYPTO_TWOFISH_COMMON
1271 select CRYPTO_TWOFISH_X86_64
1272 select CRYPTO_GLUE_HELPER_X86
1273 select CRYPTO_LRW
1274 select CRYPTO_XTS
1275 help
1276 Twofish cipher algorithm (x86_64, 3-way parallel).
1277
1278 Twofish was submitted as an AES (Advanced Encryption Standard)
1279 candidate cipher by researchers at CounterPane Systems. It is a
1280 16 round block cipher supporting key sizes of 128, 192, and 256
1281 bits.
1282
1283 This module provides Twofish cipher algorithm that processes three
1284 blocks parallel, utilizing resources of out-of-order CPUs better.
1285
1286 See also:
1287 <http://www.schneier.com/twofish.html>
1288
1289config CRYPTO_TWOFISH_AVX_X86_64
1290 tristate "Twofish cipher algorithm (x86_64/AVX)"
1291 depends on X86 && 64BIT
1292 select CRYPTO_ALGAPI
1293 select CRYPTO_CRYPTD
1294 select CRYPTO_ABLK_HELPER
1295 select CRYPTO_GLUE_HELPER_X86
1296 select CRYPTO_TWOFISH_COMMON
1297 select CRYPTO_TWOFISH_X86_64
1298 select CRYPTO_TWOFISH_X86_64_3WAY
1299 select CRYPTO_LRW
1300 select CRYPTO_XTS
1301 help
1302 Twofish cipher algorithm (x86_64/AVX).
1303
1304 Twofish was submitted as an AES (Advanced Encryption Standard)
1305 candidate cipher by researchers at CounterPane Systems. It is a
1306 16 round block cipher supporting key sizes of 128, 192, and 256
1307 bits.
1308
1309 This module provides the Twofish cipher algorithm that processes
1310 eight blocks parallel using the AVX Instruction Set.
1311
1312 See also:
1313 <http://www.schneier.com/twofish.html>
1314
1315comment "Compression"
1316
1317config CRYPTO_DEFLATE
1318 tristate "Deflate compression algorithm"
1319 select CRYPTO_ALGAPI
1320 select ZLIB_INFLATE
1321 select ZLIB_DEFLATE
1322 help
1323 This is the Deflate algorithm (RFC1951), specified for use in
1324 IPSec with the IPCOMP protocol (RFC3173, RFC2394).
1325
1326 You will most probably want this if using IPSec.
1327
1328config CRYPTO_ZLIB
1329 tristate "Zlib compression algorithm"
1330 select CRYPTO_PCOMP
1331 select ZLIB_INFLATE
1332 select ZLIB_DEFLATE
1333 select NLATTR
1334 help
1335 This is the zlib algorithm.
1336
1337config CRYPTO_LZO
1338 tristate "LZO compression algorithm"
1339 select CRYPTO_ALGAPI
1340 select LZO_COMPRESS
1341 select LZO_DECOMPRESS
1342 help
1343 This is the LZO algorithm.
1344
1345config CRYPTO_842
1346 tristate "842 compression algorithm"
1347 depends on CRYPTO_DEV_NX_COMPRESS
1348 # 842 uses lzo if the hardware becomes unavailable
1349 select LZO_COMPRESS
1350 select LZO_DECOMPRESS
1351 help
1352 This is the 842 algorithm.
1353
1354config CRYPTO_LZ4
1355 tristate "LZ4 compression algorithm"
1356 select CRYPTO_ALGAPI
1357 select LZ4_COMPRESS
1358 select LZ4_DECOMPRESS
1359 help
1360 This is the LZ4 algorithm.
1361
1362config CRYPTO_LZ4HC
1363 tristate "LZ4HC compression algorithm"
1364 select CRYPTO_ALGAPI
1365 select LZ4HC_COMPRESS
1366 select LZ4_DECOMPRESS
1367 help
1368 This is the LZ4 high compression mode algorithm.
1369
1370comment "Random Number Generation"
1371
1372config CRYPTO_ANSI_CPRNG
1373 tristate "Pseudo Random Number Generation for Cryptographic modules"
1374 default m
1375 select CRYPTO_AES
1376 select CRYPTO_RNG
1377 help
1378 This option enables the generic pseudo random number generator
1379 for cryptographic modules. Uses the Algorithm specified in
1380 ANSI X9.31 A.2.4. Note that this option must be enabled if
1381 CRYPTO_FIPS is selected
1382
1383config CRYPTO_USER_API
1384 tristate
1385
1386config CRYPTO_USER_API_HASH
1387 tristate "User-space interface for hash algorithms"
1388 depends on NET
1389 select CRYPTO_HASH
1390 select CRYPTO_USER_API
1391 help
1392 This option enables the user-spaces interface for hash
1393 algorithms.
1394
1395config CRYPTO_USER_API_SKCIPHER
1396 tristate "User-space interface for symmetric key cipher algorithms"
1397 depends on NET
1398 select CRYPTO_BLKCIPHER
1399 select CRYPTO_USER_API
1400 help
1401 This option enables the user-spaces interface for symmetric
1402 key cipher algorithms.
1403
1404config CRYPTO_HASH_INFO
1405 bool
1406
1407source "drivers/crypto/Kconfig"
1408source crypto/asymmetric_keys/Kconfig
1409
1410endif # if CRYPTO
1# SPDX-License-Identifier: GPL-2.0
2#
3# Generic algorithms support
4#
5config XOR_BLOCKS
6 tristate
7
8#
9# async_tx api: hardware offloaded memory transfer/transform support
10#
11source "crypto/async_tx/Kconfig"
12
13#
14# Cryptographic API Configuration
15#
16menuconfig CRYPTO
17 tristate "Cryptographic API"
18 select CRYPTO_LIB_UTILS
19 help
20 This option provides the core Cryptographic API.
21
22if CRYPTO
23
24menu "Crypto core or helper"
25
26config CRYPTO_FIPS
27 bool "FIPS 200 compliance"
28 depends on (CRYPTO_ANSI_CPRNG || CRYPTO_DRBG) && !CRYPTO_MANAGER_DISABLE_TESTS
29 depends on (MODULE_SIG || !MODULES)
30 help
31 This option enables the fips boot option which is
32 required if you want the system to operate in a FIPS 200
33 certification. You should say no unless you know what
34 this is.
35
36config CRYPTO_FIPS_NAME
37 string "FIPS Module Name"
38 default "Linux Kernel Cryptographic API"
39 depends on CRYPTO_FIPS
40 help
41 This option sets the FIPS Module name reported by the Crypto API via
42 the /proc/sys/crypto/fips_name file.
43
44config CRYPTO_FIPS_CUSTOM_VERSION
45 bool "Use Custom FIPS Module Version"
46 depends on CRYPTO_FIPS
47 default n
48
49config CRYPTO_FIPS_VERSION
50 string "FIPS Module Version"
51 default "(none)"
52 depends on CRYPTO_FIPS_CUSTOM_VERSION
53 help
54 This option provides the ability to override the FIPS Module Version.
55 By default the KERNELRELEASE value is used.
56
57config CRYPTO_ALGAPI
58 tristate
59 select CRYPTO_ALGAPI2
60 help
61 This option provides the API for cryptographic algorithms.
62
63config CRYPTO_ALGAPI2
64 tristate
65
66config CRYPTO_AEAD
67 tristate
68 select CRYPTO_AEAD2
69 select CRYPTO_ALGAPI
70
71config CRYPTO_AEAD2
72 tristate
73 select CRYPTO_ALGAPI2
74
75config CRYPTO_SIG
76 tristate
77 select CRYPTO_SIG2
78 select CRYPTO_ALGAPI
79
80config CRYPTO_SIG2
81 tristate
82 select CRYPTO_ALGAPI2
83
84config CRYPTO_SKCIPHER
85 tristate
86 select CRYPTO_SKCIPHER2
87 select CRYPTO_ALGAPI
88 select CRYPTO_ECB
89
90config CRYPTO_SKCIPHER2
91 tristate
92 select CRYPTO_ALGAPI2
93
94config CRYPTO_HASH
95 tristate
96 select CRYPTO_HASH2
97 select CRYPTO_ALGAPI
98
99config CRYPTO_HASH2
100 tristate
101 select CRYPTO_ALGAPI2
102
103config CRYPTO_RNG
104 tristate
105 select CRYPTO_RNG2
106 select CRYPTO_ALGAPI
107
108config CRYPTO_RNG2
109 tristate
110 select CRYPTO_ALGAPI2
111
112config CRYPTO_RNG_DEFAULT
113 tristate
114 select CRYPTO_DRBG_MENU
115
116config CRYPTO_AKCIPHER2
117 tristate
118 select CRYPTO_ALGAPI2
119
120config CRYPTO_AKCIPHER
121 tristate
122 select CRYPTO_AKCIPHER2
123 select CRYPTO_ALGAPI
124
125config CRYPTO_KPP2
126 tristate
127 select CRYPTO_ALGAPI2
128
129config CRYPTO_KPP
130 tristate
131 select CRYPTO_ALGAPI
132 select CRYPTO_KPP2
133
134config CRYPTO_ACOMP2
135 tristate
136 select CRYPTO_ALGAPI2
137 select SGL_ALLOC
138
139config CRYPTO_ACOMP
140 tristate
141 select CRYPTO_ALGAPI
142 select CRYPTO_ACOMP2
143
144config CRYPTO_MANAGER
145 tristate "Cryptographic algorithm manager"
146 select CRYPTO_MANAGER2
147 help
148 Create default cryptographic template instantiations such as
149 cbc(aes).
150
151config CRYPTO_MANAGER2
152 def_tristate CRYPTO_MANAGER || (CRYPTO_MANAGER!=n && CRYPTO_ALGAPI=y)
153 select CRYPTO_ACOMP2
154 select CRYPTO_AEAD2
155 select CRYPTO_AKCIPHER2
156 select CRYPTO_SIG2
157 select CRYPTO_HASH2
158 select CRYPTO_KPP2
159 select CRYPTO_RNG2
160 select CRYPTO_SKCIPHER2
161
162config CRYPTO_USER
163 tristate "Userspace cryptographic algorithm configuration"
164 depends on NET
165 select CRYPTO_MANAGER
166 help
167 Userspace configuration for cryptographic instantiations such as
168 cbc(aes).
169
170config CRYPTO_MANAGER_DISABLE_TESTS
171 bool "Disable run-time self tests"
172 default y
173 help
174 Disable run-time self tests that normally take place at
175 algorithm registration.
176
177config CRYPTO_MANAGER_EXTRA_TESTS
178 bool "Enable extra run-time crypto self tests"
179 depends on DEBUG_KERNEL && !CRYPTO_MANAGER_DISABLE_TESTS && CRYPTO_MANAGER
180 help
181 Enable extra run-time self tests of registered crypto algorithms,
182 including randomized fuzz tests.
183
184 This is intended for developer use only, as these tests take much
185 longer to run than the normal self tests.
186
187config CRYPTO_NULL
188 tristate "Null algorithms"
189 select CRYPTO_NULL2
190 help
191 These are 'Null' algorithms, used by IPsec, which do nothing.
192
193config CRYPTO_NULL2
194 tristate
195 select CRYPTO_ALGAPI2
196 select CRYPTO_SKCIPHER2
197 select CRYPTO_HASH2
198
199config CRYPTO_PCRYPT
200 tristate "Parallel crypto engine"
201 depends on SMP
202 select PADATA
203 select CRYPTO_MANAGER
204 select CRYPTO_AEAD
205 help
206 This converts an arbitrary crypto algorithm into a parallel
207 algorithm that executes in kernel threads.
208
209config CRYPTO_CRYPTD
210 tristate "Software async crypto daemon"
211 select CRYPTO_SKCIPHER
212 select CRYPTO_HASH
213 select CRYPTO_MANAGER
214 help
215 This is a generic software asynchronous crypto daemon that
216 converts an arbitrary synchronous software crypto algorithm
217 into an asynchronous algorithm that executes in a kernel thread.
218
219config CRYPTO_AUTHENC
220 tristate "Authenc support"
221 select CRYPTO_AEAD
222 select CRYPTO_SKCIPHER
223 select CRYPTO_MANAGER
224 select CRYPTO_HASH
225 select CRYPTO_NULL
226 help
227 Authenc: Combined mode wrapper for IPsec.
228
229 This is required for IPSec ESP (XFRM_ESP).
230
231config CRYPTO_TEST
232 tristate "Testing module"
233 depends on m || EXPERT
234 select CRYPTO_MANAGER
235 help
236 Quick & dirty crypto test module.
237
238config CRYPTO_SIMD
239 tristate
240 select CRYPTO_CRYPTD
241
242config CRYPTO_ENGINE
243 tristate
244
245endmenu
246
247menu "Public-key cryptography"
248
249config CRYPTO_RSA
250 tristate "RSA (Rivest-Shamir-Adleman)"
251 select CRYPTO_AKCIPHER
252 select CRYPTO_MANAGER
253 select MPILIB
254 select ASN1
255 help
256 RSA (Rivest-Shamir-Adleman) public key algorithm (RFC8017)
257
258config CRYPTO_DH
259 tristate "DH (Diffie-Hellman)"
260 select CRYPTO_KPP
261 select MPILIB
262 help
263 DH (Diffie-Hellman) key exchange algorithm
264
265config CRYPTO_DH_RFC7919_GROUPS
266 bool "RFC 7919 FFDHE groups"
267 depends on CRYPTO_DH
268 select CRYPTO_RNG_DEFAULT
269 help
270 FFDHE (Finite-Field-based Diffie-Hellman Ephemeral) groups
271 defined in RFC7919.
272
273 Support these finite-field groups in DH key exchanges:
274 - ffdhe2048, ffdhe3072, ffdhe4096, ffdhe6144, ffdhe8192
275
276 If unsure, say N.
277
278config CRYPTO_ECC
279 tristate
280 select CRYPTO_RNG_DEFAULT
281
282config CRYPTO_ECDH
283 tristate "ECDH (Elliptic Curve Diffie-Hellman)"
284 select CRYPTO_ECC
285 select CRYPTO_KPP
286 help
287 ECDH (Elliptic Curve Diffie-Hellman) key exchange algorithm
288 using curves P-192, P-256, and P-384 (FIPS 186)
289
290config CRYPTO_ECDSA
291 tristate "ECDSA (Elliptic Curve Digital Signature Algorithm)"
292 select CRYPTO_ECC
293 select CRYPTO_AKCIPHER
294 select ASN1
295 help
296 ECDSA (Elliptic Curve Digital Signature Algorithm) (FIPS 186,
297 ISO/IEC 14888-3)
298 using curves P-192, P-256, and P-384
299
300 Only signature verification is implemented.
301
302config CRYPTO_ECRDSA
303 tristate "EC-RDSA (Elliptic Curve Russian Digital Signature Algorithm)"
304 select CRYPTO_ECC
305 select CRYPTO_AKCIPHER
306 select CRYPTO_STREEBOG
307 select OID_REGISTRY
308 select ASN1
309 help
310 Elliptic Curve Russian Digital Signature Algorithm (GOST R 34.10-2012,
311 RFC 7091, ISO/IEC 14888-3)
312
313 One of the Russian cryptographic standard algorithms (called GOST
314 algorithms). Only signature verification is implemented.
315
316config CRYPTO_SM2
317 tristate "SM2 (ShangMi 2)"
318 select CRYPTO_SM3
319 select CRYPTO_AKCIPHER
320 select CRYPTO_MANAGER
321 select MPILIB
322 select ASN1
323 help
324 SM2 (ShangMi 2) public key algorithm
325
326 Published by State Encryption Management Bureau, China,
327 as specified by OSCCA GM/T 0003.1-2012 -- 0003.5-2012.
328
329 References:
330 https://datatracker.ietf.org/doc/draft-shen-sm2-ecdsa/
331 http://www.oscca.gov.cn/sca/xxgk/2010-12/17/content_1002386.shtml
332 http://www.gmbz.org.cn/main/bzlb.html
333
334config CRYPTO_CURVE25519
335 tristate "Curve25519"
336 select CRYPTO_KPP
337 select CRYPTO_LIB_CURVE25519_GENERIC
338 help
339 Curve25519 elliptic curve (RFC7748)
340
341endmenu
342
343menu "Block ciphers"
344
345config CRYPTO_AES
346 tristate "AES (Advanced Encryption Standard)"
347 select CRYPTO_ALGAPI
348 select CRYPTO_LIB_AES
349 help
350 AES cipher algorithms (Rijndael)(FIPS-197, ISO/IEC 18033-3)
351
352 Rijndael appears to be consistently a very good performer in
353 both hardware and software across a wide range of computing
354 environments regardless of its use in feedback or non-feedback
355 modes. Its key setup time is excellent, and its key agility is
356 good. Rijndael's very low memory requirements make it very well
357 suited for restricted-space environments, in which it also
358 demonstrates excellent performance. Rijndael's operations are
359 among the easiest to defend against power and timing attacks.
360
361 The AES specifies three key sizes: 128, 192 and 256 bits
362
363config CRYPTO_AES_TI
364 tristate "AES (Advanced Encryption Standard) (fixed time)"
365 select CRYPTO_ALGAPI
366 select CRYPTO_LIB_AES
367 help
368 AES cipher algorithms (Rijndael)(FIPS-197, ISO/IEC 18033-3)
369
370 This is a generic implementation of AES that attempts to eliminate
371 data dependent latencies as much as possible without affecting
372 performance too much. It is intended for use by the generic CCM
373 and GCM drivers, and other CTR or CMAC/XCBC based modes that rely
374 solely on encryption (although decryption is supported as well, but
375 with a more dramatic performance hit)
376
377 Instead of using 16 lookup tables of 1 KB each, (8 for encryption and
378 8 for decryption), this implementation only uses just two S-boxes of
379 256 bytes each, and attempts to eliminate data dependent latencies by
380 prefetching the entire table into the cache at the start of each
381 block. Interrupts are also disabled to avoid races where cachelines
382 are evicted when the CPU is interrupted to do something else.
383
384config CRYPTO_ANUBIS
385 tristate "Anubis"
386 depends on CRYPTO_USER_API_ENABLE_OBSOLETE
387 select CRYPTO_ALGAPI
388 help
389 Anubis cipher algorithm
390
391 Anubis is a variable key length cipher which can use keys from
392 128 bits to 320 bits in length. It was evaluated as a entrant
393 in the NESSIE competition.
394
395 See https://web.archive.org/web/20160606112246/http://www.larc.usp.br/~pbarreto/AnubisPage.html
396 for further information.
397
398config CRYPTO_ARIA
399 tristate "ARIA"
400 select CRYPTO_ALGAPI
401 help
402 ARIA cipher algorithm (RFC5794)
403
404 ARIA is a standard encryption algorithm of the Republic of Korea.
405 The ARIA specifies three key sizes and rounds.
406 128-bit: 12 rounds.
407 192-bit: 14 rounds.
408 256-bit: 16 rounds.
409
410 See:
411 https://seed.kisa.or.kr/kisa/algorithm/EgovAriaInfo.do
412
413config CRYPTO_BLOWFISH
414 tristate "Blowfish"
415 select CRYPTO_ALGAPI
416 select CRYPTO_BLOWFISH_COMMON
417 help
418 Blowfish cipher algorithm, by Bruce Schneier
419
420 This is a variable key length cipher which can use keys from 32
421 bits to 448 bits in length. It's fast, simple and specifically
422 designed for use on "large microprocessors".
423
424 See https://www.schneier.com/blowfish.html for further information.
425
426config CRYPTO_BLOWFISH_COMMON
427 tristate
428 help
429 Common parts of the Blowfish cipher algorithm shared by the
430 generic c and the assembler implementations.
431
432config CRYPTO_CAMELLIA
433 tristate "Camellia"
434 select CRYPTO_ALGAPI
435 help
436 Camellia cipher algorithms (ISO/IEC 18033-3)
437
438 Camellia is a symmetric key block cipher developed jointly
439 at NTT and Mitsubishi Electric Corporation.
440
441 The Camellia specifies three key sizes: 128, 192 and 256 bits.
442
443 See https://info.isl.ntt.co.jp/crypt/eng/camellia/ for further information.
444
445config CRYPTO_CAST_COMMON
446 tristate
447 help
448 Common parts of the CAST cipher algorithms shared by the
449 generic c and the assembler implementations.
450
451config CRYPTO_CAST5
452 tristate "CAST5 (CAST-128)"
453 select CRYPTO_ALGAPI
454 select CRYPTO_CAST_COMMON
455 help
456 CAST5 (CAST-128) cipher algorithm (RFC2144, ISO/IEC 18033-3)
457
458config CRYPTO_CAST6
459 tristate "CAST6 (CAST-256)"
460 select CRYPTO_ALGAPI
461 select CRYPTO_CAST_COMMON
462 help
463 CAST6 (CAST-256) encryption algorithm (RFC2612)
464
465config CRYPTO_DES
466 tristate "DES and Triple DES EDE"
467 select CRYPTO_ALGAPI
468 select CRYPTO_LIB_DES
469 help
470 DES (Data Encryption Standard)(FIPS 46-2, ISO/IEC 18033-3) and
471 Triple DES EDE (Encrypt/Decrypt/Encrypt) (FIPS 46-3, ISO/IEC 18033-3)
472 cipher algorithms
473
474config CRYPTO_FCRYPT
475 tristate "FCrypt"
476 select CRYPTO_ALGAPI
477 select CRYPTO_SKCIPHER
478 help
479 FCrypt algorithm used by RxRPC
480
481 See https://ota.polyonymo.us/fcrypt-paper.txt
482
483config CRYPTO_KHAZAD
484 tristate "Khazad"
485 depends on CRYPTO_USER_API_ENABLE_OBSOLETE
486 select CRYPTO_ALGAPI
487 help
488 Khazad cipher algorithm
489
490 Khazad was a finalist in the initial NESSIE competition. It is
491 an algorithm optimized for 64-bit processors with good performance
492 on 32-bit processors. Khazad uses an 128 bit key size.
493
494 See https://web.archive.org/web/20171011071731/http://www.larc.usp.br/~pbarreto/KhazadPage.html
495 for further information.
496
497config CRYPTO_SEED
498 tristate "SEED"
499 depends on CRYPTO_USER_API_ENABLE_OBSOLETE
500 select CRYPTO_ALGAPI
501 help
502 SEED cipher algorithm (RFC4269, ISO/IEC 18033-3)
503
504 SEED is a 128-bit symmetric key block cipher that has been
505 developed by KISA (Korea Information Security Agency) as a
506 national standard encryption algorithm of the Republic of Korea.
507 It is a 16 round block cipher with the key size of 128 bit.
508
509 See https://seed.kisa.or.kr/kisa/algorithm/EgovSeedInfo.do
510 for further information.
511
512config CRYPTO_SERPENT
513 tristate "Serpent"
514 select CRYPTO_ALGAPI
515 help
516 Serpent cipher algorithm, by Anderson, Biham & Knudsen
517
518 Keys are allowed to be from 0 to 256 bits in length, in steps
519 of 8 bits.
520
521 See https://www.cl.cam.ac.uk/~rja14/serpent.html for further information.
522
523config CRYPTO_SM4
524 tristate
525
526config CRYPTO_SM4_GENERIC
527 tristate "SM4 (ShangMi 4)"
528 select CRYPTO_ALGAPI
529 select CRYPTO_SM4
530 help
531 SM4 cipher algorithms (OSCCA GB/T 32907-2016,
532 ISO/IEC 18033-3:2010/Amd 1:2021)
533
534 SM4 (GBT.32907-2016) is a cryptographic standard issued by the
535 Organization of State Commercial Administration of China (OSCCA)
536 as an authorized cryptographic algorithms for the use within China.
537
538 SMS4 was originally created for use in protecting wireless
539 networks, and is mandated in the Chinese National Standard for
540 Wireless LAN WAPI (Wired Authentication and Privacy Infrastructure)
541 (GB.15629.11-2003).
542
543 The latest SM4 standard (GBT.32907-2016) was proposed by OSCCA and
544 standardized through TC 260 of the Standardization Administration
545 of the People's Republic of China (SAC).
546
547 The input, output, and key of SMS4 are each 128 bits.
548
549 See https://eprint.iacr.org/2008/329.pdf for further information.
550
551 If unsure, say N.
552
553config CRYPTO_TEA
554 tristate "TEA, XTEA and XETA"
555 depends on CRYPTO_USER_API_ENABLE_OBSOLETE
556 select CRYPTO_ALGAPI
557 help
558 TEA (Tiny Encryption Algorithm) cipher algorithms
559
560 Tiny Encryption Algorithm is a simple cipher that uses
561 many rounds for security. It is very fast and uses
562 little memory.
563
564 Xtendend Tiny Encryption Algorithm is a modification to
565 the TEA algorithm to address a potential key weakness
566 in the TEA algorithm.
567
568 Xtendend Encryption Tiny Algorithm is a mis-implementation
569 of the XTEA algorithm for compatibility purposes.
570
571config CRYPTO_TWOFISH
572 tristate "Twofish"
573 select CRYPTO_ALGAPI
574 select CRYPTO_TWOFISH_COMMON
575 help
576 Twofish cipher algorithm
577
578 Twofish was submitted as an AES (Advanced Encryption Standard)
579 candidate cipher by researchers at CounterPane Systems. It is a
580 16 round block cipher supporting key sizes of 128, 192, and 256
581 bits.
582
583 See https://www.schneier.com/twofish.html for further information.
584
585config CRYPTO_TWOFISH_COMMON
586 tristate
587 help
588 Common parts of the Twofish cipher algorithm shared by the
589 generic c and the assembler implementations.
590
591endmenu
592
593menu "Length-preserving ciphers and modes"
594
595config CRYPTO_ADIANTUM
596 tristate "Adiantum"
597 select CRYPTO_CHACHA20
598 select CRYPTO_LIB_POLY1305_GENERIC
599 select CRYPTO_NHPOLY1305
600 select CRYPTO_MANAGER
601 help
602 Adiantum tweakable, length-preserving encryption mode
603
604 Designed for fast and secure disk encryption, especially on
605 CPUs without dedicated crypto instructions. It encrypts
606 each sector using the XChaCha12 stream cipher, two passes of
607 an ε-almost-∆-universal hash function, and an invocation of
608 the AES-256 block cipher on a single 16-byte block. On CPUs
609 without AES instructions, Adiantum is much faster than
610 AES-XTS.
611
612 Adiantum's security is provably reducible to that of its
613 underlying stream and block ciphers, subject to a security
614 bound. Unlike XTS, Adiantum is a true wide-block encryption
615 mode, so it actually provides an even stronger notion of
616 security than XTS, subject to the security bound.
617
618 If unsure, say N.
619
620config CRYPTO_ARC4
621 tristate "ARC4 (Alleged Rivest Cipher 4)"
622 depends on CRYPTO_USER_API_ENABLE_OBSOLETE
623 select CRYPTO_SKCIPHER
624 select CRYPTO_LIB_ARC4
625 help
626 ARC4 cipher algorithm
627
628 ARC4 is a stream cipher using keys ranging from 8 bits to 2048
629 bits in length. This algorithm is required for driver-based
630 WEP, but it should not be for other purposes because of the
631 weakness of the algorithm.
632
633config CRYPTO_CHACHA20
634 tristate "ChaCha"
635 select CRYPTO_LIB_CHACHA_GENERIC
636 select CRYPTO_SKCIPHER
637 help
638 The ChaCha20, XChaCha20, and XChaCha12 stream cipher algorithms
639
640 ChaCha20 is a 256-bit high-speed stream cipher designed by Daniel J.
641 Bernstein and further specified in RFC7539 for use in IETF protocols.
642 This is the portable C implementation of ChaCha20. See
643 https://cr.yp.to/chacha/chacha-20080128.pdf for further information.
644
645 XChaCha20 is the application of the XSalsa20 construction to ChaCha20
646 rather than to Salsa20. XChaCha20 extends ChaCha20's nonce length
647 from 64 bits (or 96 bits using the RFC7539 convention) to 192 bits,
648 while provably retaining ChaCha20's security. See
649 https://cr.yp.to/snuffle/xsalsa-20081128.pdf for further information.
650
651 XChaCha12 is XChaCha20 reduced to 12 rounds, with correspondingly
652 reduced security margin but increased performance. It can be needed
653 in some performance-sensitive scenarios.
654
655config CRYPTO_CBC
656 tristate "CBC (Cipher Block Chaining)"
657 select CRYPTO_SKCIPHER
658 select CRYPTO_MANAGER
659 help
660 CBC (Cipher Block Chaining) mode (NIST SP800-38A)
661
662 This block cipher mode is required for IPSec ESP (XFRM_ESP).
663
664config CRYPTO_CTR
665 tristate "CTR (Counter)"
666 select CRYPTO_SKCIPHER
667 select CRYPTO_MANAGER
668 help
669 CTR (Counter) mode (NIST SP800-38A)
670
671config CRYPTO_CTS
672 tristate "CTS (Cipher Text Stealing)"
673 select CRYPTO_SKCIPHER
674 select CRYPTO_MANAGER
675 help
676 CBC-CS3 variant of CTS (Cipher Text Stealing) (NIST
677 Addendum to SP800-38A (October 2010))
678
679 This mode is required for Kerberos gss mechanism support
680 for AES encryption.
681
682config CRYPTO_ECB
683 tristate "ECB (Electronic Codebook)"
684 select CRYPTO_SKCIPHER2
685 select CRYPTO_MANAGER
686 help
687 ECB (Electronic Codebook) mode (NIST SP800-38A)
688
689config CRYPTO_HCTR2
690 tristate "HCTR2"
691 select CRYPTO_XCTR
692 select CRYPTO_POLYVAL
693 select CRYPTO_MANAGER
694 help
695 HCTR2 length-preserving encryption mode
696
697 A mode for storage encryption that is efficient on processors with
698 instructions to accelerate AES and carryless multiplication, e.g.
699 x86 processors with AES-NI and CLMUL, and ARM processors with the
700 ARMv8 crypto extensions.
701
702 See https://eprint.iacr.org/2021/1441
703
704config CRYPTO_KEYWRAP
705 tristate "KW (AES Key Wrap)"
706 select CRYPTO_SKCIPHER
707 select CRYPTO_MANAGER
708 help
709 KW (AES Key Wrap) authenticated encryption mode (NIST SP800-38F
710 and RFC3394) without padding.
711
712config CRYPTO_LRW
713 tristate "LRW (Liskov Rivest Wagner)"
714 select CRYPTO_LIB_GF128MUL
715 select CRYPTO_SKCIPHER
716 select CRYPTO_MANAGER
717 select CRYPTO_ECB
718 help
719 LRW (Liskov Rivest Wagner) mode
720
721 A tweakable, non malleable, non movable
722 narrow block cipher mode for dm-crypt. Use it with cipher
723 specification string aes-lrw-benbi, the key must be 256, 320 or 384.
724 The first 128, 192 or 256 bits in the key are used for AES and the
725 rest is used to tie each cipher block to its logical position.
726
727 See https://people.csail.mit.edu/rivest/pubs/LRW02.pdf
728
729config CRYPTO_PCBC
730 tristate "PCBC (Propagating Cipher Block Chaining)"
731 select CRYPTO_SKCIPHER
732 select CRYPTO_MANAGER
733 help
734 PCBC (Propagating Cipher Block Chaining) mode
735
736 This block cipher mode is required for RxRPC.
737
738config CRYPTO_XCTR
739 tristate
740 select CRYPTO_SKCIPHER
741 select CRYPTO_MANAGER
742 help
743 XCTR (XOR Counter) mode for HCTR2
744
745 This blockcipher mode is a variant of CTR mode using XORs and little-endian
746 addition rather than big-endian arithmetic.
747
748 XCTR mode is used to implement HCTR2.
749
750config CRYPTO_XTS
751 tristate "XTS (XOR Encrypt XOR with ciphertext stealing)"
752 select CRYPTO_SKCIPHER
753 select CRYPTO_MANAGER
754 select CRYPTO_ECB
755 help
756 XTS (XOR Encrypt XOR with ciphertext stealing) mode (NIST SP800-38E
757 and IEEE 1619)
758
759 Use with aes-xts-plain, key size 256, 384 or 512 bits. This
760 implementation currently can't handle a sectorsize which is not a
761 multiple of 16 bytes.
762
763config CRYPTO_NHPOLY1305
764 tristate
765 select CRYPTO_HASH
766 select CRYPTO_LIB_POLY1305_GENERIC
767
768endmenu
769
770menu "AEAD (authenticated encryption with associated data) ciphers"
771
772config CRYPTO_AEGIS128
773 tristate "AEGIS-128"
774 select CRYPTO_AEAD
775 select CRYPTO_AES # for AES S-box tables
776 help
777 AEGIS-128 AEAD algorithm
778
779config CRYPTO_AEGIS128_SIMD
780 bool "AEGIS-128 (arm NEON, arm64 NEON)"
781 depends on CRYPTO_AEGIS128 && ((ARM || ARM64) && KERNEL_MODE_NEON)
782 default y
783 help
784 AEGIS-128 AEAD algorithm
785
786 Architecture: arm or arm64 using:
787 - NEON (Advanced SIMD) extension
788
789config CRYPTO_CHACHA20POLY1305
790 tristate "ChaCha20-Poly1305"
791 select CRYPTO_CHACHA20
792 select CRYPTO_POLY1305
793 select CRYPTO_AEAD
794 select CRYPTO_MANAGER
795 help
796 ChaCha20 stream cipher and Poly1305 authenticator combined
797 mode (RFC8439)
798
799config CRYPTO_CCM
800 tristate "CCM (Counter with Cipher Block Chaining-MAC)"
801 select CRYPTO_CTR
802 select CRYPTO_HASH
803 select CRYPTO_AEAD
804 select CRYPTO_MANAGER
805 help
806 CCM (Counter with Cipher Block Chaining-Message Authentication Code)
807 authenticated encryption mode (NIST SP800-38C)
808
809config CRYPTO_GCM
810 tristate "GCM (Galois/Counter Mode) and GMAC (GCM MAC)"
811 select CRYPTO_CTR
812 select CRYPTO_AEAD
813 select CRYPTO_GHASH
814 select CRYPTO_NULL
815 select CRYPTO_MANAGER
816 help
817 GCM (Galois/Counter Mode) authenticated encryption mode and GMAC
818 (GCM Message Authentication Code) (NIST SP800-38D)
819
820 This is required for IPSec ESP (XFRM_ESP).
821
822config CRYPTO_GENIV
823 tristate
824 select CRYPTO_AEAD
825 select CRYPTO_NULL
826 select CRYPTO_MANAGER
827 select CRYPTO_RNG_DEFAULT
828
829config CRYPTO_SEQIV
830 tristate "Sequence Number IV Generator"
831 select CRYPTO_GENIV
832 help
833 Sequence Number IV generator
834
835 This IV generator generates an IV based on a sequence number by
836 xoring it with a salt. This algorithm is mainly useful for CTR.
837
838 This is required for IPsec ESP (XFRM_ESP).
839
840config CRYPTO_ECHAINIV
841 tristate "Encrypted Chain IV Generator"
842 select CRYPTO_GENIV
843 help
844 Encrypted Chain IV generator
845
846 This IV generator generates an IV based on the encryption of
847 a sequence number xored with a salt. This is the default
848 algorithm for CBC.
849
850config CRYPTO_ESSIV
851 tristate "Encrypted Salt-Sector IV Generator"
852 select CRYPTO_AUTHENC
853 help
854 Encrypted Salt-Sector IV generator
855
856 This IV generator is used in some cases by fscrypt and/or
857 dm-crypt. It uses the hash of the block encryption key as the
858 symmetric key for a block encryption pass applied to the input
859 IV, making low entropy IV sources more suitable for block
860 encryption.
861
862 This driver implements a crypto API template that can be
863 instantiated either as an skcipher or as an AEAD (depending on the
864 type of the first template argument), and which defers encryption
865 and decryption requests to the encapsulated cipher after applying
866 ESSIV to the input IV. Note that in the AEAD case, it is assumed
867 that the keys are presented in the same format used by the authenc
868 template, and that the IV appears at the end of the authenticated
869 associated data (AAD) region (which is how dm-crypt uses it.)
870
871 Note that the use of ESSIV is not recommended for new deployments,
872 and so this only needs to be enabled when interoperability with
873 existing encrypted volumes of filesystems is required, or when
874 building for a particular system that requires it (e.g., when
875 the SoC in question has accelerated CBC but not XTS, making CBC
876 combined with ESSIV the only feasible mode for h/w accelerated
877 block encryption)
878
879endmenu
880
881menu "Hashes, digests, and MACs"
882
883config CRYPTO_BLAKE2B
884 tristate "BLAKE2b"
885 select CRYPTO_HASH
886 help
887 BLAKE2b cryptographic hash function (RFC 7693)
888
889 BLAKE2b is optimized for 64-bit platforms and can produce digests
890 of any size between 1 and 64 bytes. The keyed hash is also implemented.
891
892 This module provides the following algorithms:
893 - blake2b-160
894 - blake2b-256
895 - blake2b-384
896 - blake2b-512
897
898 Used by the btrfs filesystem.
899
900 See https://blake2.net for further information.
901
902config CRYPTO_CMAC
903 tristate "CMAC (Cipher-based MAC)"
904 select CRYPTO_HASH
905 select CRYPTO_MANAGER
906 help
907 CMAC (Cipher-based Message Authentication Code) authentication
908 mode (NIST SP800-38B and IETF RFC4493)
909
910config CRYPTO_GHASH
911 tristate "GHASH"
912 select CRYPTO_HASH
913 select CRYPTO_LIB_GF128MUL
914 help
915 GCM GHASH function (NIST SP800-38D)
916
917config CRYPTO_HMAC
918 tristate "HMAC (Keyed-Hash MAC)"
919 select CRYPTO_HASH
920 select CRYPTO_MANAGER
921 help
922 HMAC (Keyed-Hash Message Authentication Code) (FIPS 198 and
923 RFC2104)
924
925 This is required for IPsec AH (XFRM_AH) and IPsec ESP (XFRM_ESP).
926
927config CRYPTO_MD4
928 tristate "MD4"
929 select CRYPTO_HASH
930 help
931 MD4 message digest algorithm (RFC1320)
932
933config CRYPTO_MD5
934 tristate "MD5"
935 select CRYPTO_HASH
936 help
937 MD5 message digest algorithm (RFC1321)
938
939config CRYPTO_MICHAEL_MIC
940 tristate "Michael MIC"
941 select CRYPTO_HASH
942 help
943 Michael MIC (Message Integrity Code) (IEEE 802.11i)
944
945 Defined by the IEEE 802.11i TKIP (Temporal Key Integrity Protocol),
946 known as WPA (Wif-Fi Protected Access).
947
948 This algorithm is required for TKIP, but it should not be used for
949 other purposes because of the weakness of the algorithm.
950
951config CRYPTO_POLYVAL
952 tristate
953 select CRYPTO_HASH
954 select CRYPTO_LIB_GF128MUL
955 help
956 POLYVAL hash function for HCTR2
957
958 This is used in HCTR2. It is not a general-purpose
959 cryptographic hash function.
960
961config CRYPTO_POLY1305
962 tristate "Poly1305"
963 select CRYPTO_HASH
964 select CRYPTO_LIB_POLY1305_GENERIC
965 help
966 Poly1305 authenticator algorithm (RFC7539)
967
968 Poly1305 is an authenticator algorithm designed by Daniel J. Bernstein.
969 It is used for the ChaCha20-Poly1305 AEAD, specified in RFC7539 for use
970 in IETF protocols. This is the portable C implementation of Poly1305.
971
972config CRYPTO_RMD160
973 tristate "RIPEMD-160"
974 select CRYPTO_HASH
975 help
976 RIPEMD-160 hash function (ISO/IEC 10118-3)
977
978 RIPEMD-160 is a 160-bit cryptographic hash function. It is intended
979 to be used as a secure replacement for the 128-bit hash functions
980 MD4, MD5 and its predecessor RIPEMD
981 (not to be confused with RIPEMD-128).
982
983 Its speed is comparable to SHA-1 and there are no known attacks
984 against RIPEMD-160.
985
986 Developed by Hans Dobbertin, Antoon Bosselaers and Bart Preneel.
987 See https://homes.esat.kuleuven.be/~bosselae/ripemd160.html
988 for further information.
989
990config CRYPTO_SHA1
991 tristate "SHA-1"
992 select CRYPTO_HASH
993 select CRYPTO_LIB_SHA1
994 help
995 SHA-1 secure hash algorithm (FIPS 180, ISO/IEC 10118-3)
996
997config CRYPTO_SHA256
998 tristate "SHA-224 and SHA-256"
999 select CRYPTO_HASH
1000 select CRYPTO_LIB_SHA256
1001 help
1002 SHA-224 and SHA-256 secure hash algorithms (FIPS 180, ISO/IEC 10118-3)
1003
1004 This is required for IPsec AH (XFRM_AH) and IPsec ESP (XFRM_ESP).
1005 Used by the btrfs filesystem, Ceph, NFS, and SMB.
1006
1007config CRYPTO_SHA512
1008 tristate "SHA-384 and SHA-512"
1009 select CRYPTO_HASH
1010 help
1011 SHA-384 and SHA-512 secure hash algorithms (FIPS 180, ISO/IEC 10118-3)
1012
1013config CRYPTO_SHA3
1014 tristate "SHA-3"
1015 select CRYPTO_HASH
1016 help
1017 SHA-3 secure hash algorithms (FIPS 202, ISO/IEC 10118-3)
1018
1019config CRYPTO_SM3
1020 tristate
1021
1022config CRYPTO_SM3_GENERIC
1023 tristate "SM3 (ShangMi 3)"
1024 select CRYPTO_HASH
1025 select CRYPTO_SM3
1026 help
1027 SM3 (ShangMi 3) secure hash function (OSCCA GM/T 0004-2012, ISO/IEC 10118-3)
1028
1029 This is part of the Chinese Commercial Cryptography suite.
1030
1031 References:
1032 http://www.oscca.gov.cn/UpFile/20101222141857786.pdf
1033 https://datatracker.ietf.org/doc/html/draft-shen-sm3-hash
1034
1035config CRYPTO_STREEBOG
1036 tristate "Streebog"
1037 select CRYPTO_HASH
1038 help
1039 Streebog Hash Function (GOST R 34.11-2012, RFC 6986, ISO/IEC 10118-3)
1040
1041 This is one of the Russian cryptographic standard algorithms (called
1042 GOST algorithms). This setting enables two hash algorithms with
1043 256 and 512 bits output.
1044
1045 References:
1046 https://tc26.ru/upload/iblock/fed/feddbb4d26b685903faa2ba11aea43f6.pdf
1047 https://tools.ietf.org/html/rfc6986
1048
1049config CRYPTO_VMAC
1050 tristate "VMAC"
1051 select CRYPTO_HASH
1052 select CRYPTO_MANAGER
1053 help
1054 VMAC is a message authentication algorithm designed for
1055 very high speed on 64-bit architectures.
1056
1057 See https://fastcrypto.org/vmac for further information.
1058
1059config CRYPTO_WP512
1060 tristate "Whirlpool"
1061 select CRYPTO_HASH
1062 help
1063 Whirlpool hash function (ISO/IEC 10118-3)
1064
1065 512, 384 and 256-bit hashes.
1066
1067 Whirlpool-512 is part of the NESSIE cryptographic primitives.
1068
1069 See https://web.archive.org/web/20171129084214/http://www.larc.usp.br/~pbarreto/WhirlpoolPage.html
1070 for further information.
1071
1072config CRYPTO_XCBC
1073 tristate "XCBC-MAC (Extended Cipher Block Chaining MAC)"
1074 select CRYPTO_HASH
1075 select CRYPTO_MANAGER
1076 help
1077 XCBC-MAC (Extended Cipher Block Chaining Message Authentication
1078 Code) (RFC3566)
1079
1080config CRYPTO_XXHASH
1081 tristate "xxHash"
1082 select CRYPTO_HASH
1083 select XXHASH
1084 help
1085 xxHash non-cryptographic hash algorithm
1086
1087 Extremely fast, working at speeds close to RAM limits.
1088
1089 Used by the btrfs filesystem.
1090
1091endmenu
1092
1093menu "CRCs (cyclic redundancy checks)"
1094
1095config CRYPTO_CRC32C
1096 tristate "CRC32c"
1097 select CRYPTO_HASH
1098 select CRC32
1099 help
1100 CRC32c CRC algorithm with the iSCSI polynomial (RFC 3385 and RFC 3720)
1101
1102 A 32-bit CRC (cyclic redundancy check) with a polynomial defined
1103 by G. Castagnoli, S. Braeuer and M. Herrman in "Optimization of Cyclic
1104 Redundancy-Check Codes with 24 and 32 Parity Bits", IEEE Transactions
1105 on Communications, Vol. 41, No. 6, June 1993, selected for use with
1106 iSCSI.
1107
1108 Used by btrfs, ext4, jbd2, NVMeoF/TCP, and iSCSI.
1109
1110config CRYPTO_CRC32
1111 tristate "CRC32"
1112 select CRYPTO_HASH
1113 select CRC32
1114 help
1115 CRC32 CRC algorithm (IEEE 802.3)
1116
1117 Used by RoCEv2 and f2fs.
1118
1119config CRYPTO_CRCT10DIF
1120 tristate "CRCT10DIF"
1121 select CRYPTO_HASH
1122 help
1123 CRC16 CRC algorithm used for the T10 (SCSI) Data Integrity Field (DIF)
1124
1125 CRC algorithm used by the SCSI Block Commands standard.
1126
1127config CRYPTO_CRC64_ROCKSOFT
1128 tristate "CRC64 based on Rocksoft Model algorithm"
1129 depends on CRC64
1130 select CRYPTO_HASH
1131 help
1132 CRC64 CRC algorithm based on the Rocksoft Model CRC Algorithm
1133
1134 Used by the NVMe implementation of T10 DIF (BLK_DEV_INTEGRITY)
1135
1136 See https://zlib.net/crc_v3.txt
1137
1138endmenu
1139
1140menu "Compression"
1141
1142config CRYPTO_DEFLATE
1143 tristate "Deflate"
1144 select CRYPTO_ALGAPI
1145 select CRYPTO_ACOMP2
1146 select ZLIB_INFLATE
1147 select ZLIB_DEFLATE
1148 help
1149 Deflate compression algorithm (RFC1951)
1150
1151 Used by IPSec with the IPCOMP protocol (RFC3173, RFC2394)
1152
1153config CRYPTO_LZO
1154 tristate "LZO"
1155 select CRYPTO_ALGAPI
1156 select CRYPTO_ACOMP2
1157 select LZO_COMPRESS
1158 select LZO_DECOMPRESS
1159 help
1160 LZO compression algorithm
1161
1162 See https://www.oberhumer.com/opensource/lzo/ for further information.
1163
1164config CRYPTO_842
1165 tristate "842"
1166 select CRYPTO_ALGAPI
1167 select CRYPTO_ACOMP2
1168 select 842_COMPRESS
1169 select 842_DECOMPRESS
1170 help
1171 842 compression algorithm by IBM
1172
1173 See https://github.com/plauth/lib842 for further information.
1174
1175config CRYPTO_LZ4
1176 tristate "LZ4"
1177 select CRYPTO_ALGAPI
1178 select CRYPTO_ACOMP2
1179 select LZ4_COMPRESS
1180 select LZ4_DECOMPRESS
1181 help
1182 LZ4 compression algorithm
1183
1184 See https://github.com/lz4/lz4 for further information.
1185
1186config CRYPTO_LZ4HC
1187 tristate "LZ4HC"
1188 select CRYPTO_ALGAPI
1189 select CRYPTO_ACOMP2
1190 select LZ4HC_COMPRESS
1191 select LZ4_DECOMPRESS
1192 help
1193 LZ4 high compression mode algorithm
1194
1195 See https://github.com/lz4/lz4 for further information.
1196
1197config CRYPTO_ZSTD
1198 tristate "Zstd"
1199 select CRYPTO_ALGAPI
1200 select CRYPTO_ACOMP2
1201 select ZSTD_COMPRESS
1202 select ZSTD_DECOMPRESS
1203 help
1204 zstd compression algorithm
1205
1206 See https://github.com/facebook/zstd for further information.
1207
1208endmenu
1209
1210menu "Random number generation"
1211
1212config CRYPTO_ANSI_CPRNG
1213 tristate "ANSI PRNG (Pseudo Random Number Generator)"
1214 select CRYPTO_AES
1215 select CRYPTO_RNG
1216 help
1217 Pseudo RNG (random number generator) (ANSI X9.31 Appendix A.2.4)
1218
1219 This uses the AES cipher algorithm.
1220
1221 Note that this option must be enabled if CRYPTO_FIPS is selected
1222
1223menuconfig CRYPTO_DRBG_MENU
1224 tristate "NIST SP800-90A DRBG (Deterministic Random Bit Generator)"
1225 help
1226 DRBG (Deterministic Random Bit Generator) (NIST SP800-90A)
1227
1228 In the following submenu, one or more of the DRBG types must be selected.
1229
1230if CRYPTO_DRBG_MENU
1231
1232config CRYPTO_DRBG_HMAC
1233 bool
1234 default y
1235 select CRYPTO_HMAC
1236 select CRYPTO_SHA512
1237
1238config CRYPTO_DRBG_HASH
1239 bool "Hash_DRBG"
1240 select CRYPTO_SHA256
1241 help
1242 Hash_DRBG variant as defined in NIST SP800-90A.
1243
1244 This uses the SHA-1, SHA-256, SHA-384, or SHA-512 hash algorithms.
1245
1246config CRYPTO_DRBG_CTR
1247 bool "CTR_DRBG"
1248 select CRYPTO_AES
1249 select CRYPTO_CTR
1250 help
1251 CTR_DRBG variant as defined in NIST SP800-90A.
1252
1253 This uses the AES cipher algorithm with the counter block mode.
1254
1255config CRYPTO_DRBG
1256 tristate
1257 default CRYPTO_DRBG_MENU
1258 select CRYPTO_RNG
1259 select CRYPTO_JITTERENTROPY
1260
1261endif # if CRYPTO_DRBG_MENU
1262
1263config CRYPTO_JITTERENTROPY
1264 tristate "CPU Jitter Non-Deterministic RNG (Random Number Generator)"
1265 select CRYPTO_RNG
1266 select CRYPTO_SHA3
1267 help
1268 CPU Jitter RNG (Random Number Generator) from the Jitterentropy library
1269
1270 A non-physical non-deterministic ("true") RNG (e.g., an entropy source
1271 compliant with NIST SP800-90B) intended to provide a seed to a
1272 deterministic RNG (e.g. per NIST SP800-90C).
1273 This RNG does not perform any cryptographic whitening of the generated
1274
1275 See https://www.chronox.de/jent.html
1276
1277if CRYPTO_JITTERENTROPY
1278if CRYPTO_FIPS && EXPERT
1279
1280choice
1281 prompt "CPU Jitter RNG Memory Size"
1282 default CRYPTO_JITTERENTROPY_MEMSIZE_2
1283 help
1284 The Jitter RNG measures the execution time of memory accesses.
1285 Multiple consecutive memory accesses are performed. If the memory
1286 size fits into a cache (e.g. L1), only the memory access timing
1287 to that cache is measured. The closer the cache is to the CPU
1288 the less variations are measured and thus the less entropy is
1289 obtained. Thus, if the memory size fits into the L1 cache, the
1290 obtained entropy is less than if the memory size fits within
1291 L1 + L2, which in turn is less if the memory fits into
1292 L1 + L2 + L3. Thus, by selecting a different memory size,
1293 the entropy rate produced by the Jitter RNG can be modified.
1294
1295 config CRYPTO_JITTERENTROPY_MEMSIZE_2
1296 bool "2048 Bytes (default)"
1297
1298 config CRYPTO_JITTERENTROPY_MEMSIZE_128
1299 bool "128 kBytes"
1300
1301 config CRYPTO_JITTERENTROPY_MEMSIZE_1024
1302 bool "1024 kBytes"
1303
1304 config CRYPTO_JITTERENTROPY_MEMSIZE_8192
1305 bool "8192 kBytes"
1306endchoice
1307
1308config CRYPTO_JITTERENTROPY_MEMORY_BLOCKS
1309 int
1310 default 64 if CRYPTO_JITTERENTROPY_MEMSIZE_2
1311 default 512 if CRYPTO_JITTERENTROPY_MEMSIZE_128
1312 default 1024 if CRYPTO_JITTERENTROPY_MEMSIZE_1024
1313 default 4096 if CRYPTO_JITTERENTROPY_MEMSIZE_8192
1314
1315config CRYPTO_JITTERENTROPY_MEMORY_BLOCKSIZE
1316 int
1317 default 32 if CRYPTO_JITTERENTROPY_MEMSIZE_2
1318 default 256 if CRYPTO_JITTERENTROPY_MEMSIZE_128
1319 default 1024 if CRYPTO_JITTERENTROPY_MEMSIZE_1024
1320 default 2048 if CRYPTO_JITTERENTROPY_MEMSIZE_8192
1321
1322config CRYPTO_JITTERENTROPY_OSR
1323 int "CPU Jitter RNG Oversampling Rate"
1324 range 1 15
1325 default 1
1326 help
1327 The Jitter RNG allows the specification of an oversampling rate (OSR).
1328 The Jitter RNG operation requires a fixed amount of timing
1329 measurements to produce one output block of random numbers. The
1330 OSR value is multiplied with the amount of timing measurements to
1331 generate one output block. Thus, the timing measurement is oversampled
1332 by the OSR factor. The oversampling allows the Jitter RNG to operate
1333 on hardware whose timers deliver limited amount of entropy (e.g.
1334 the timer is coarse) by setting the OSR to a higher value. The
1335 trade-off, however, is that the Jitter RNG now requires more time
1336 to generate random numbers.
1337
1338config CRYPTO_JITTERENTROPY_TESTINTERFACE
1339 bool "CPU Jitter RNG Test Interface"
1340 help
1341 The test interface allows a privileged process to capture
1342 the raw unconditioned high resolution time stamp noise that
1343 is collected by the Jitter RNG for statistical analysis. As
1344 this data is used at the same time to generate random bits,
1345 the Jitter RNG operates in an insecure mode as long as the
1346 recording is enabled. This interface therefore is only
1347 intended for testing purposes and is not suitable for
1348 production systems.
1349
1350 The raw noise data can be obtained using the jent_raw_hires
1351 debugfs file. Using the option
1352 jitterentropy_testing.boot_raw_hires_test=1 the raw noise of
1353 the first 1000 entropy events since boot can be sampled.
1354
1355 If unsure, select N.
1356
1357endif # if CRYPTO_FIPS && EXPERT
1358
1359if !(CRYPTO_FIPS && EXPERT)
1360
1361config CRYPTO_JITTERENTROPY_MEMORY_BLOCKS
1362 int
1363 default 64
1364
1365config CRYPTO_JITTERENTROPY_MEMORY_BLOCKSIZE
1366 int
1367 default 32
1368
1369config CRYPTO_JITTERENTROPY_OSR
1370 int
1371 default 1
1372
1373config CRYPTO_JITTERENTROPY_TESTINTERFACE
1374 bool
1375
1376endif # if !(CRYPTO_FIPS && EXPERT)
1377endif # if CRYPTO_JITTERENTROPY
1378
1379config CRYPTO_KDF800108_CTR
1380 tristate
1381 select CRYPTO_HMAC
1382 select CRYPTO_SHA256
1383
1384endmenu
1385menu "Userspace interface"
1386
1387config CRYPTO_USER_API
1388 tristate
1389
1390config CRYPTO_USER_API_HASH
1391 tristate "Hash algorithms"
1392 depends on NET
1393 select CRYPTO_HASH
1394 select CRYPTO_USER_API
1395 help
1396 Enable the userspace interface for hash algorithms.
1397
1398 See Documentation/crypto/userspace-if.rst and
1399 https://www.chronox.de/libkcapi/html/index.html
1400
1401config CRYPTO_USER_API_SKCIPHER
1402 tristate "Symmetric key cipher algorithms"
1403 depends on NET
1404 select CRYPTO_SKCIPHER
1405 select CRYPTO_USER_API
1406 help
1407 Enable the userspace interface for symmetric key cipher algorithms.
1408
1409 See Documentation/crypto/userspace-if.rst and
1410 https://www.chronox.de/libkcapi/html/index.html
1411
1412config CRYPTO_USER_API_RNG
1413 tristate "RNG (random number generator) algorithms"
1414 depends on NET
1415 select CRYPTO_RNG
1416 select CRYPTO_USER_API
1417 help
1418 Enable the userspace interface for RNG (random number generator)
1419 algorithms.
1420
1421 See Documentation/crypto/userspace-if.rst and
1422 https://www.chronox.de/libkcapi/html/index.html
1423
1424config CRYPTO_USER_API_RNG_CAVP
1425 bool "Enable CAVP testing of DRBG"
1426 depends on CRYPTO_USER_API_RNG && CRYPTO_DRBG
1427 help
1428 Enable extra APIs in the userspace interface for NIST CAVP
1429 (Cryptographic Algorithm Validation Program) testing:
1430 - resetting DRBG entropy
1431 - providing Additional Data
1432
1433 This should only be enabled for CAVP testing. You should say
1434 no unless you know what this is.
1435
1436config CRYPTO_USER_API_AEAD
1437 tristate "AEAD cipher algorithms"
1438 depends on NET
1439 select CRYPTO_AEAD
1440 select CRYPTO_SKCIPHER
1441 select CRYPTO_NULL
1442 select CRYPTO_USER_API
1443 help
1444 Enable the userspace interface for AEAD cipher algorithms.
1445
1446 See Documentation/crypto/userspace-if.rst and
1447 https://www.chronox.de/libkcapi/html/index.html
1448
1449config CRYPTO_USER_API_ENABLE_OBSOLETE
1450 bool "Obsolete cryptographic algorithms"
1451 depends on CRYPTO_USER_API
1452 default y
1453 help
1454 Allow obsolete cryptographic algorithms to be selected that have
1455 already been phased out from internal use by the kernel, and are
1456 only useful for userspace clients that still rely on them.
1457
1458config CRYPTO_STATS
1459 bool "Crypto usage statistics"
1460 depends on CRYPTO_USER
1461 help
1462 Enable the gathering of crypto stats.
1463
1464 Enabling this option reduces the performance of the crypto API. It
1465 should only be enabled when there is actually a use case for it.
1466
1467 This collects data sizes, numbers of requests, and numbers
1468 of errors processed by:
1469 - AEAD ciphers (encrypt, decrypt)
1470 - asymmetric key ciphers (encrypt, decrypt, verify, sign)
1471 - symmetric key ciphers (encrypt, decrypt)
1472 - compression algorithms (compress, decompress)
1473 - hash algorithms (hash)
1474 - key-agreement protocol primitives (setsecret, generate
1475 public key, compute shared secret)
1476 - RNG (generate, seed)
1477
1478endmenu
1479
1480config CRYPTO_HASH_INFO
1481 bool
1482
1483if !KMSAN # avoid false positives from assembly
1484if ARM
1485source "arch/arm/crypto/Kconfig"
1486endif
1487if ARM64
1488source "arch/arm64/crypto/Kconfig"
1489endif
1490if LOONGARCH
1491source "arch/loongarch/crypto/Kconfig"
1492endif
1493if MIPS
1494source "arch/mips/crypto/Kconfig"
1495endif
1496if PPC
1497source "arch/powerpc/crypto/Kconfig"
1498endif
1499if S390
1500source "arch/s390/crypto/Kconfig"
1501endif
1502if SPARC
1503source "arch/sparc/crypto/Kconfig"
1504endif
1505if X86
1506source "arch/x86/crypto/Kconfig"
1507endif
1508endif
1509
1510source "drivers/crypto/Kconfig"
1511source "crypto/asymmetric_keys/Kconfig"
1512source "certs/Kconfig"
1513
1514endif # if CRYPTO