1# SPDX-License-Identifier: GPL-2.0
   2#
   3# Generic algorithms support
   4#
   5config XOR_BLOCKS
   6	tristate
   7
   8#
   9# async_tx api: hardware offloaded memory transfer/transform support
  10#
  11source "crypto/async_tx/Kconfig"
  12
  13#
  14# Cryptographic API Configuration
  15#
  16menuconfig CRYPTO
  17	tristate "Cryptographic API"
  18	help
  19	  This option provides the core Cryptographic API.
  20
  21if CRYPTO
  22
  23comment "Crypto core or helper"
  24
  25config CRYPTO_FIPS
  26	bool "FIPS 200 compliance"
  27	depends on (CRYPTO_ANSI_CPRNG || CRYPTO_DRBG) && !CRYPTO_MANAGER_DISABLE_TESTS
  28	depends on (MODULE_SIG || !MODULES)
  29	help
  30	  This options enables the fips boot option which is
  31	  required if you want to system to operate in a FIPS 200
  32	  certification.  You should say no unless you know what
  33	  this is.
  34
  35config CRYPTO_ALGAPI
  36	tristate
  37	select CRYPTO_ALGAPI2
  38	help
  39	  This option provides the API for cryptographic algorithms.
  40
  41config CRYPTO_ALGAPI2
  42	tristate
  43
  44config CRYPTO_AEAD
  45	tristate
  46	select CRYPTO_AEAD2
  47	select CRYPTO_ALGAPI
  48
  49config CRYPTO_AEAD2
  50	tristate
  51	select CRYPTO_ALGAPI2
  52	select CRYPTO_NULL2
  53	select CRYPTO_RNG2
  54
  55config CRYPTO_BLKCIPHER
  56	tristate
  57	select CRYPTO_BLKCIPHER2
  58	select CRYPTO_ALGAPI
  59
  60config CRYPTO_BLKCIPHER2
  61	tristate
  62	select CRYPTO_ALGAPI2
  63	select CRYPTO_RNG2
  64	select CRYPTO_WORKQUEUE
  65
  66config CRYPTO_HASH
  67	tristate
  68	select CRYPTO_HASH2
  69	select CRYPTO_ALGAPI
  70
  71config CRYPTO_HASH2
  72	tristate
  73	select CRYPTO_ALGAPI2
  74
  75config CRYPTO_RNG
  76	tristate
  77	select CRYPTO_RNG2
  78	select CRYPTO_ALGAPI
  79
  80config CRYPTO_RNG2
  81	tristate
  82	select CRYPTO_ALGAPI2
  83
  84config CRYPTO_RNG_DEFAULT
  85	tristate
  86	select CRYPTO_DRBG_MENU
  87
  88config CRYPTO_AKCIPHER2
  89	tristate
  90	select CRYPTO_ALGAPI2
  91
  92config CRYPTO_AKCIPHER
  93	tristate
  94	select CRYPTO_AKCIPHER2
  95	select CRYPTO_ALGAPI
  96
  97config CRYPTO_KPP2
  98	tristate
  99	select CRYPTO_ALGAPI2
 100
 101config CRYPTO_KPP
 102	tristate
 
 103	select CRYPTO_ALGAPI
 104	select CRYPTO_KPP2
 105
 106config CRYPTO_ACOMP2
 107	tristate
 108	select CRYPTO_ALGAPI2
 109	select SGL_ALLOC
 110
 111config CRYPTO_ACOMP
 112	tristate
 113	select CRYPTO_ALGAPI
 114	select CRYPTO_ACOMP2
 115
 116config CRYPTO_RSA
 117	tristate "RSA algorithm"
 118	select CRYPTO_AKCIPHER
 119	select CRYPTO_MANAGER
 120	select MPILIB
 121	select ASN1
 122	help
 123	  Generic implementation of the RSA public key algorithm.
 124
 125config CRYPTO_DH
 126	tristate "Diffie-Hellman algorithm"
 127	select CRYPTO_KPP
 128	select MPILIB
 129	help
 130	  Generic implementation of the Diffie-Hellman algorithm.
 131
 132config CRYPTO_ECDH
 133	tristate "ECDH algorithm"
 134	select CRYPTO_KPP
 135	select CRYPTO_RNG_DEFAULT
 136	help
 137	  Generic implementation of the ECDH algorithm
 138
 139config CRYPTO_MANAGER
 140	tristate "Cryptographic algorithm manager"
 141	select CRYPTO_MANAGER2
 142	help
 143	  Create default cryptographic template instantiations such as
 144	  cbc(aes).
 145
 146config CRYPTO_MANAGER2
 147	def_tristate CRYPTO_MANAGER || (CRYPTO_MANAGER!=n && CRYPTO_ALGAPI=y)
 148	select CRYPTO_AEAD2
 149	select CRYPTO_HASH2
 150	select CRYPTO_BLKCIPHER2
 151	select CRYPTO_AKCIPHER2
 152	select CRYPTO_KPP2
 153	select CRYPTO_ACOMP2
 154
 155config CRYPTO_USER
 156	tristate "Userspace cryptographic algorithm configuration"
 157	depends on NET
 158	select CRYPTO_MANAGER
 159	help
 160	  Userspace configuration for cryptographic instantiations such as
 161	  cbc(aes).
 162
 163config CRYPTO_MANAGER_DISABLE_TESTS
 164	bool "Disable run-time self tests"
 165	default y
 166	depends on CRYPTO_MANAGER2
 167	help
 168	  Disable run-time self tests that normally take place at
 169	  algorithm registration.
 170
 171config CRYPTO_GF128MUL
 172	tristate "GF(2^128) multiplication functions"
 173	help
 174	  Efficient table driven implementation of multiplications in the
 175	  field GF(2^128).  This is needed by some cypher modes. This
 176	  option will be selected automatically if you select such a
 177	  cipher mode.  Only select this option by hand if you expect to load
 178	  an external module that requires these functions.
 179
 180config CRYPTO_NULL
 181	tristate "Null algorithms"
 182	select CRYPTO_NULL2
 
 
 183	help
 184	  These are 'Null' algorithms, used by IPsec, which do nothing.
 185
 186config CRYPTO_NULL2
 187	tristate
 188	select CRYPTO_ALGAPI2
 189	select CRYPTO_BLKCIPHER2
 190	select CRYPTO_HASH2
 191
 192config CRYPTO_PCRYPT
 193	tristate "Parallel crypto engine"
 194	depends on SMP
 195	select PADATA
 196	select CRYPTO_MANAGER
 197	select CRYPTO_AEAD
 198	help
 199	  This converts an arbitrary crypto algorithm into a parallel
 200	  algorithm that executes in kernel threads.
 201
 202config CRYPTO_WORKQUEUE
 203       tristate
 204
 205config CRYPTO_CRYPTD
 206	tristate "Software async crypto daemon"
 207	select CRYPTO_BLKCIPHER
 208	select CRYPTO_HASH
 209	select CRYPTO_MANAGER
 210	select CRYPTO_WORKQUEUE
 211	help
 212	  This is a generic software asynchronous crypto daemon that
 213	  converts an arbitrary synchronous software crypto algorithm
 214	  into an asynchronous algorithm that executes in a kernel thread.
 215
 216config CRYPTO_MCRYPTD
 217	tristate "Software async multi-buffer crypto daemon"
 218	select CRYPTO_BLKCIPHER
 219	select CRYPTO_HASH
 220	select CRYPTO_MANAGER
 221	select CRYPTO_WORKQUEUE
 222	help
 223	  This is a generic software asynchronous crypto daemon that
 224	  provides the kernel thread to assist multi-buffer crypto
 225	  algorithms for submitting jobs and flushing jobs in multi-buffer
 226	  crypto algorithms.  Multi-buffer crypto algorithms are executed
 227	  in the context of this kernel thread and drivers can post
 228	  their crypto request asynchronously to be processed by this daemon.
 229
 230config CRYPTO_AUTHENC
 231	tristate "Authenc support"
 232	select CRYPTO_AEAD
 233	select CRYPTO_BLKCIPHER
 234	select CRYPTO_MANAGER
 235	select CRYPTO_HASH
 236	select CRYPTO_NULL
 237	help
 238	  Authenc: Combined mode wrapper for IPsec.
 239	  This is required for IPSec.
 240
 241config CRYPTO_TEST
 242	tristate "Testing module"
 243	depends on m
 244	select CRYPTO_MANAGER
 245	help
 246	  Quick & dirty crypto test module.
 247
 248config CRYPTO_SIMD
 249	tristate
 250	select CRYPTO_CRYPTD
 251
 252config CRYPTO_GLUE_HELPER_X86
 253	tristate
 254	depends on X86
 255	select CRYPTO_BLKCIPHER
 256
 257config CRYPTO_ENGINE
 258	tristate
 259
 260comment "Authenticated Encryption with Associated Data"
 261
 262config CRYPTO_CCM
 263	tristate "CCM support"
 264	select CRYPTO_CTR
 265	select CRYPTO_HASH
 266	select CRYPTO_AEAD
 267	help
 268	  Support for Counter with CBC MAC. Required for IPsec.
 269
 270config CRYPTO_GCM
 271	tristate "GCM/GMAC support"
 272	select CRYPTO_CTR
 273	select CRYPTO_AEAD
 274	select CRYPTO_GHASH
 275	select CRYPTO_NULL
 276	help
 277	  Support for Galois/Counter Mode (GCM) and Galois Message
 278	  Authentication Code (GMAC). Required for IPSec.
 279
 280config CRYPTO_CHACHA20POLY1305
 281	tristate "ChaCha20-Poly1305 AEAD support"
 282	select CRYPTO_CHACHA20
 283	select CRYPTO_POLY1305
 284	select CRYPTO_AEAD
 285	help
 286	  ChaCha20-Poly1305 AEAD support, RFC7539.
 287
 288	  Support for the AEAD wrapper using the ChaCha20 stream cipher combined
 289	  with the Poly1305 authenticator. It is defined in RFC7539 for use in
 290	  IETF protocols.
 291
 292config CRYPTO_SEQIV
 293	tristate "Sequence Number IV Generator"
 294	select CRYPTO_AEAD
 295	select CRYPTO_BLKCIPHER
 296	select CRYPTO_NULL
 297	select CRYPTO_RNG_DEFAULT
 298	help
 299	  This IV generator generates an IV based on a sequence number by
 300	  xoring it with a salt.  This algorithm is mainly useful for CTR
 301
 302config CRYPTO_ECHAINIV
 303	tristate "Encrypted Chain IV Generator"
 304	select CRYPTO_AEAD
 305	select CRYPTO_NULL
 306	select CRYPTO_RNG_DEFAULT
 307	default m
 308	help
 309	  This IV generator generates an IV based on the encryption of
 310	  a sequence number xored with a salt.  This is the default
 311	  algorithm for CBC.
 312
 313comment "Block modes"
 314
 315config CRYPTO_CBC
 316	tristate "CBC support"
 317	select CRYPTO_BLKCIPHER
 318	select CRYPTO_MANAGER
 319	help
 320	  CBC: Cipher Block Chaining mode
 321	  This block cipher algorithm is required for IPSec.
 322
 323config CRYPTO_CFB
 324	tristate "CFB support"
 325	select CRYPTO_BLKCIPHER
 326	select CRYPTO_MANAGER
 327	help
 328	  CFB: Cipher FeedBack mode
 329	  This block cipher algorithm is required for TPM2 Cryptography.
 330
 331config CRYPTO_CTR
 332	tristate "CTR support"
 333	select CRYPTO_BLKCIPHER
 334	select CRYPTO_SEQIV
 335	select CRYPTO_MANAGER
 336	help
 337	  CTR: Counter mode
 338	  This block cipher algorithm is required for IPSec.
 339
 340config CRYPTO_CTS
 341	tristate "CTS support"
 342	select CRYPTO_BLKCIPHER
 343	help
 344	  CTS: Cipher Text Stealing
 345	  This is the Cipher Text Stealing mode as described by
 346	  Section 8 of rfc2040 and referenced by rfc3962.
 347	  (rfc3962 includes errata information in its Appendix A)
 348	  This mode is required for Kerberos gss mechanism support
 349	  for AES encryption.
 350
 351config CRYPTO_ECB
 352	tristate "ECB support"
 353	select CRYPTO_BLKCIPHER
 354	select CRYPTO_MANAGER
 355	help
 356	  ECB: Electronic CodeBook mode
 357	  This is the simplest block cipher algorithm.  It simply encrypts
 358	  the input block by block.
 359
 360config CRYPTO_LRW
 361	tristate "LRW support"
 
 362	select CRYPTO_BLKCIPHER
 363	select CRYPTO_MANAGER
 364	select CRYPTO_GF128MUL
 365	help
 366	  LRW: Liskov Rivest Wagner, a tweakable, non malleable, non movable
 367	  narrow block cipher mode for dm-crypt.  Use it with cipher
 368	  specification string aes-lrw-benbi, the key must be 256, 320 or 384.
 369	  The first 128, 192 or 256 bits in the key are used for AES and the
 370	  rest is used to tie each cipher block to its logical position.
 371
 372config CRYPTO_PCBC
 373	tristate "PCBC support"
 374	select CRYPTO_BLKCIPHER
 375	select CRYPTO_MANAGER
 376	help
 377	  PCBC: Propagating Cipher Block Chaining mode
 378	  This block cipher algorithm is required for RxRPC.
 379
 380config CRYPTO_XTS
 381	tristate "XTS support"
 
 382	select CRYPTO_BLKCIPHER
 383	select CRYPTO_MANAGER
 384	select CRYPTO_ECB
 385	help
 386	  XTS: IEEE1619/D16 narrow block cipher use with aes-xts-plain,
 387	  key size 256, 384 or 512 bits. This implementation currently
 388	  can't handle a sectorsize which is not a multiple of 16 bytes.
 389
 390config CRYPTO_KEYWRAP
 391	tristate "Key wrapping support"
 392	select CRYPTO_BLKCIPHER
 393	help
 394	  Support for key wrapping (NIST SP800-38F / RFC3394) without
 395	  padding.
 396
 397comment "Hash modes"
 398
 399config CRYPTO_CMAC
 400	tristate "CMAC support"
 401	select CRYPTO_HASH
 402	select CRYPTO_MANAGER
 403	help
 404	  Cipher-based Message Authentication Code (CMAC) specified by
 405	  The National Institute of Standards and Technology (NIST).
 406
 407	  https://tools.ietf.org/html/rfc4493
 408	  http://csrc.nist.gov/publications/nistpubs/800-38B/SP_800-38B.pdf
 409
 410config CRYPTO_HMAC
 411	tristate "HMAC support"
 412	select CRYPTO_HASH
 413	select CRYPTO_MANAGER
 414	help
 415	  HMAC: Keyed-Hashing for Message Authentication (RFC2104).
 416	  This is required for IPSec.
 417
 418config CRYPTO_XCBC
 419	tristate "XCBC support"
 
 420	select CRYPTO_HASH
 421	select CRYPTO_MANAGER
 422	help
 423	  XCBC: Keyed-Hashing with encryption algorithm
 424		http://www.ietf.org/rfc/rfc3566.txt
 425		http://csrc.nist.gov/encryption/modes/proposedmodes/
 426		 xcbc-mac/xcbc-mac-spec.pdf
 427
 428config CRYPTO_VMAC
 429	tristate "VMAC support"
 
 430	select CRYPTO_HASH
 431	select CRYPTO_MANAGER
 432	help
 433	  VMAC is a message authentication algorithm designed for
 434	  very high speed on 64-bit architectures.
 435
 436	  See also:
 437	  <http://fastcrypto.org/vmac>
 438
 439comment "Digest"
 440
 441config CRYPTO_CRC32C
 442	tristate "CRC32c CRC algorithm"
 443	select CRYPTO_HASH
 444	select CRC32
 445	help
 446	  Castagnoli, et al Cyclic Redundancy-Check Algorithm.  Used
 447	  by iSCSI for header and data digests and by others.
 448	  See Castagnoli93.  Module will be crc32c.
 449
 450config CRYPTO_CRC32C_INTEL
 451	tristate "CRC32c INTEL hardware acceleration"
 452	depends on X86
 453	select CRYPTO_HASH
 454	help
 455	  In Intel processor with SSE4.2 supported, the processor will
 456	  support CRC32C implementation using hardware accelerated CRC32
 457	  instruction. This option will create 'crc32c-intel' module,
 458	  which will enable any routine to use the CRC32 instruction to
 459	  gain performance compared with software implementation.
 460	  Module will be crc32c-intel.
 461
 462config CRYPTO_CRC32C_VPMSUM
 463	tristate "CRC32c CRC algorithm (powerpc64)"
 464	depends on PPC64 && ALTIVEC
 465	select CRYPTO_HASH
 466	select CRC32
 467	help
 468	  CRC32c algorithm implemented using vector polynomial multiply-sum
 469	  (vpmsum) instructions, introduced in POWER8. Enable on POWER8
 470	  and newer processors for improved performance.
 471
 472
 473config CRYPTO_CRC32C_SPARC64
 474	tristate "CRC32c CRC algorithm (SPARC64)"
 475	depends on SPARC64
 476	select CRYPTO_HASH
 477	select CRC32
 478	help
 479	  CRC32c CRC algorithm implemented using sparc64 crypto instructions,
 480	  when available.
 481
 482config CRYPTO_CRC32
 483	tristate "CRC32 CRC algorithm"
 484	select CRYPTO_HASH
 485	select CRC32
 486	help
 487	  CRC-32-IEEE 802.3 cyclic redundancy-check algorithm.
 488	  Shash crypto api wrappers to crc32_le function.
 489
 490config CRYPTO_CRC32_PCLMUL
 491	tristate "CRC32 PCLMULQDQ hardware acceleration"
 492	depends on X86
 493	select CRYPTO_HASH
 494	select CRC32
 495	help
 496	  From Intel Westmere and AMD Bulldozer processor with SSE4.2
 497	  and PCLMULQDQ supported, the processor will support
 498	  CRC32 PCLMULQDQ implementation using hardware accelerated PCLMULQDQ
 499	  instruction. This option will create 'crc32-plcmul' module,
 500	  which will enable any routine to use the CRC-32-IEEE 802.3 checksum
 501	  and gain better performance as compared with the table implementation.
 502
 503config CRYPTO_CRC32_MIPS
 504	tristate "CRC32c and CRC32 CRC algorithm (MIPS)"
 505	depends on MIPS_CRC_SUPPORT
 506	select CRYPTO_HASH
 507	help
 508	  CRC32c and CRC32 CRC algorithms implemented using mips crypto
 509	  instructions, when available.
 510
 511
 512config CRYPTO_CRCT10DIF
 513	tristate "CRCT10DIF algorithm"
 514	select CRYPTO_HASH
 515	help
 516	  CRC T10 Data Integrity Field computation is being cast as
 517	  a crypto transform.  This allows for faster crc t10 diff
 518	  transforms to be used if they are available.
 519
 520config CRYPTO_CRCT10DIF_PCLMUL
 521	tristate "CRCT10DIF PCLMULQDQ hardware acceleration"
 522	depends on X86 && 64BIT && CRC_T10DIF
 523	select CRYPTO_HASH
 524	help
 525	  For x86_64 processors with SSE4.2 and PCLMULQDQ supported,
 526	  CRC T10 DIF PCLMULQDQ computation can be hardware
 527	  accelerated PCLMULQDQ instruction. This option will create
 528	  'crct10dif-plcmul' module, which is faster when computing the
 529	  crct10dif checksum as compared with the generic table implementation.
 530
 531config CRYPTO_CRCT10DIF_VPMSUM
 532	tristate "CRC32T10DIF powerpc64 hardware acceleration"
 533	depends on PPC64 && ALTIVEC && CRC_T10DIF
 534	select CRYPTO_HASH
 535	help
 536	  CRC10T10DIF algorithm implemented using vector polynomial
 537	  multiply-sum (vpmsum) instructions, introduced in POWER8. Enable on
 538	  POWER8 and newer processors for improved performance.
 539
 540config CRYPTO_VPMSUM_TESTER
 541	tristate "Powerpc64 vpmsum hardware acceleration tester"
 542	depends on CRYPTO_CRCT10DIF_VPMSUM && CRYPTO_CRC32C_VPMSUM
 543	help
 544	  Stress test for CRC32c and CRC-T10DIF algorithms implemented with
 545	  POWER8 vpmsum instructions.
 546	  Unless you are testing these algorithms, you don't need this.
 547
 548config CRYPTO_GHASH
 549	tristate "GHASH digest algorithm"
 
 550	select CRYPTO_GF128MUL
 551	select CRYPTO_HASH
 552	help
 553	  GHASH is message digest algorithm for GCM (Galois/Counter Mode).
 554
 555config CRYPTO_POLY1305
 556	tristate "Poly1305 authenticator algorithm"
 557	select CRYPTO_HASH
 558	help
 559	  Poly1305 authenticator algorithm, RFC7539.
 560
 561	  Poly1305 is an authenticator algorithm designed by Daniel J. Bernstein.
 562	  It is used for the ChaCha20-Poly1305 AEAD, specified in RFC7539 for use
 563	  in IETF protocols. This is the portable C implementation of Poly1305.
 564
 565config CRYPTO_POLY1305_X86_64
 566	tristate "Poly1305 authenticator algorithm (x86_64/SSE2/AVX2)"
 567	depends on X86 && 64BIT
 568	select CRYPTO_POLY1305
 569	help
 570	  Poly1305 authenticator algorithm, RFC7539.
 571
 572	  Poly1305 is an authenticator algorithm designed by Daniel J. Bernstein.
 573	  It is used for the ChaCha20-Poly1305 AEAD, specified in RFC7539 for use
 574	  in IETF protocols. This is the x86_64 assembler implementation using SIMD
 575	  instructions.
 576
 577config CRYPTO_MD4
 578	tristate "MD4 digest algorithm"
 579	select CRYPTO_HASH
 580	help
 581	  MD4 message digest algorithm (RFC1320).
 582
 583config CRYPTO_MD5
 584	tristate "MD5 digest algorithm"
 585	select CRYPTO_HASH
 586	help
 587	  MD5 message digest algorithm (RFC1321).
 588
 589config CRYPTO_MD5_OCTEON
 590	tristate "MD5 digest algorithm (OCTEON)"
 591	depends on CPU_CAVIUM_OCTEON
 592	select CRYPTO_MD5
 593	select CRYPTO_HASH
 594	help
 595	  MD5 message digest algorithm (RFC1321) implemented
 596	  using OCTEON crypto instructions, when available.
 597
 598config CRYPTO_MD5_PPC
 599	tristate "MD5 digest algorithm (PPC)"
 600	depends on PPC
 601	select CRYPTO_HASH
 602	help
 603	  MD5 message digest algorithm (RFC1321) implemented
 604	  in PPC assembler.
 605
 606config CRYPTO_MD5_SPARC64
 607	tristate "MD5 digest algorithm (SPARC64)"
 608	depends on SPARC64
 609	select CRYPTO_MD5
 610	select CRYPTO_HASH
 611	help
 612	  MD5 message digest algorithm (RFC1321) implemented
 613	  using sparc64 crypto instructions, when available.
 614
 615config CRYPTO_MICHAEL_MIC
 616	tristate "Michael MIC keyed digest algorithm"
 617	select CRYPTO_HASH
 618	help
 619	  Michael MIC is used for message integrity protection in TKIP
 620	  (IEEE 802.11i). This algorithm is required for TKIP, but it
 621	  should not be used for other purposes because of the weakness
 622	  of the algorithm.
 623
 624config CRYPTO_RMD128
 625	tristate "RIPEMD-128 digest algorithm"
 626	select CRYPTO_HASH
 627	help
 628	  RIPEMD-128 (ISO/IEC 10118-3:2004).
 629
 630	  RIPEMD-128 is a 128-bit cryptographic hash function. It should only
 631	  be used as a secure replacement for RIPEMD. For other use cases,
 632	  RIPEMD-160 should be used.
 633
 634	  Developed by Hans Dobbertin, Antoon Bosselaers and Bart Preneel.
 635	  See <http://homes.esat.kuleuven.be/~bosselae/ripemd160.html>
 636
 637config CRYPTO_RMD160
 638	tristate "RIPEMD-160 digest algorithm"
 639	select CRYPTO_HASH
 640	help
 641	  RIPEMD-160 (ISO/IEC 10118-3:2004).
 642
 643	  RIPEMD-160 is a 160-bit cryptographic hash function. It is intended
 644	  to be used as a secure replacement for the 128-bit hash functions
 645	  MD4, MD5 and it's predecessor RIPEMD
 646	  (not to be confused with RIPEMD-128).
 647
 648	  It's speed is comparable to SHA1 and there are no known attacks
 649	  against RIPEMD-160.
 650
 651	  Developed by Hans Dobbertin, Antoon Bosselaers and Bart Preneel.
 652	  See <http://homes.esat.kuleuven.be/~bosselae/ripemd160.html>
 653
 654config CRYPTO_RMD256
 655	tristate "RIPEMD-256 digest algorithm"
 656	select CRYPTO_HASH
 657	help
 658	  RIPEMD-256 is an optional extension of RIPEMD-128 with a
 659	  256 bit hash. It is intended for applications that require
 660	  longer hash-results, without needing a larger security level
 661	  (than RIPEMD-128).
 662
 663	  Developed by Hans Dobbertin, Antoon Bosselaers and Bart Preneel.
 664	  See <http://homes.esat.kuleuven.be/~bosselae/ripemd160.html>
 665
 666config CRYPTO_RMD320
 667	tristate "RIPEMD-320 digest algorithm"
 668	select CRYPTO_HASH
 669	help
 670	  RIPEMD-320 is an optional extension of RIPEMD-160 with a
 671	  320 bit hash. It is intended for applications that require
 672	  longer hash-results, without needing a larger security level
 673	  (than RIPEMD-160).
 674
 675	  Developed by Hans Dobbertin, Antoon Bosselaers and Bart Preneel.
 676	  See <http://homes.esat.kuleuven.be/~bosselae/ripemd160.html>
 677
 678config CRYPTO_SHA1
 679	tristate "SHA1 digest algorithm"
 680	select CRYPTO_HASH
 681	help
 682	  SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2).
 683
 684config CRYPTO_SHA1_SSSE3
 685	tristate "SHA1 digest algorithm (SSSE3/AVX/AVX2/SHA-NI)"
 686	depends on X86 && 64BIT
 687	select CRYPTO_SHA1
 688	select CRYPTO_HASH
 689	help
 690	  SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2) implemented
 691	  using Supplemental SSE3 (SSSE3) instructions or Advanced Vector
 692	  Extensions (AVX/AVX2) or SHA-NI(SHA Extensions New Instructions),
 693	  when available.
 694
 695config CRYPTO_SHA256_SSSE3
 696	tristate "SHA256 digest algorithm (SSSE3/AVX/AVX2/SHA-NI)"
 697	depends on X86 && 64BIT
 698	select CRYPTO_SHA256
 699	select CRYPTO_HASH
 700	help
 701	  SHA-256 secure hash standard (DFIPS 180-2) implemented
 702	  using Supplemental SSE3 (SSSE3) instructions, or Advanced Vector
 703	  Extensions version 1 (AVX1), or Advanced Vector Extensions
 704	  version 2 (AVX2) instructions, or SHA-NI (SHA Extensions New
 705	  Instructions) when available.
 706
 707config CRYPTO_SHA512_SSSE3
 708	tristate "SHA512 digest algorithm (SSSE3/AVX/AVX2)"
 709	depends on X86 && 64BIT
 710	select CRYPTO_SHA512
 711	select CRYPTO_HASH
 712	help
 713	  SHA-512 secure hash standard (DFIPS 180-2) implemented
 714	  using Supplemental SSE3 (SSSE3) instructions, or Advanced Vector
 715	  Extensions version 1 (AVX1), or Advanced Vector Extensions
 716	  version 2 (AVX2) instructions, when available.
 717
 718config CRYPTO_SHA1_OCTEON
 719	tristate "SHA1 digest algorithm (OCTEON)"
 720	depends on CPU_CAVIUM_OCTEON
 721	select CRYPTO_SHA1
 722	select CRYPTO_HASH
 723	help
 724	  SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2) implemented
 725	  using OCTEON crypto instructions, when available.
 726
 727config CRYPTO_SHA1_SPARC64
 728	tristate "SHA1 digest algorithm (SPARC64)"
 729	depends on SPARC64
 730	select CRYPTO_SHA1
 731	select CRYPTO_HASH
 732	help
 733	  SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2) implemented
 734	  using sparc64 crypto instructions, when available.
 735
 736config CRYPTO_SHA1_PPC
 737	tristate "SHA1 digest algorithm (powerpc)"
 738	depends on PPC
 739	help
 740	  This is the powerpc hardware accelerated implementation of the
 741	  SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2).
 742
 743config CRYPTO_SHA1_PPC_SPE
 744	tristate "SHA1 digest algorithm (PPC SPE)"
 745	depends on PPC && SPE
 746	help
 747	  SHA-1 secure hash standard (DFIPS 180-4) implemented
 748	  using powerpc SPE SIMD instruction set.
 749
 750config CRYPTO_SHA1_MB
 751	tristate "SHA1 digest algorithm (x86_64 Multi-Buffer, Experimental)"
 752	depends on X86 && 64BIT
 753	select CRYPTO_SHA1
 754	select CRYPTO_HASH
 755	select CRYPTO_MCRYPTD
 756	help
 757	  SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2) implemented
 758	  using multi-buffer technique.  This algorithm computes on
 759	  multiple data lanes concurrently with SIMD instructions for
 760	  better throughput.  It should not be enabled by default but
 761	  used when there is significant amount of work to keep the keep
 762	  the data lanes filled to get performance benefit.  If the data
 763	  lanes remain unfilled, a flush operation will be initiated to
 764	  process the crypto jobs, adding a slight latency.
 765
 766config CRYPTO_SHA256_MB
 767	tristate "SHA256 digest algorithm (x86_64 Multi-Buffer, Experimental)"
 768	depends on X86 && 64BIT
 769	select CRYPTO_SHA256
 770	select CRYPTO_HASH
 771	select CRYPTO_MCRYPTD
 772	help
 773	  SHA-256 secure hash standard (FIPS 180-1/DFIPS 180-2) implemented
 774	  using multi-buffer technique.  This algorithm computes on
 775	  multiple data lanes concurrently with SIMD instructions for
 776	  better throughput.  It should not be enabled by default but
 777	  used when there is significant amount of work to keep the keep
 778	  the data lanes filled to get performance benefit.  If the data
 779	  lanes remain unfilled, a flush operation will be initiated to
 780	  process the crypto jobs, adding a slight latency.
 781
 782config CRYPTO_SHA512_MB
 783        tristate "SHA512 digest algorithm (x86_64 Multi-Buffer, Experimental)"
 784        depends on X86 && 64BIT
 785        select CRYPTO_SHA512
 786        select CRYPTO_HASH
 787        select CRYPTO_MCRYPTD
 788        help
 789          SHA-512 secure hash standard (FIPS 180-1/DFIPS 180-2) implemented
 790          using multi-buffer technique.  This algorithm computes on
 791          multiple data lanes concurrently with SIMD instructions for
 792          better throughput.  It should not be enabled by default but
 793          used when there is significant amount of work to keep the keep
 794          the data lanes filled to get performance benefit.  If the data
 795          lanes remain unfilled, a flush operation will be initiated to
 796          process the crypto jobs, adding a slight latency.
 797
 798config CRYPTO_SHA256
 799	tristate "SHA224 and SHA256 digest algorithm"
 800	select CRYPTO_HASH
 801	help
 802	  SHA256 secure hash standard (DFIPS 180-2).
 803
 804	  This version of SHA implements a 256 bit hash with 128 bits of
 805	  security against collision attacks.
 806
 807	  This code also includes SHA-224, a 224 bit hash with 112 bits
 808	  of security against collision attacks.
 809
 810config CRYPTO_SHA256_PPC_SPE
 811	tristate "SHA224 and SHA256 digest algorithm (PPC SPE)"
 812	depends on PPC && SPE
 813	select CRYPTO_SHA256
 814	select CRYPTO_HASH
 815	help
 816	  SHA224 and SHA256 secure hash standard (DFIPS 180-2)
 817	  implemented using powerpc SPE SIMD instruction set.
 818
 819config CRYPTO_SHA256_OCTEON
 820	tristate "SHA224 and SHA256 digest algorithm (OCTEON)"
 821	depends on CPU_CAVIUM_OCTEON
 822	select CRYPTO_SHA256
 823	select CRYPTO_HASH
 824	help
 825	  SHA-256 secure hash standard (DFIPS 180-2) implemented
 826	  using OCTEON crypto instructions, when available.
 827
 828config CRYPTO_SHA256_SPARC64
 829	tristate "SHA224 and SHA256 digest algorithm (SPARC64)"
 830	depends on SPARC64
 831	select CRYPTO_SHA256
 832	select CRYPTO_HASH
 833	help
 834	  SHA-256 secure hash standard (DFIPS 180-2) implemented
 835	  using sparc64 crypto instructions, when available.
 836
 837config CRYPTO_SHA512
 838	tristate "SHA384 and SHA512 digest algorithms"
 839	select CRYPTO_HASH
 840	help
 841	  SHA512 secure hash standard (DFIPS 180-2).
 842
 843	  This version of SHA implements a 512 bit hash with 256 bits of
 844	  security against collision attacks.
 845
 846	  This code also includes SHA-384, a 384 bit hash with 192 bits
 847	  of security against collision attacks.
 848
 849config CRYPTO_SHA512_OCTEON
 850	tristate "SHA384 and SHA512 digest algorithms (OCTEON)"
 851	depends on CPU_CAVIUM_OCTEON
 852	select CRYPTO_SHA512
 853	select CRYPTO_HASH
 854	help
 855	  SHA-512 secure hash standard (DFIPS 180-2) implemented
 856	  using OCTEON crypto instructions, when available.
 857
 858config CRYPTO_SHA512_SPARC64
 859	tristate "SHA384 and SHA512 digest algorithm (SPARC64)"
 860	depends on SPARC64
 861	select CRYPTO_SHA512
 862	select CRYPTO_HASH
 863	help
 864	  SHA-512 secure hash standard (DFIPS 180-2) implemented
 865	  using sparc64 crypto instructions, when available.
 866
 867config CRYPTO_SHA3
 868	tristate "SHA3 digest algorithm"
 869	select CRYPTO_HASH
 870	help
 871	  SHA-3 secure hash standard (DFIPS 202). It's based on
 872	  cryptographic sponge function family called Keccak.
 873
 874	  References:
 875	  http://keccak.noekeon.org/
 876
 877config CRYPTO_SM3
 878	tristate "SM3 digest algorithm"
 879	select CRYPTO_HASH
 880	help
 881	  SM3 secure hash function as defined by OSCCA GM/T 0004-2012 SM3).
 882	  It is part of the Chinese Commercial Cryptography suite.
 883
 884	  References:
 885	  http://www.oscca.gov.cn/UpFile/20101222141857786.pdf
 886	  https://datatracker.ietf.org/doc/html/draft-shen-sm3-hash
 887
 888config CRYPTO_TGR192
 889	tristate "Tiger digest algorithms"
 890	select CRYPTO_HASH
 891	help
 892	  Tiger hash algorithm 192, 160 and 128-bit hashes
 893
 894	  Tiger is a hash function optimized for 64-bit processors while
 895	  still having decent performance on 32-bit processors.
 896	  Tiger was developed by Ross Anderson and Eli Biham.
 897
 898	  See also:
 899	  <http://www.cs.technion.ac.il/~biham/Reports/Tiger/>.
 900
 901config CRYPTO_WP512
 902	tristate "Whirlpool digest algorithms"
 903	select CRYPTO_HASH
 904	help
 905	  Whirlpool hash algorithm 512, 384 and 256-bit hashes
 906
 907	  Whirlpool-512 is part of the NESSIE cryptographic primitives.
 908	  Whirlpool will be part of the ISO/IEC 10118-3:2003(E) standard
 909
 910	  See also:
 911	  <http://www.larc.usp.br/~pbarreto/WhirlpoolPage.html>
 912
 913config CRYPTO_GHASH_CLMUL_NI_INTEL
 914	tristate "GHASH digest algorithm (CLMUL-NI accelerated)"
 915	depends on X86 && 64BIT
 
 916	select CRYPTO_CRYPTD
 917	help
 918	  GHASH is message digest algorithm for GCM (Galois/Counter Mode).
 919	  The implementation is accelerated by CLMUL-NI of Intel.
 920
 921comment "Ciphers"
 922
 923config CRYPTO_AES
 924	tristate "AES cipher algorithms"
 925	select CRYPTO_ALGAPI
 926	help
 927	  AES cipher algorithms (FIPS-197). AES uses the Rijndael
 928	  algorithm.
 929
 930	  Rijndael appears to be consistently a very good performer in
 931	  both hardware and software across a wide range of computing
 932	  environments regardless of its use in feedback or non-feedback
 933	  modes. Its key setup time is excellent, and its key agility is
 934	  good. Rijndael's very low memory requirements make it very well
 935	  suited for restricted-space environments, in which it also
 936	  demonstrates excellent performance. Rijndael's operations are
 937	  among the easiest to defend against power and timing attacks.
 938
 939	  The AES specifies three key sizes: 128, 192 and 256 bits
 940
 941	  See <http://csrc.nist.gov/CryptoToolkit/aes/> for more information.
 942
 943config CRYPTO_AES_TI
 944	tristate "Fixed time AES cipher"
 945	select CRYPTO_ALGAPI
 946	help
 947	  This is a generic implementation of AES that attempts to eliminate
 948	  data dependent latencies as much as possible without affecting
 949	  performance too much. It is intended for use by the generic CCM
 950	  and GCM drivers, and other CTR or CMAC/XCBC based modes that rely
 951	  solely on encryption (although decryption is supported as well, but
 952	  with a more dramatic performance hit)
 953
 954	  Instead of using 16 lookup tables of 1 KB each, (8 for encryption and
 955	  8 for decryption), this implementation only uses just two S-boxes of
 956	  256 bytes each, and attempts to eliminate data dependent latencies by
 957	  prefetching the entire table into the cache at the start of each
 958	  block.
 959
 960config CRYPTO_AES_586
 961	tristate "AES cipher algorithms (i586)"
 962	depends on (X86 || UML_X86) && !64BIT
 963	select CRYPTO_ALGAPI
 964	select CRYPTO_AES
 965	help
 966	  AES cipher algorithms (FIPS-197). AES uses the Rijndael
 967	  algorithm.
 968
 969	  Rijndael appears to be consistently a very good performer in
 970	  both hardware and software across a wide range of computing
 971	  environments regardless of its use in feedback or non-feedback
 972	  modes. Its key setup time is excellent, and its key agility is
 973	  good. Rijndael's very low memory requirements make it very well
 974	  suited for restricted-space environments, in which it also
 975	  demonstrates excellent performance. Rijndael's operations are
 976	  among the easiest to defend against power and timing attacks.
 977
 978	  The AES specifies three key sizes: 128, 192 and 256 bits
 979
 980	  See <http://csrc.nist.gov/encryption/aes/> for more information.
 981
 982config CRYPTO_AES_X86_64
 983	tristate "AES cipher algorithms (x86_64)"
 984	depends on (X86 || UML_X86) && 64BIT
 985	select CRYPTO_ALGAPI
 986	select CRYPTO_AES
 987	help
 988	  AES cipher algorithms (FIPS-197). AES uses the Rijndael
 989	  algorithm.
 990
 991	  Rijndael appears to be consistently a very good performer in
 992	  both hardware and software across a wide range of computing
 993	  environments regardless of its use in feedback or non-feedback
 994	  modes. Its key setup time is excellent, and its key agility is
 995	  good. Rijndael's very low memory requirements make it very well
 996	  suited for restricted-space environments, in which it also
 997	  demonstrates excellent performance. Rijndael's operations are
 998	  among the easiest to defend against power and timing attacks.
 999
1000	  The AES specifies three key sizes: 128, 192 and 256 bits
1001
1002	  See <http://csrc.nist.gov/encryption/aes/> for more information.
1003
1004config CRYPTO_AES_NI_INTEL
1005	tristate "AES cipher algorithms (AES-NI)"
1006	depends on X86
1007	select CRYPTO_AEAD
1008	select CRYPTO_AES_X86_64 if 64BIT
1009	select CRYPTO_AES_586 if !64BIT
 
1010	select CRYPTO_ALGAPI
1011	select CRYPTO_BLKCIPHER
1012	select CRYPTO_GLUE_HELPER_X86 if 64BIT
1013	select CRYPTO_SIMD
1014	help
1015	  Use Intel AES-NI instructions for AES algorithm.
1016
1017	  AES cipher algorithms (FIPS-197). AES uses the Rijndael
1018	  algorithm.
1019
1020	  Rijndael appears to be consistently a very good performer in
1021	  both hardware and software across a wide range of computing
1022	  environments regardless of its use in feedback or non-feedback
1023	  modes. Its key setup time is excellent, and its key agility is
1024	  good. Rijndael's very low memory requirements make it very well
1025	  suited for restricted-space environments, in which it also
1026	  demonstrates excellent performance. Rijndael's operations are
1027	  among the easiest to defend against power and timing attacks.
1028
1029	  The AES specifies three key sizes: 128, 192 and 256 bits
1030
1031	  See <http://csrc.nist.gov/encryption/aes/> for more information.
1032
1033	  In addition to AES cipher algorithm support, the acceleration
1034	  for some popular block cipher mode is supported too, including
1035	  ECB, CBC, LRW, PCBC, XTS. The 64 bit version has additional
1036	  acceleration for CTR.
1037
1038config CRYPTO_AES_SPARC64
1039	tristate "AES cipher algorithms (SPARC64)"
1040	depends on SPARC64
1041	select CRYPTO_CRYPTD
1042	select CRYPTO_ALGAPI
1043	help
1044	  Use SPARC64 crypto opcodes for AES algorithm.
1045
1046	  AES cipher algorithms (FIPS-197). AES uses the Rijndael
1047	  algorithm.
1048
1049	  Rijndael appears to be consistently a very good performer in
1050	  both hardware and software across a wide range of computing
1051	  environments regardless of its use in feedback or non-feedback
1052	  modes. Its key setup time is excellent, and its key agility is
1053	  good. Rijndael's very low memory requirements make it very well
1054	  suited for restricted-space environments, in which it also
1055	  demonstrates excellent performance. Rijndael's operations are
1056	  among the easiest to defend against power and timing attacks.
1057
1058	  The AES specifies three key sizes: 128, 192 and 256 bits
1059
1060	  See <http://csrc.nist.gov/encryption/aes/> for more information.
1061
1062	  In addition to AES cipher algorithm support, the acceleration
1063	  for some popular block cipher mode is supported too, including
1064	  ECB and CBC.
1065
1066config CRYPTO_AES_PPC_SPE
1067	tristate "AES cipher algorithms (PPC SPE)"
1068	depends on PPC && SPE
1069	help
1070	  AES cipher algorithms (FIPS-197). Additionally the acceleration
1071	  for popular block cipher modes ECB, CBC, CTR and XTS is supported.
1072	  This module should only be used for low power (router) devices
1073	  without hardware AES acceleration (e.g. caam crypto). It reduces the
1074	  size of the AES tables from 16KB to 8KB + 256 bytes and mitigates
1075	  timining attacks. Nevertheless it might be not as secure as other
1076	  architecture specific assembler implementations that work on 1KB
1077	  tables or 256 bytes S-boxes.
1078
1079config CRYPTO_ANUBIS
1080	tristate "Anubis cipher algorithm"
1081	select CRYPTO_ALGAPI
1082	help
1083	  Anubis cipher algorithm.
1084
1085	  Anubis is a variable key length cipher which can use keys from
1086	  128 bits to 320 bits in length.  It was evaluated as a entrant
1087	  in the NESSIE competition.
1088
1089	  See also:
1090	  <https://www.cosic.esat.kuleuven.be/nessie/reports/>
1091	  <http://www.larc.usp.br/~pbarreto/AnubisPage.html>
1092
1093config CRYPTO_ARC4
1094	tristate "ARC4 cipher algorithm"
1095	select CRYPTO_BLKCIPHER
1096	help
1097	  ARC4 cipher algorithm.
1098
1099	  ARC4 is a stream cipher using keys ranging from 8 bits to 2048
1100	  bits in length.  This algorithm is required for driver-based
1101	  WEP, but it should not be for other purposes because of the
1102	  weakness of the algorithm.
1103
1104config CRYPTO_BLOWFISH
1105	tristate "Blowfish cipher algorithm"
1106	select CRYPTO_ALGAPI
1107	select CRYPTO_BLOWFISH_COMMON
1108	help
1109	  Blowfish cipher algorithm, by Bruce Schneier.
1110
1111	  This is a variable key length cipher which can use keys from 32
1112	  bits to 448 bits in length.  It's fast, simple and specifically
1113	  designed for use on "large microprocessors".
1114
1115	  See also:
1116	  <http://www.schneier.com/blowfish.html>
1117
1118config CRYPTO_BLOWFISH_COMMON
1119	tristate
1120	help
1121	  Common parts of the Blowfish cipher algorithm shared by the
1122	  generic c and the assembler implementations.
1123
1124	  See also:
1125	  <http://www.schneier.com/blowfish.html>
1126
1127config CRYPTO_BLOWFISH_X86_64
1128	tristate "Blowfish cipher algorithm (x86_64)"
1129	depends on X86 && 64BIT
1130	select CRYPTO_BLKCIPHER
1131	select CRYPTO_BLOWFISH_COMMON
1132	help
1133	  Blowfish cipher algorithm (x86_64), by Bruce Schneier.
1134
1135	  This is a variable key length cipher which can use keys from 32
1136	  bits to 448 bits in length.  It's fast, simple and specifically
1137	  designed for use on "large microprocessors".
1138
1139	  See also:
1140	  <http://www.schneier.com/blowfish.html>
1141
1142config CRYPTO_CAMELLIA
1143	tristate "Camellia cipher algorithms"
1144	depends on CRYPTO
1145	select CRYPTO_ALGAPI
1146	help
1147	  Camellia cipher algorithms module.
1148
1149	  Camellia is a symmetric key block cipher developed jointly
1150	  at NTT and Mitsubishi Electric Corporation.
1151
1152	  The Camellia specifies three key sizes: 128, 192 and 256 bits.
1153
1154	  See also:
1155	  <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
1156
1157config CRYPTO_CAMELLIA_X86_64
1158	tristate "Camellia cipher algorithm (x86_64)"
1159	depends on X86 && 64BIT
1160	depends on CRYPTO
1161	select CRYPTO_BLKCIPHER
1162	select CRYPTO_GLUE_HELPER_X86
1163	help
1164	  Camellia cipher algorithm module (x86_64).
1165
1166	  Camellia is a symmetric key block cipher developed jointly
1167	  at NTT and Mitsubishi Electric Corporation.
1168
1169	  The Camellia specifies three key sizes: 128, 192 and 256 bits.
1170
1171	  See also:
1172	  <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
1173
1174config CRYPTO_CAMELLIA_AESNI_AVX_X86_64
1175	tristate "Camellia cipher algorithm (x86_64/AES-NI/AVX)"
1176	depends on X86 && 64BIT
1177	depends on CRYPTO
1178	select CRYPTO_BLKCIPHER
1179	select CRYPTO_CAMELLIA_X86_64
1180	select CRYPTO_GLUE_HELPER_X86
1181	select CRYPTO_SIMD
1182	select CRYPTO_XTS
1183	help
1184	  Camellia cipher algorithm module (x86_64/AES-NI/AVX).
1185
1186	  Camellia is a symmetric key block cipher developed jointly
1187	  at NTT and Mitsubishi Electric Corporation.
1188
1189	  The Camellia specifies three key sizes: 128, 192 and 256 bits.
1190
1191	  See also:
1192	  <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
1193
1194config CRYPTO_CAMELLIA_AESNI_AVX2_X86_64
1195	tristate "Camellia cipher algorithm (x86_64/AES-NI/AVX2)"
1196	depends on X86 && 64BIT
1197	depends on CRYPTO
1198	select CRYPTO_CAMELLIA_AESNI_AVX_X86_64
1199	help
1200	  Camellia cipher algorithm module (x86_64/AES-NI/AVX2).
1201
1202	  Camellia is a symmetric key block cipher developed jointly
1203	  at NTT and Mitsubishi Electric Corporation.
1204
1205	  The Camellia specifies three key sizes: 128, 192 and 256 bits.
1206
1207	  See also:
1208	  <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
1209
1210config CRYPTO_CAMELLIA_SPARC64
1211	tristate "Camellia cipher algorithm (SPARC64)"
1212	depends on SPARC64
1213	depends on CRYPTO
1214	select CRYPTO_ALGAPI
1215	help
1216	  Camellia cipher algorithm module (SPARC64).
1217
1218	  Camellia is a symmetric key block cipher developed jointly
1219	  at NTT and Mitsubishi Electric Corporation.
1220
1221	  The Camellia specifies three key sizes: 128, 192 and 256 bits.
1222
1223	  See also:
1224	  <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
1225
1226config CRYPTO_CAST_COMMON
1227	tristate
1228	help
1229	  Common parts of the CAST cipher algorithms shared by the
1230	  generic c and the assembler implementations.
1231
1232config CRYPTO_CAST5
1233	tristate "CAST5 (CAST-128) cipher algorithm"
1234	select CRYPTO_ALGAPI
1235	select CRYPTO_CAST_COMMON
1236	help
1237	  The CAST5 encryption algorithm (synonymous with CAST-128) is
1238	  described in RFC2144.
1239
1240config CRYPTO_CAST5_AVX_X86_64
1241	tristate "CAST5 (CAST-128) cipher algorithm (x86_64/AVX)"
1242	depends on X86 && 64BIT
1243	select CRYPTO_BLKCIPHER
1244	select CRYPTO_CAST5
1245	select CRYPTO_CAST_COMMON
1246	select CRYPTO_SIMD
1247	help
1248	  The CAST5 encryption algorithm (synonymous with CAST-128) is
1249	  described in RFC2144.
1250
1251	  This module provides the Cast5 cipher algorithm that processes
1252	  sixteen blocks parallel using the AVX instruction set.
1253
1254config CRYPTO_CAST6
1255	tristate "CAST6 (CAST-256) cipher algorithm"
1256	select CRYPTO_ALGAPI
1257	select CRYPTO_CAST_COMMON
1258	help
1259	  The CAST6 encryption algorithm (synonymous with CAST-256) is
1260	  described in RFC2612.
1261
1262config CRYPTO_CAST6_AVX_X86_64
1263	tristate "CAST6 (CAST-256) cipher algorithm (x86_64/AVX)"
1264	depends on X86 && 64BIT
1265	select CRYPTO_BLKCIPHER
1266	select CRYPTO_CAST6
1267	select CRYPTO_CAST_COMMON
1268	select CRYPTO_GLUE_HELPER_X86
1269	select CRYPTO_SIMD
1270	select CRYPTO_XTS
1271	help
1272	  The CAST6 encryption algorithm (synonymous with CAST-256) is
1273	  described in RFC2612.
1274
1275	  This module provides the Cast6 cipher algorithm that processes
1276	  eight blocks parallel using the AVX instruction set.
1277
1278config CRYPTO_DES
1279	tristate "DES and Triple DES EDE cipher algorithms"
1280	select CRYPTO_ALGAPI
1281	help
1282	  DES cipher algorithm (FIPS 46-2), and Triple DES EDE (FIPS 46-3).
1283
1284config CRYPTO_DES_SPARC64
1285	tristate "DES and Triple DES EDE cipher algorithms (SPARC64)"
1286	depends on SPARC64
1287	select CRYPTO_ALGAPI
1288	select CRYPTO_DES
1289	help
1290	  DES cipher algorithm (FIPS 46-2), and Triple DES EDE (FIPS 46-3),
1291	  optimized using SPARC64 crypto opcodes.
1292
1293config CRYPTO_DES3_EDE_X86_64
1294	tristate "Triple DES EDE cipher algorithm (x86-64)"
1295	depends on X86 && 64BIT
1296	select CRYPTO_BLKCIPHER
1297	select CRYPTO_DES
1298	help
1299	  Triple DES EDE (FIPS 46-3) algorithm.
1300
1301	  This module provides implementation of the Triple DES EDE cipher
1302	  algorithm that is optimized for x86-64 processors. Two versions of
1303	  algorithm are provided; regular processing one input block and
1304	  one that processes three blocks parallel.
1305
1306config CRYPTO_FCRYPT
1307	tristate "FCrypt cipher algorithm"
1308	select CRYPTO_ALGAPI
1309	select CRYPTO_BLKCIPHER
1310	help
1311	  FCrypt algorithm used by RxRPC.
1312
1313config CRYPTO_KHAZAD
1314	tristate "Khazad cipher algorithm"
1315	select CRYPTO_ALGAPI
1316	help
1317	  Khazad cipher algorithm.
1318
1319	  Khazad was a finalist in the initial NESSIE competition.  It is
1320	  an algorithm optimized for 64-bit processors with good performance
1321	  on 32-bit processors.  Khazad uses an 128 bit key size.
1322
1323	  See also:
1324	  <http://www.larc.usp.br/~pbarreto/KhazadPage.html>
1325
1326config CRYPTO_SALSA20
1327	tristate "Salsa20 stream cipher algorithm"
 
1328	select CRYPTO_BLKCIPHER
1329	help
1330	  Salsa20 stream cipher algorithm.
1331
1332	  Salsa20 is a stream cipher submitted to eSTREAM, the ECRYPT
1333	  Stream Cipher Project. See <http://www.ecrypt.eu.org/stream/>
1334
1335	  The Salsa20 stream cipher algorithm is designed by Daniel J.
1336	  Bernstein <djb@cr.yp.to>. See <http://cr.yp.to/snuffle.html>
1337
1338config CRYPTO_SALSA20_586
1339	tristate "Salsa20 stream cipher algorithm (i586)"
1340	depends on (X86 || UML_X86) && !64BIT
 
1341	select CRYPTO_BLKCIPHER
1342	select CRYPTO_SALSA20
1343	help
1344	  Salsa20 stream cipher algorithm.
1345
1346	  Salsa20 is a stream cipher submitted to eSTREAM, the ECRYPT
1347	  Stream Cipher Project. See <http://www.ecrypt.eu.org/stream/>
1348
1349	  The Salsa20 stream cipher algorithm is designed by Daniel J.
1350	  Bernstein <djb@cr.yp.to>. See <http://cr.yp.to/snuffle.html>
1351
1352config CRYPTO_SALSA20_X86_64
1353	tristate "Salsa20 stream cipher algorithm (x86_64)"
1354	depends on (X86 || UML_X86) && 64BIT
 
1355	select CRYPTO_BLKCIPHER
1356	select CRYPTO_SALSA20
1357	help
1358	  Salsa20 stream cipher algorithm.
1359
1360	  Salsa20 is a stream cipher submitted to eSTREAM, the ECRYPT
1361	  Stream Cipher Project. See <http://www.ecrypt.eu.org/stream/>
1362
1363	  The Salsa20 stream cipher algorithm is designed by Daniel J.
1364	  Bernstein <djb@cr.yp.to>. See <http://cr.yp.to/snuffle.html>
1365
1366config CRYPTO_CHACHA20
1367	tristate "ChaCha20 cipher algorithm"
1368	select CRYPTO_BLKCIPHER
1369	help
1370	  ChaCha20 cipher algorithm, RFC7539.
1371
1372	  ChaCha20 is a 256-bit high-speed stream cipher designed by Daniel J.
1373	  Bernstein and further specified in RFC7539 for use in IETF protocols.
1374	  This is the portable C implementation of ChaCha20.
1375
1376	  See also:
1377	  <http://cr.yp.to/chacha/chacha-20080128.pdf>
1378
1379config CRYPTO_CHACHA20_X86_64
1380	tristate "ChaCha20 cipher algorithm (x86_64/SSSE3/AVX2)"
1381	depends on X86 && 64BIT
1382	select CRYPTO_BLKCIPHER
1383	select CRYPTO_CHACHA20
1384	help
1385	  ChaCha20 cipher algorithm, RFC7539.
1386
1387	  ChaCha20 is a 256-bit high-speed stream cipher designed by Daniel J.
1388	  Bernstein and further specified in RFC7539 for use in IETF protocols.
1389	  This is the x86_64 assembler implementation using SIMD instructions.
1390
1391	  See also:
1392	  <http://cr.yp.to/chacha/chacha-20080128.pdf>
1393
1394config CRYPTO_SEED
1395	tristate "SEED cipher algorithm"
1396	select CRYPTO_ALGAPI
1397	help
1398	  SEED cipher algorithm (RFC4269).
1399
1400	  SEED is a 128-bit symmetric key block cipher that has been
1401	  developed by KISA (Korea Information Security Agency) as a
1402	  national standard encryption algorithm of the Republic of Korea.
1403	  It is a 16 round block cipher with the key size of 128 bit.
1404
1405	  See also:
1406	  <http://www.kisa.or.kr/kisa/seed/jsp/seed_eng.jsp>
1407
1408config CRYPTO_SERPENT
1409	tristate "Serpent cipher algorithm"
1410	select CRYPTO_ALGAPI
1411	help
1412	  Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1413
1414	  Keys are allowed to be from 0 to 256 bits in length, in steps
1415	  of 8 bits.  Also includes the 'Tnepres' algorithm, a reversed
1416	  variant of Serpent for compatibility with old kerneli.org code.
1417
1418	  See also:
1419	  <http://www.cl.cam.ac.uk/~rja14/serpent.html>
1420
1421config CRYPTO_SERPENT_SSE2_X86_64
1422	tristate "Serpent cipher algorithm (x86_64/SSE2)"
1423	depends on X86 && 64BIT
1424	select CRYPTO_BLKCIPHER
1425	select CRYPTO_GLUE_HELPER_X86
1426	select CRYPTO_SERPENT
1427	select CRYPTO_SIMD
1428	help
1429	  Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1430
1431	  Keys are allowed to be from 0 to 256 bits in length, in steps
1432	  of 8 bits.
1433
1434	  This module provides Serpent cipher algorithm that processes eight
1435	  blocks parallel using SSE2 instruction set.
1436
1437	  See also:
1438	  <http://www.cl.cam.ac.uk/~rja14/serpent.html>
1439
1440config CRYPTO_SERPENT_SSE2_586
1441	tristate "Serpent cipher algorithm (i586/SSE2)"
1442	depends on X86 && !64BIT
1443	select CRYPTO_BLKCIPHER
1444	select CRYPTO_GLUE_HELPER_X86
1445	select CRYPTO_SERPENT
1446	select CRYPTO_SIMD
1447	help
1448	  Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1449
1450	  Keys are allowed to be from 0 to 256 bits in length, in steps
1451	  of 8 bits.
1452
1453	  This module provides Serpent cipher algorithm that processes four
1454	  blocks parallel using SSE2 instruction set.
1455
1456	  See also:
1457	  <http://www.cl.cam.ac.uk/~rja14/serpent.html>
1458
1459config CRYPTO_SERPENT_AVX_X86_64
1460	tristate "Serpent cipher algorithm (x86_64/AVX)"
1461	depends on X86 && 64BIT
1462	select CRYPTO_BLKCIPHER
1463	select CRYPTO_GLUE_HELPER_X86
1464	select CRYPTO_SERPENT
1465	select CRYPTO_SIMD
1466	select CRYPTO_XTS
1467	help
1468	  Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1469
1470	  Keys are allowed to be from 0 to 256 bits in length, in steps
1471	  of 8 bits.
1472
1473	  This module provides the Serpent cipher algorithm that processes
1474	  eight blocks parallel using the AVX instruction set.
1475
1476	  See also:
1477	  <http://www.cl.cam.ac.uk/~rja14/serpent.html>
1478
1479config CRYPTO_SERPENT_AVX2_X86_64
1480	tristate "Serpent cipher algorithm (x86_64/AVX2)"
1481	depends on X86 && 64BIT
1482	select CRYPTO_SERPENT_AVX_X86_64
1483	help
1484	  Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1485
1486	  Keys are allowed to be from 0 to 256 bits in length, in steps
1487	  of 8 bits.
1488
1489	  This module provides Serpent cipher algorithm that processes 16
1490	  blocks parallel using AVX2 instruction set.
1491
1492	  See also:
1493	  <http://www.cl.cam.ac.uk/~rja14/serpent.html>
1494
1495config CRYPTO_SM4
1496	tristate "SM4 cipher algorithm"
1497	select CRYPTO_ALGAPI
1498	help
1499	  SM4 cipher algorithms (OSCCA GB/T 32907-2016).
1500
1501	  SM4 (GBT.32907-2016) is a cryptographic standard issued by the
1502	  Organization of State Commercial Administration of China (OSCCA)
1503	  as an authorized cryptographic algorithms for the use within China.
1504
1505	  SMS4 was originally created for use in protecting wireless
1506	  networks, and is mandated in the Chinese National Standard for
1507	  Wireless LAN WAPI (Wired Authentication and Privacy Infrastructure)
1508	  (GB.15629.11-2003).
1509
1510	  The latest SM4 standard (GBT.32907-2016) was proposed by OSCCA and
1511	  standardized through TC 260 of the Standardization Administration
1512	  of the People's Republic of China (SAC).
1513
1514	  The input, output, and key of SMS4 are each 128 bits.
1515
1516	  See also: <https://eprint.iacr.org/2008/329.pdf>
1517
1518	  If unsure, say N.
1519
1520config CRYPTO_SPECK
1521	tristate "Speck cipher algorithm"
1522	select CRYPTO_ALGAPI
1523	help
1524	  Speck is a lightweight block cipher that is tuned for optimal
1525	  performance in software (rather than hardware).
1526
1527	  Speck may not be as secure as AES, and should only be used on systems
1528	  where AES is not fast enough.
1529
1530	  See also: <https://eprint.iacr.org/2013/404.pdf>
1531
1532	  If unsure, say N.
1533
1534config CRYPTO_TEA
1535	tristate "TEA, XTEA and XETA cipher algorithms"
1536	select CRYPTO_ALGAPI
1537	help
1538	  TEA cipher algorithm.
1539
1540	  Tiny Encryption Algorithm is a simple cipher that uses
1541	  many rounds for security.  It is very fast and uses
1542	  little memory.
1543
1544	  Xtendend Tiny Encryption Algorithm is a modification to
1545	  the TEA algorithm to address a potential key weakness
1546	  in the TEA algorithm.
1547
1548	  Xtendend Encryption Tiny Algorithm is a mis-implementation
1549	  of the XTEA algorithm for compatibility purposes.
1550
1551config CRYPTO_TWOFISH
1552	tristate "Twofish cipher algorithm"
1553	select CRYPTO_ALGAPI
1554	select CRYPTO_TWOFISH_COMMON
1555	help
1556	  Twofish cipher algorithm.
1557
1558	  Twofish was submitted as an AES (Advanced Encryption Standard)
1559	  candidate cipher by researchers at CounterPane Systems.  It is a
1560	  16 round block cipher supporting key sizes of 128, 192, and 256
1561	  bits.
1562
1563	  See also:
1564	  <http://www.schneier.com/twofish.html>
1565
1566config CRYPTO_TWOFISH_COMMON
1567	tristate
1568	help
1569	  Common parts of the Twofish cipher algorithm shared by the
1570	  generic c and the assembler implementations.
1571
1572config CRYPTO_TWOFISH_586
1573	tristate "Twofish cipher algorithms (i586)"
1574	depends on (X86 || UML_X86) && !64BIT
1575	select CRYPTO_ALGAPI
1576	select CRYPTO_TWOFISH_COMMON
1577	help
1578	  Twofish cipher algorithm.
1579
1580	  Twofish was submitted as an AES (Advanced Encryption Standard)
1581	  candidate cipher by researchers at CounterPane Systems.  It is a
1582	  16 round block cipher supporting key sizes of 128, 192, and 256
1583	  bits.
1584
1585	  See also:
1586	  <http://www.schneier.com/twofish.html>
1587
1588config CRYPTO_TWOFISH_X86_64
1589	tristate "Twofish cipher algorithm (x86_64)"
1590	depends on (X86 || UML_X86) && 64BIT
1591	select CRYPTO_ALGAPI
1592	select CRYPTO_TWOFISH_COMMON
1593	help
1594	  Twofish cipher algorithm (x86_64).
1595
1596	  Twofish was submitted as an AES (Advanced Encryption Standard)
1597	  candidate cipher by researchers at CounterPane Systems.  It is a
1598	  16 round block cipher supporting key sizes of 128, 192, and 256
1599	  bits.
1600
1601	  See also:
1602	  <http://www.schneier.com/twofish.html>
1603
1604config CRYPTO_TWOFISH_X86_64_3WAY
1605	tristate "Twofish cipher algorithm (x86_64, 3-way parallel)"
1606	depends on X86 && 64BIT
1607	select CRYPTO_BLKCIPHER
1608	select CRYPTO_TWOFISH_COMMON
1609	select CRYPTO_TWOFISH_X86_64
1610	select CRYPTO_GLUE_HELPER_X86
1611	help
1612	  Twofish cipher algorithm (x86_64, 3-way parallel).
1613
1614	  Twofish was submitted as an AES (Advanced Encryption Standard)
1615	  candidate cipher by researchers at CounterPane Systems.  It is a
1616	  16 round block cipher supporting key sizes of 128, 192, and 256
1617	  bits.
1618
1619	  This module provides Twofish cipher algorithm that processes three
1620	  blocks parallel, utilizing resources of out-of-order CPUs better.
1621
1622	  See also:
1623	  <http://www.schneier.com/twofish.html>
1624
1625config CRYPTO_TWOFISH_AVX_X86_64
1626	tristate "Twofish cipher algorithm (x86_64/AVX)"
1627	depends on X86 && 64BIT
1628	select CRYPTO_BLKCIPHER
1629	select CRYPTO_GLUE_HELPER_X86
1630	select CRYPTO_SIMD
1631	select CRYPTO_TWOFISH_COMMON
1632	select CRYPTO_TWOFISH_X86_64
1633	select CRYPTO_TWOFISH_X86_64_3WAY
1634	help
1635	  Twofish cipher algorithm (x86_64/AVX).
1636
1637	  Twofish was submitted as an AES (Advanced Encryption Standard)
1638	  candidate cipher by researchers at CounterPane Systems.  It is a
1639	  16 round block cipher supporting key sizes of 128, 192, and 256
1640	  bits.
1641
1642	  This module provides the Twofish cipher algorithm that processes
1643	  eight blocks parallel using the AVX Instruction Set.
1644
1645	  See also:
1646	  <http://www.schneier.com/twofish.html>
1647
1648comment "Compression"
1649
1650config CRYPTO_DEFLATE
1651	tristate "Deflate compression algorithm"
1652	select CRYPTO_ALGAPI
1653	select CRYPTO_ACOMP2
1654	select ZLIB_INFLATE
1655	select ZLIB_DEFLATE
1656	help
1657	  This is the Deflate algorithm (RFC1951), specified for use in
1658	  IPSec with the IPCOMP protocol (RFC3173, RFC2394).
1659
1660	  You will most probably want this if using IPSec.
1661
 
 
 
 
 
 
 
 
 
1662config CRYPTO_LZO
1663	tristate "LZO compression algorithm"
1664	select CRYPTO_ALGAPI
1665	select CRYPTO_ACOMP2
1666	select LZO_COMPRESS
1667	select LZO_DECOMPRESS
1668	help
1669	  This is the LZO algorithm.
1670
1671config CRYPTO_842
1672	tristate "842 compression algorithm"
1673	select CRYPTO_ALGAPI
1674	select CRYPTO_ACOMP2
1675	select 842_COMPRESS
1676	select 842_DECOMPRESS
1677	help
1678	  This is the 842 algorithm.
1679
1680config CRYPTO_LZ4
1681	tristate "LZ4 compression algorithm"
1682	select CRYPTO_ALGAPI
1683	select CRYPTO_ACOMP2
1684	select LZ4_COMPRESS
1685	select LZ4_DECOMPRESS
1686	help
1687	  This is the LZ4 algorithm.
1688
1689config CRYPTO_LZ4HC
1690	tristate "LZ4HC compression algorithm"
1691	select CRYPTO_ALGAPI
1692	select CRYPTO_ACOMP2
1693	select LZ4HC_COMPRESS
1694	select LZ4_DECOMPRESS
1695	help
1696	  This is the LZ4 high compression mode algorithm.
1697
1698comment "Random Number Generation"
1699
1700config CRYPTO_ANSI_CPRNG
1701	tristate "Pseudo Random Number Generation for Cryptographic modules"
 
1702	select CRYPTO_AES
1703	select CRYPTO_RNG
1704	help
1705	  This option enables the generic pseudo random number generator
1706	  for cryptographic modules.  Uses the Algorithm specified in
1707	  ANSI X9.31 A.2.4. Note that this option must be enabled if
1708	  CRYPTO_FIPS is selected
1709
1710menuconfig CRYPTO_DRBG_MENU
1711	tristate "NIST SP800-90A DRBG"
1712	help
1713	  NIST SP800-90A compliant DRBG. In the following submenu, one or
1714	  more of the DRBG types must be selected.
1715
1716if CRYPTO_DRBG_MENU
1717
1718config CRYPTO_DRBG_HMAC
1719	bool
1720	default y
1721	select CRYPTO_HMAC
1722	select CRYPTO_SHA256
1723
1724config CRYPTO_DRBG_HASH
1725	bool "Enable Hash DRBG"
1726	select CRYPTO_SHA256
1727	help
1728	  Enable the Hash DRBG variant as defined in NIST SP800-90A.
1729
1730config CRYPTO_DRBG_CTR
1731	bool "Enable CTR DRBG"
1732	select CRYPTO_AES
1733	depends on CRYPTO_CTR
1734	help
1735	  Enable the CTR DRBG variant as defined in NIST SP800-90A.
1736
1737config CRYPTO_DRBG
1738	tristate
1739	default CRYPTO_DRBG_MENU
1740	select CRYPTO_RNG
1741	select CRYPTO_JITTERENTROPY
1742
1743endif	# if CRYPTO_DRBG_MENU
1744
1745config CRYPTO_JITTERENTROPY
1746	tristate "Jitterentropy Non-Deterministic Random Number Generator"
1747	select CRYPTO_RNG
1748	help
1749	  The Jitterentropy RNG is a noise that is intended
1750	  to provide seed to another RNG. The RNG does not
1751	  perform any cryptographic whitening of the generated
1752	  random numbers. This Jitterentropy RNG registers with
1753	  the kernel crypto API and can be used by any caller.
1754
1755config CRYPTO_USER_API
1756	tristate
1757
1758config CRYPTO_USER_API_HASH
1759	tristate "User-space interface for hash algorithms"
1760	depends on NET
1761	select CRYPTO_HASH
1762	select CRYPTO_USER_API
1763	help
1764	  This option enables the user-spaces interface for hash
1765	  algorithms.
1766
1767config CRYPTO_USER_API_SKCIPHER
1768	tristate "User-space interface for symmetric key cipher algorithms"
1769	depends on NET
1770	select CRYPTO_BLKCIPHER
1771	select CRYPTO_USER_API
1772	help
1773	  This option enables the user-spaces interface for symmetric
1774	  key cipher algorithms.
1775
1776config CRYPTO_USER_API_RNG
1777	tristate "User-space interface for random number generator algorithms"
1778	depends on NET
1779	select CRYPTO_RNG
1780	select CRYPTO_USER_API
1781	help
1782	  This option enables the user-spaces interface for random
1783	  number generator algorithms.
1784
1785config CRYPTO_USER_API_AEAD
1786	tristate "User-space interface for AEAD cipher algorithms"
1787	depends on NET
1788	select CRYPTO_AEAD
1789	select CRYPTO_BLKCIPHER
1790	select CRYPTO_NULL
1791	select CRYPTO_USER_API
1792	help
1793	  This option enables the user-spaces interface for AEAD
1794	  cipher algorithms.
1795
1796config CRYPTO_HASH_INFO
1797	bool
1798
1799source "drivers/crypto/Kconfig"
1800source crypto/asymmetric_keys/Kconfig
1801source certs/Kconfig
1802
1803endif	# if CRYPTO