1# SPDX-License-Identifier: GPL-2.0
   2#
   3# Generic algorithms support
   4#
   5config XOR_BLOCKS
   6	tristate
   7
   8#
   9# async_tx api: hardware offloaded memory transfer/transform support
  10#
  11source "crypto/async_tx/Kconfig"
  12
  13#
  14# Cryptographic API Configuration
  15#
  16menuconfig CRYPTO
  17	tristate "Cryptographic API"
  18	select CRYPTO_LIB_UTILS
  19	help
  20	  This option provides the core Cryptographic API.
  21
  22if CRYPTO
  23
  24menu "Crypto core or helper"
  25
  26config CRYPTO_FIPS
  27	bool "FIPS 200 compliance"
  28	depends on (CRYPTO_ANSI_CPRNG || CRYPTO_DRBG) && !CRYPTO_MANAGER_DISABLE_TESTS
  29	depends on (MODULE_SIG || !MODULES)
  30	help
  31	  This option enables the fips boot option which is
  32	  required if you want the system to operate in a FIPS 200
  33	  certification.  You should say no unless you know what
  34	  this is.
  35
  36config CRYPTO_FIPS_NAME
  37	string "FIPS Module Name"
  38	default "Linux Kernel Cryptographic API"
  39	depends on CRYPTO_FIPS
  40	help
  41	  This option sets the FIPS Module name reported by the Crypto API via
  42	  the /proc/sys/crypto/fips_name file.
  43
  44config CRYPTO_FIPS_CUSTOM_VERSION
  45	bool "Use Custom FIPS Module Version"
  46	depends on CRYPTO_FIPS
  47	default n
  48
  49config CRYPTO_FIPS_VERSION
  50	string "FIPS Module Version"
  51	default "(none)"
  52	depends on CRYPTO_FIPS_CUSTOM_VERSION
  53	help
  54	  This option provides the ability to override the FIPS Module Version.
  55	  By default the KERNELRELEASE value is used.
  56
  57config CRYPTO_ALGAPI
  58	tristate
  59	select CRYPTO_ALGAPI2
  60	help
  61	  This option provides the API for cryptographic algorithms.
  62
  63config CRYPTO_ALGAPI2
  64	tristate
  65
  66config CRYPTO_AEAD
  67	tristate
  68	select CRYPTO_AEAD2
  69	select CRYPTO_ALGAPI
  70
  71config CRYPTO_AEAD2
  72	tristate
  73	select CRYPTO_ALGAPI2
  74
  75config CRYPTO_SIG
  76	tristate
  77	select CRYPTO_SIG2
  78	select CRYPTO_ALGAPI
  79
  80config CRYPTO_SIG2
  81	tristate
  82	select CRYPTO_ALGAPI2
  83
  84config CRYPTO_SKCIPHER
  85	tristate
  86	select CRYPTO_SKCIPHER2
  87	select CRYPTO_ALGAPI
  88	select CRYPTO_ECB
  89
  90config CRYPTO_SKCIPHER2
  91	tristate
  92	select CRYPTO_ALGAPI2
 
  93
  94config CRYPTO_HASH
  95	tristate
  96	select CRYPTO_HASH2
  97	select CRYPTO_ALGAPI
  98
  99config CRYPTO_HASH2
 100	tristate
 101	select CRYPTO_ALGAPI2
 102
 103config CRYPTO_RNG
 104	tristate
 105	select CRYPTO_RNG2
 106	select CRYPTO_ALGAPI
 107
 108config CRYPTO_RNG2
 109	tristate
 110	select CRYPTO_ALGAPI2
 111
 112config CRYPTO_RNG_DEFAULT
 113	tristate
 114	select CRYPTO_DRBG_MENU
 115
 116config CRYPTO_AKCIPHER2
 117	tristate
 118	select CRYPTO_ALGAPI2
 119
 120config CRYPTO_AKCIPHER
 121	tristate
 122	select CRYPTO_AKCIPHER2
 123	select CRYPTO_ALGAPI
 124
 125config CRYPTO_KPP2
 126	tristate
 127	select CRYPTO_ALGAPI2
 128
 129config CRYPTO_KPP
 130	tristate
 131	select CRYPTO_ALGAPI
 132	select CRYPTO_KPP2
 133
 134config CRYPTO_ACOMP2
 135	tristate
 136	select CRYPTO_ALGAPI2
 137	select SGL_ALLOC
 138
 139config CRYPTO_ACOMP
 140	tristate
 141	select CRYPTO_ALGAPI
 142	select CRYPTO_ACOMP2
 143
 144config CRYPTO_MANAGER
 145	tristate "Cryptographic algorithm manager"
 146	select CRYPTO_MANAGER2
 147	help
 148	  Create default cryptographic template instantiations such as
 149	  cbc(aes).
 150
 151config CRYPTO_MANAGER2
 152	def_tristate CRYPTO_MANAGER || (CRYPTO_MANAGER!=n && CRYPTO_ALGAPI=y)
 153	select CRYPTO_ACOMP2
 154	select CRYPTO_AEAD2
 155	select CRYPTO_AKCIPHER2
 156	select CRYPTO_SIG2
 157	select CRYPTO_HASH2
 158	select CRYPTO_KPP2
 159	select CRYPTO_RNG2
 160	select CRYPTO_SKCIPHER2
 
 
 
 161
 162config CRYPTO_USER
 163	tristate "Userspace cryptographic algorithm configuration"
 164	depends on NET
 165	select CRYPTO_MANAGER
 166	help
 167	  Userspace configuration for cryptographic instantiations such as
 168	  cbc(aes).
 169
 170config CRYPTO_MANAGER_DISABLE_TESTS
 171	bool "Disable run-time self tests"
 172	default y
 173	help
 174	  Disable run-time self tests that normally take place at
 175	  algorithm registration.
 176
 177config CRYPTO_MANAGER_EXTRA_TESTS
 178	bool "Enable extra run-time crypto self tests"
 179	depends on DEBUG_KERNEL && !CRYPTO_MANAGER_DISABLE_TESTS && CRYPTO_MANAGER
 180	help
 181	  Enable extra run-time self tests of registered crypto algorithms,
 182	  including randomized fuzz tests.
 183
 184	  This is intended for developer use only, as these tests take much
 185	  longer to run than the normal self tests.
 186
 187config CRYPTO_NULL
 188	tristate "Null algorithms"
 189	select CRYPTO_NULL2
 190	help
 191	  These are 'Null' algorithms, used by IPsec, which do nothing.
 192
 193config CRYPTO_NULL2
 194	tristate
 195	select CRYPTO_ALGAPI2
 196	select CRYPTO_SKCIPHER2
 197	select CRYPTO_HASH2
 198
 199config CRYPTO_PCRYPT
 200	tristate "Parallel crypto engine"
 201	depends on SMP
 202	select PADATA
 203	select CRYPTO_MANAGER
 204	select CRYPTO_AEAD
 205	help
 206	  This converts an arbitrary crypto algorithm into a parallel
 207	  algorithm that executes in kernel threads.
 208
 209config CRYPTO_CRYPTD
 210	tristate "Software async crypto daemon"
 211	select CRYPTO_SKCIPHER
 212	select CRYPTO_HASH
 213	select CRYPTO_MANAGER
 214	help
 215	  This is a generic software asynchronous crypto daemon that
 216	  converts an arbitrary synchronous software crypto algorithm
 217	  into an asynchronous algorithm that executes in a kernel thread.
 218
 219config CRYPTO_AUTHENC
 220	tristate "Authenc support"
 221	select CRYPTO_AEAD
 222	select CRYPTO_SKCIPHER
 223	select CRYPTO_MANAGER
 224	select CRYPTO_HASH
 225	select CRYPTO_NULL
 226	help
 227	  Authenc: Combined mode wrapper for IPsec.
 228
 229	  This is required for IPSec ESP (XFRM_ESP).
 230
 231config CRYPTO_TEST
 232	tristate "Testing module"
 233	depends on m || EXPERT
 234	select CRYPTO_MANAGER
 235	help
 236	  Quick & dirty crypto test module.
 237
 238config CRYPTO_SIMD
 239	tristate
 240	select CRYPTO_CRYPTD
 241
 242config CRYPTO_ENGINE
 243	tristate
 244
 245endmenu
 246
 247menu "Public-key cryptography"
 248
 249config CRYPTO_RSA
 250	tristate "RSA (Rivest-Shamir-Adleman)"
 251	select CRYPTO_AKCIPHER
 252	select CRYPTO_MANAGER
 253	select CRYPTO_SIG
 254	select MPILIB
 255	select ASN1
 256	help
 257	  RSA (Rivest-Shamir-Adleman) public key algorithm (RFC8017)
 258
 259config CRYPTO_DH
 260	tristate "DH (Diffie-Hellman)"
 261	select CRYPTO_KPP
 262	select MPILIB
 263	help
 264	  DH (Diffie-Hellman) key exchange algorithm
 265
 266config CRYPTO_DH_RFC7919_GROUPS
 267	bool "RFC 7919 FFDHE groups"
 268	depends on CRYPTO_DH
 269	select CRYPTO_RNG_DEFAULT
 270	help
 271	  FFDHE (Finite-Field-based Diffie-Hellman Ephemeral) groups
 272	  defined in RFC7919.
 273
 274	  Support these finite-field groups in DH key exchanges:
 275	  - ffdhe2048, ffdhe3072, ffdhe4096, ffdhe6144, ffdhe8192
 276
 277	  If unsure, say N.
 278
 279config CRYPTO_ECC
 280	tristate
 281	select CRYPTO_RNG_DEFAULT
 282
 283config CRYPTO_ECDH
 284	tristate "ECDH (Elliptic Curve Diffie-Hellman)"
 285	select CRYPTO_ECC
 286	select CRYPTO_KPP
 287	help
 288	  ECDH (Elliptic Curve Diffie-Hellman) key exchange algorithm
 289	  using curves P-192, P-256, and P-384 (FIPS 186)
 290
 291config CRYPTO_ECDSA
 292	tristate "ECDSA (Elliptic Curve Digital Signature Algorithm)"
 293	select CRYPTO_ECC
 294	select CRYPTO_SIG
 295	select ASN1
 296	help
 297	  ECDSA (Elliptic Curve Digital Signature Algorithm) (FIPS 186,
 298	  ISO/IEC 14888-3)
 299	  using curves P-192, P-256, P-384 and P-521
 300
 301	  Only signature verification is implemented.
 302
 303config CRYPTO_ECRDSA
 304	tristate "EC-RDSA (Elliptic Curve Russian Digital Signature Algorithm)"
 305	select CRYPTO_ECC
 306	select CRYPTO_SIG
 307	select CRYPTO_STREEBOG
 308	select OID_REGISTRY
 309	select ASN1
 310	help
 311	  Elliptic Curve Russian Digital Signature Algorithm (GOST R 34.10-2012,
 312	  RFC 7091, ISO/IEC 14888-3)
 313
 314	  One of the Russian cryptographic standard algorithms (called GOST
 315	  algorithms). Only signature verification is implemented.
 316
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 317config CRYPTO_CURVE25519
 318	tristate "Curve25519"
 319	select CRYPTO_KPP
 320	select CRYPTO_LIB_CURVE25519_GENERIC
 321	help
 322	  Curve25519 elliptic curve (RFC7748)
 323
 324endmenu
 325
 326menu "Block ciphers"
 327
 328config CRYPTO_AES
 329	tristate "AES (Advanced Encryption Standard)"
 330	select CRYPTO_ALGAPI
 331	select CRYPTO_LIB_AES
 332	help
 333	  AES cipher algorithms (Rijndael)(FIPS-197, ISO/IEC 18033-3)
 334
 335	  Rijndael appears to be consistently a very good performer in
 336	  both hardware and software across a wide range of computing
 337	  environments regardless of its use in feedback or non-feedback
 338	  modes. Its key setup time is excellent, and its key agility is
 339	  good. Rijndael's very low memory requirements make it very well
 340	  suited for restricted-space environments, in which it also
 341	  demonstrates excellent performance. Rijndael's operations are
 342	  among the easiest to defend against power and timing attacks.
 343
 344	  The AES specifies three key sizes: 128, 192 and 256 bits
 345
 346config CRYPTO_AES_TI
 347	tristate "AES (Advanced Encryption Standard) (fixed time)"
 348	select CRYPTO_ALGAPI
 349	select CRYPTO_LIB_AES
 350	help
 351	  AES cipher algorithms (Rijndael)(FIPS-197, ISO/IEC 18033-3)
 352
 353	  This is a generic implementation of AES that attempts to eliminate
 354	  data dependent latencies as much as possible without affecting
 355	  performance too much. It is intended for use by the generic CCM
 356	  and GCM drivers, and other CTR or CMAC/XCBC based modes that rely
 357	  solely on encryption (although decryption is supported as well, but
 358	  with a more dramatic performance hit)
 359
 360	  Instead of using 16 lookup tables of 1 KB each, (8 for encryption and
 361	  8 for decryption), this implementation only uses just two S-boxes of
 362	  256 bytes each, and attempts to eliminate data dependent latencies by
 363	  prefetching the entire table into the cache at the start of each
 364	  block. Interrupts are also disabled to avoid races where cachelines
 365	  are evicted when the CPU is interrupted to do something else.
 366
 367config CRYPTO_ANUBIS
 368	tristate "Anubis"
 369	depends on CRYPTO_USER_API_ENABLE_OBSOLETE
 370	select CRYPTO_ALGAPI
 371	help
 372	  Anubis cipher algorithm
 373
 374	  Anubis is a variable key length cipher which can use keys from
 375	  128 bits to 320 bits in length.  It was evaluated as a entrant
 376	  in the NESSIE competition.
 377
 378	  See https://web.archive.org/web/20160606112246/http://www.larc.usp.br/~pbarreto/AnubisPage.html
 379	  for further information.
 380
 381config CRYPTO_ARIA
 382	tristate "ARIA"
 383	select CRYPTO_ALGAPI
 384	help
 385	  ARIA cipher algorithm (RFC5794)
 386
 387	  ARIA is a standard encryption algorithm of the Republic of Korea.
 388	  The ARIA specifies three key sizes and rounds.
 389	  128-bit: 12 rounds.
 390	  192-bit: 14 rounds.
 391	  256-bit: 16 rounds.
 392
 393	  See:
 394	  https://seed.kisa.or.kr/kisa/algorithm/EgovAriaInfo.do
 395
 396config CRYPTO_BLOWFISH
 397	tristate "Blowfish"
 398	select CRYPTO_ALGAPI
 399	select CRYPTO_BLOWFISH_COMMON
 400	help
 401	  Blowfish cipher algorithm, by Bruce Schneier
 402
 403	  This is a variable key length cipher which can use keys from 32
 404	  bits to 448 bits in length.  It's fast, simple and specifically
 405	  designed for use on "large microprocessors".
 406
 407	  See https://www.schneier.com/blowfish.html for further information.
 408
 409config CRYPTO_BLOWFISH_COMMON
 410	tristate
 411	help
 412	  Common parts of the Blowfish cipher algorithm shared by the
 413	  generic c and the assembler implementations.
 414
 415config CRYPTO_CAMELLIA
 416	tristate "Camellia"
 417	select CRYPTO_ALGAPI
 418	help
 419	  Camellia cipher algorithms (ISO/IEC 18033-3)
 420
 421	  Camellia is a symmetric key block cipher developed jointly
 422	  at NTT and Mitsubishi Electric Corporation.
 423
 424	  The Camellia specifies three key sizes: 128, 192 and 256 bits.
 425
 426	  See https://info.isl.ntt.co.jp/crypt/eng/camellia/ for further information.
 427
 428config CRYPTO_CAST_COMMON
 429	tristate
 430	help
 431	  Common parts of the CAST cipher algorithms shared by the
 432	  generic c and the assembler implementations.
 433
 434config CRYPTO_CAST5
 435	tristate "CAST5 (CAST-128)"
 436	select CRYPTO_ALGAPI
 437	select CRYPTO_CAST_COMMON
 438	help
 439	  CAST5 (CAST-128) cipher algorithm (RFC2144, ISO/IEC 18033-3)
 440
 441config CRYPTO_CAST6
 442	tristate "CAST6 (CAST-256)"
 443	select CRYPTO_ALGAPI
 444	select CRYPTO_CAST_COMMON
 445	help
 446	  CAST6 (CAST-256) encryption algorithm (RFC2612)
 447
 448config CRYPTO_DES
 449	tristate "DES and Triple DES EDE"
 450	select CRYPTO_ALGAPI
 451	select CRYPTO_LIB_DES
 452	help
 453	  DES (Data Encryption Standard)(FIPS 46-2, ISO/IEC 18033-3) and
 454	  Triple DES EDE (Encrypt/Decrypt/Encrypt) (FIPS 46-3, ISO/IEC 18033-3)
 455	  cipher algorithms
 456
 457config CRYPTO_FCRYPT
 458	tristate "FCrypt"
 459	select CRYPTO_ALGAPI
 460	select CRYPTO_SKCIPHER
 461	help
 462	  FCrypt algorithm used by RxRPC
 463
 464	  See https://ota.polyonymo.us/fcrypt-paper.txt
 465
 466config CRYPTO_KHAZAD
 467	tristate "Khazad"
 468	depends on CRYPTO_USER_API_ENABLE_OBSOLETE
 469	select CRYPTO_ALGAPI
 470	help
 471	  Khazad cipher algorithm
 472
 473	  Khazad was a finalist in the initial NESSIE competition.  It is
 474	  an algorithm optimized for 64-bit processors with good performance
 475	  on 32-bit processors.  Khazad uses an 128 bit key size.
 476
 477	  See https://web.archive.org/web/20171011071731/http://www.larc.usp.br/~pbarreto/KhazadPage.html
 478	  for further information.
 479
 480config CRYPTO_SEED
 481	tristate "SEED"
 482	depends on CRYPTO_USER_API_ENABLE_OBSOLETE
 483	select CRYPTO_ALGAPI
 484	help
 485	  SEED cipher algorithm (RFC4269, ISO/IEC 18033-3)
 486
 487	  SEED is a 128-bit symmetric key block cipher that has been
 488	  developed by KISA (Korea Information Security Agency) as a
 489	  national standard encryption algorithm of the Republic of Korea.
 490	  It is a 16 round block cipher with the key size of 128 bit.
 491
 492	  See https://seed.kisa.or.kr/kisa/algorithm/EgovSeedInfo.do
 493	  for further information.
 494
 495config CRYPTO_SERPENT
 496	tristate "Serpent"
 497	select CRYPTO_ALGAPI
 498	help
 499	  Serpent cipher algorithm, by Anderson, Biham & Knudsen
 500
 501	  Keys are allowed to be from 0 to 256 bits in length, in steps
 502	  of 8 bits.
 503
 504	  See https://www.cl.cam.ac.uk/~rja14/serpent.html for further information.
 505
 506config CRYPTO_SM4
 507	tristate
 508
 509config CRYPTO_SM4_GENERIC
 510	tristate "SM4 (ShangMi 4)"
 511	select CRYPTO_ALGAPI
 512	select CRYPTO_SM4
 513	help
 514	  SM4 cipher algorithms (OSCCA GB/T 32907-2016,
 515	  ISO/IEC 18033-3:2010/Amd 1:2021)
 516
 517	  SM4 (GBT.32907-2016) is a cryptographic standard issued by the
 518	  Organization of State Commercial Administration of China (OSCCA)
 519	  as an authorized cryptographic algorithms for the use within China.
 520
 521	  SMS4 was originally created for use in protecting wireless
 522	  networks, and is mandated in the Chinese National Standard for
 523	  Wireless LAN WAPI (Wired Authentication and Privacy Infrastructure)
 524	  (GB.15629.11-2003).
 525
 526	  The latest SM4 standard (GBT.32907-2016) was proposed by OSCCA and
 527	  standardized through TC 260 of the Standardization Administration
 528	  of the People's Republic of China (SAC).
 529
 530	  The input, output, and key of SMS4 are each 128 bits.
 531
 532	  See https://eprint.iacr.org/2008/329.pdf for further information.
 533
 534	  If unsure, say N.
 535
 536config CRYPTO_TEA
 537	tristate "TEA, XTEA and XETA"
 538	depends on CRYPTO_USER_API_ENABLE_OBSOLETE
 539	select CRYPTO_ALGAPI
 540	help
 541	  TEA (Tiny Encryption Algorithm) cipher algorithms
 542
 543	  Tiny Encryption Algorithm is a simple cipher that uses
 544	  many rounds for security.  It is very fast and uses
 545	  little memory.
 546
 547	  Xtendend Tiny Encryption Algorithm is a modification to
 548	  the TEA algorithm to address a potential key weakness
 549	  in the TEA algorithm.
 550
 551	  Xtendend Encryption Tiny Algorithm is a mis-implementation
 552	  of the XTEA algorithm for compatibility purposes.
 553
 554config CRYPTO_TWOFISH
 555	tristate "Twofish"
 556	select CRYPTO_ALGAPI
 557	select CRYPTO_TWOFISH_COMMON
 558	help
 559	  Twofish cipher algorithm
 560
 561	  Twofish was submitted as an AES (Advanced Encryption Standard)
 562	  candidate cipher by researchers at CounterPane Systems.  It is a
 563	  16 round block cipher supporting key sizes of 128, 192, and 256
 564	  bits.
 565
 566	  See https://www.schneier.com/twofish.html for further information.
 567
 568config CRYPTO_TWOFISH_COMMON
 569	tristate
 570	help
 571	  Common parts of the Twofish cipher algorithm shared by the
 572	  generic c and the assembler implementations.
 573
 574endmenu
 575
 576menu "Length-preserving ciphers and modes"
 577
 578config CRYPTO_ADIANTUM
 579	tristate "Adiantum"
 580	select CRYPTO_CHACHA20
 581	select CRYPTO_LIB_POLY1305_GENERIC
 582	select CRYPTO_NHPOLY1305
 583	select CRYPTO_MANAGER
 584	help
 585	  Adiantum tweakable, length-preserving encryption mode
 586
 587	  Designed for fast and secure disk encryption, especially on
 588	  CPUs without dedicated crypto instructions.  It encrypts
 589	  each sector using the XChaCha12 stream cipher, two passes of
 590	  an ε-almost-∆-universal hash function, and an invocation of
 591	  the AES-256 block cipher on a single 16-byte block.  On CPUs
 592	  without AES instructions, Adiantum is much faster than
 593	  AES-XTS.
 594
 595	  Adiantum's security is provably reducible to that of its
 596	  underlying stream and block ciphers, subject to a security
 597	  bound.  Unlike XTS, Adiantum is a true wide-block encryption
 598	  mode, so it actually provides an even stronger notion of
 599	  security than XTS, subject to the security bound.
 600
 601	  If unsure, say N.
 602
 603config CRYPTO_ARC4
 604	tristate "ARC4 (Alleged Rivest Cipher 4)"
 605	depends on CRYPTO_USER_API_ENABLE_OBSOLETE
 606	select CRYPTO_SKCIPHER
 607	select CRYPTO_LIB_ARC4
 608	help
 609	  ARC4 cipher algorithm
 610
 611	  ARC4 is a stream cipher using keys ranging from 8 bits to 2048
 612	  bits in length.  This algorithm is required for driver-based
 613	  WEP, but it should not be for other purposes because of the
 614	  weakness of the algorithm.
 615
 616config CRYPTO_CHACHA20
 617	tristate "ChaCha"
 618	select CRYPTO_LIB_CHACHA_GENERIC
 619	select CRYPTO_SKCIPHER
 620	help
 621	  The ChaCha20, XChaCha20, and XChaCha12 stream cipher algorithms
 622
 623	  ChaCha20 is a 256-bit high-speed stream cipher designed by Daniel J.
 624	  Bernstein and further specified in RFC7539 for use in IETF protocols.
 625	  This is the portable C implementation of ChaCha20.  See
 626	  https://cr.yp.to/chacha/chacha-20080128.pdf for further information.
 627
 628	  XChaCha20 is the application of the XSalsa20 construction to ChaCha20
 629	  rather than to Salsa20.  XChaCha20 extends ChaCha20's nonce length
 630	  from 64 bits (or 96 bits using the RFC7539 convention) to 192 bits,
 631	  while provably retaining ChaCha20's security.  See
 632	  https://cr.yp.to/snuffle/xsalsa-20081128.pdf for further information.
 633
 634	  XChaCha12 is XChaCha20 reduced to 12 rounds, with correspondingly
 635	  reduced security margin but increased performance.  It can be needed
 636	  in some performance-sensitive scenarios.
 637
 638config CRYPTO_CBC
 639	tristate "CBC (Cipher Block Chaining)"
 640	select CRYPTO_SKCIPHER
 641	select CRYPTO_MANAGER
 642	help
 643	  CBC (Cipher Block Chaining) mode (NIST SP800-38A)
 644
 645	  This block cipher mode is required for IPSec ESP (XFRM_ESP).
 646
 
 
 
 
 
 
 
 
 
 647config CRYPTO_CTR
 648	tristate "CTR (Counter)"
 649	select CRYPTO_SKCIPHER
 650	select CRYPTO_MANAGER
 651	help
 652	  CTR (Counter) mode (NIST SP800-38A)
 653
 654config CRYPTO_CTS
 655	tristate "CTS (Cipher Text Stealing)"
 656	select CRYPTO_SKCIPHER
 657	select CRYPTO_MANAGER
 658	help
 659	  CBC-CS3 variant of CTS (Cipher Text Stealing) (NIST
 660	  Addendum to SP800-38A (October 2010))
 661
 662	  This mode is required for Kerberos gss mechanism support
 663	  for AES encryption.
 664
 665config CRYPTO_ECB
 666	tristate "ECB (Electronic Codebook)"
 667	select CRYPTO_SKCIPHER2
 668	select CRYPTO_MANAGER
 669	help
 670	  ECB (Electronic Codebook) mode (NIST SP800-38A)
 671
 672config CRYPTO_HCTR2
 673	tristate "HCTR2"
 674	select CRYPTO_XCTR
 675	select CRYPTO_POLYVAL
 676	select CRYPTO_MANAGER
 677	help
 678	  HCTR2 length-preserving encryption mode
 679
 680	  A mode for storage encryption that is efficient on processors with
 681	  instructions to accelerate AES and carryless multiplication, e.g.
 682	  x86 processors with AES-NI and CLMUL, and ARM processors with the
 683	  ARMv8 crypto extensions.
 684
 685	  See https://eprint.iacr.org/2021/1441
 686
 687config CRYPTO_KEYWRAP
 688	tristate "KW (AES Key Wrap)"
 689	select CRYPTO_SKCIPHER
 690	select CRYPTO_MANAGER
 691	help
 692	  KW (AES Key Wrap) authenticated encryption mode (NIST SP800-38F
 693	  and RFC3394) without padding.
 694
 695config CRYPTO_LRW
 696	tristate "LRW (Liskov Rivest Wagner)"
 697	select CRYPTO_LIB_GF128MUL
 698	select CRYPTO_SKCIPHER
 699	select CRYPTO_MANAGER
 700	select CRYPTO_ECB
 701	help
 702	  LRW (Liskov Rivest Wagner) mode
 703
 704	  A tweakable, non malleable, non movable
 705	  narrow block cipher mode for dm-crypt.  Use it with cipher
 706	  specification string aes-lrw-benbi, the key must be 256, 320 or 384.
 707	  The first 128, 192 or 256 bits in the key are used for AES and the
 708	  rest is used to tie each cipher block to its logical position.
 709
 710	  See https://people.csail.mit.edu/rivest/pubs/LRW02.pdf
 711
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 712config CRYPTO_PCBC
 713	tristate "PCBC (Propagating Cipher Block Chaining)"
 714	select CRYPTO_SKCIPHER
 715	select CRYPTO_MANAGER
 716	help
 717	  PCBC (Propagating Cipher Block Chaining) mode
 718
 719	  This block cipher mode is required for RxRPC.
 720
 721config CRYPTO_XCTR
 722	tristate
 723	select CRYPTO_SKCIPHER
 724	select CRYPTO_MANAGER
 725	help
 726	  XCTR (XOR Counter) mode for HCTR2
 727
 728	  This blockcipher mode is a variant of CTR mode using XORs and little-endian
 729	  addition rather than big-endian arithmetic.
 730
 731	  XCTR mode is used to implement HCTR2.
 732
 733config CRYPTO_XTS
 734	tristate "XTS (XOR Encrypt XOR with ciphertext stealing)"
 735	select CRYPTO_SKCIPHER
 736	select CRYPTO_MANAGER
 737	select CRYPTO_ECB
 738	help
 739	  XTS (XOR Encrypt XOR with ciphertext stealing) mode (NIST SP800-38E
 740	  and IEEE 1619)
 741
 742	  Use with aes-xts-plain, key size 256, 384 or 512 bits. This
 743	  implementation currently can't handle a sectorsize which is not a
 744	  multiple of 16 bytes.
 745
 746config CRYPTO_NHPOLY1305
 747	tristate
 748	select CRYPTO_HASH
 749	select CRYPTO_LIB_POLY1305_GENERIC
 750
 751endmenu
 752
 753menu "AEAD (authenticated encryption with associated data) ciphers"
 754
 755config CRYPTO_AEGIS128
 756	tristate "AEGIS-128"
 757	select CRYPTO_AEAD
 758	select CRYPTO_AES  # for AES S-box tables
 759	help
 760	  AEGIS-128 AEAD algorithm
 761
 762config CRYPTO_AEGIS128_SIMD
 763	bool "AEGIS-128 (arm NEON, arm64 NEON)"
 764	depends on CRYPTO_AEGIS128 && ((ARM || ARM64) && KERNEL_MODE_NEON)
 765	default y
 766	help
 767	  AEGIS-128 AEAD algorithm
 768
 769	  Architecture: arm or arm64 using:
 770	  - NEON (Advanced SIMD) extension
 771
 772config CRYPTO_CHACHA20POLY1305
 773	tristate "ChaCha20-Poly1305"
 774	select CRYPTO_CHACHA20
 775	select CRYPTO_POLY1305
 776	select CRYPTO_AEAD
 777	select CRYPTO_MANAGER
 778	help
 779	  ChaCha20 stream cipher and Poly1305 authenticator combined
 780	  mode (RFC8439)
 781
 782config CRYPTO_CCM
 783	tristate "CCM (Counter with Cipher Block Chaining-MAC)"
 784	select CRYPTO_CTR
 785	select CRYPTO_HASH
 786	select CRYPTO_AEAD
 787	select CRYPTO_MANAGER
 788	help
 789	  CCM (Counter with Cipher Block Chaining-Message Authentication Code)
 790	  authenticated encryption mode (NIST SP800-38C)
 791
 792config CRYPTO_GCM
 793	tristate "GCM (Galois/Counter Mode) and GMAC (GCM MAC)"
 794	select CRYPTO_CTR
 795	select CRYPTO_AEAD
 796	select CRYPTO_GHASH
 797	select CRYPTO_NULL
 798	select CRYPTO_MANAGER
 799	help
 800	  GCM (Galois/Counter Mode) authenticated encryption mode and GMAC
 801	  (GCM Message Authentication Code) (NIST SP800-38D)
 802
 803	  This is required for IPSec ESP (XFRM_ESP).
 804
 805config CRYPTO_GENIV
 806	tristate
 807	select CRYPTO_AEAD
 
 808	select CRYPTO_NULL
 809	select CRYPTO_MANAGER
 810	select CRYPTO_RNG_DEFAULT
 811
 812config CRYPTO_SEQIV
 813	tristate "Sequence Number IV Generator"
 814	select CRYPTO_GENIV
 815	help
 816	  Sequence Number IV generator
 817
 818	  This IV generator generates an IV based on a sequence number by
 819	  xoring it with a salt.  This algorithm is mainly useful for CTR.
 820
 821	  This is required for IPsec ESP (XFRM_ESP).
 822
 823config CRYPTO_ECHAINIV
 824	tristate "Encrypted Chain IV Generator"
 825	select CRYPTO_GENIV
 
 
 
 826	help
 827	  Encrypted Chain IV generator
 828
 829	  This IV generator generates an IV based on the encryption of
 830	  a sequence number xored with a salt.  This is the default
 831	  algorithm for CBC.
 832
 833config CRYPTO_ESSIV
 834	tristate "Encrypted Salt-Sector IV Generator"
 835	select CRYPTO_AUTHENC
 836	help
 837	  Encrypted Salt-Sector IV generator
 838
 839	  This IV generator is used in some cases by fscrypt and/or
 840	  dm-crypt. It uses the hash of the block encryption key as the
 841	  symmetric key for a block encryption pass applied to the input
 842	  IV, making low entropy IV sources more suitable for block
 843	  encryption.
 844
 845	  This driver implements a crypto API template that can be
 846	  instantiated either as an skcipher or as an AEAD (depending on the
 847	  type of the first template argument), and which defers encryption
 848	  and decryption requests to the encapsulated cipher after applying
 849	  ESSIV to the input IV. Note that in the AEAD case, it is assumed
 850	  that the keys are presented in the same format used by the authenc
 851	  template, and that the IV appears at the end of the authenticated
 852	  associated data (AAD) region (which is how dm-crypt uses it.)
 853
 854	  Note that the use of ESSIV is not recommended for new deployments,
 855	  and so this only needs to be enabled when interoperability with
 856	  existing encrypted volumes of filesystems is required, or when
 857	  building for a particular system that requires it (e.g., when
 858	  the SoC in question has accelerated CBC but not XTS, making CBC
 859	  combined with ESSIV the only feasible mode for h/w accelerated
 860	  block encryption)
 861
 862endmenu
 863
 864menu "Hashes, digests, and MACs"
 865
 866config CRYPTO_BLAKE2B
 867	tristate "BLAKE2b"
 868	select CRYPTO_HASH
 869	help
 870	  BLAKE2b cryptographic hash function (RFC 7693)
 871
 872	  BLAKE2b is optimized for 64-bit platforms and can produce digests
 873	  of any size between 1 and 64 bytes. The keyed hash is also implemented.
 874
 875	  This module provides the following algorithms:
 876	  - blake2b-160
 877	  - blake2b-256
 878	  - blake2b-384
 879	  - blake2b-512
 880
 881	  Used by the btrfs filesystem.
 882
 883	  See https://blake2.net for further information.
 884
 885config CRYPTO_CMAC
 886	tristate "CMAC (Cipher-based MAC)"
 887	select CRYPTO_HASH
 888	select CRYPTO_MANAGER
 889	help
 890	  CMAC (Cipher-based Message Authentication Code) authentication
 891	  mode (NIST SP800-38B and IETF RFC4493)
 892
 893config CRYPTO_GHASH
 894	tristate "GHASH"
 895	select CRYPTO_HASH
 896	select CRYPTO_LIB_GF128MUL
 897	help
 898	  GCM GHASH function (NIST SP800-38D)
 899
 900config CRYPTO_HMAC
 901	tristate "HMAC (Keyed-Hash MAC)"
 902	select CRYPTO_HASH
 903	select CRYPTO_MANAGER
 904	help
 905	  HMAC (Keyed-Hash Message Authentication Code) (FIPS 198 and
 906	  RFC2104)
 907
 908	  This is required for IPsec AH (XFRM_AH) and IPsec ESP (XFRM_ESP).
 909
 910config CRYPTO_MD4
 911	tristate "MD4"
 912	select CRYPTO_HASH
 913	help
 914	  MD4 message digest algorithm (RFC1320)
 915
 916config CRYPTO_MD5
 917	tristate "MD5"
 918	select CRYPTO_HASH
 919	help
 920	  MD5 message digest algorithm (RFC1321)
 921
 922config CRYPTO_MICHAEL_MIC
 923	tristate "Michael MIC"
 924	select CRYPTO_HASH
 925	help
 926	  Michael MIC (Message Integrity Code) (IEEE 802.11i)
 927
 928	  Defined by the IEEE 802.11i TKIP (Temporal Key Integrity Protocol),
 929	  known as WPA (Wif-Fi Protected Access).
 930
 931	  This algorithm is required for TKIP, but it should not be used for
 932	  other purposes because of the weakness of the algorithm.
 933
 934config CRYPTO_POLYVAL
 935	tristate
 936	select CRYPTO_HASH
 937	select CRYPTO_LIB_GF128MUL
 938	help
 939	  POLYVAL hash function for HCTR2
 940
 941	  This is used in HCTR2.  It is not a general-purpose
 942	  cryptographic hash function.
 943
 944config CRYPTO_POLY1305
 945	tristate "Poly1305"
 946	select CRYPTO_HASH
 947	select CRYPTO_LIB_POLY1305_GENERIC
 948	help
 949	  Poly1305 authenticator algorithm (RFC7539)
 950
 951	  Poly1305 is an authenticator algorithm designed by Daniel J. Bernstein.
 952	  It is used for the ChaCha20-Poly1305 AEAD, specified in RFC7539 for use
 953	  in IETF protocols. This is the portable C implementation of Poly1305.
 954
 955config CRYPTO_RMD160
 956	tristate "RIPEMD-160"
 957	select CRYPTO_HASH
 958	help
 959	  RIPEMD-160 hash function (ISO/IEC 10118-3)
 960
 961	  RIPEMD-160 is a 160-bit cryptographic hash function. It is intended
 962	  to be used as a secure replacement for the 128-bit hash functions
 963	  MD4, MD5 and its predecessor RIPEMD
 964	  (not to be confused with RIPEMD-128).
 965
 966	  Its speed is comparable to SHA-1 and there are no known attacks
 967	  against RIPEMD-160.
 968
 969	  Developed by Hans Dobbertin, Antoon Bosselaers and Bart Preneel.
 970	  See https://homes.esat.kuleuven.be/~bosselae/ripemd160.html
 971	  for further information.
 972
 973config CRYPTO_SHA1
 974	tristate "SHA-1"
 975	select CRYPTO_HASH
 976	select CRYPTO_LIB_SHA1
 977	help
 978	  SHA-1 secure hash algorithm (FIPS 180, ISO/IEC 10118-3)
 979
 980config CRYPTO_SHA256
 981	tristate "SHA-224 and SHA-256"
 982	select CRYPTO_HASH
 983	select CRYPTO_LIB_SHA256
 984	help
 985	  SHA-224 and SHA-256 secure hash algorithms (FIPS 180, ISO/IEC 10118-3)
 986
 987	  This is required for IPsec AH (XFRM_AH) and IPsec ESP (XFRM_ESP).
 988	  Used by the btrfs filesystem, Ceph, NFS, and SMB.
 989
 990config CRYPTO_SHA512
 991	tristate "SHA-384 and SHA-512"
 992	select CRYPTO_HASH
 993	help
 994	  SHA-384 and SHA-512 secure hash algorithms (FIPS 180, ISO/IEC 10118-3)
 995
 996config CRYPTO_SHA3
 997	tristate "SHA-3"
 998	select CRYPTO_HASH
 999	help
1000	  SHA-3 secure hash algorithms (FIPS 202, ISO/IEC 10118-3)
1001
1002config CRYPTO_SM3
1003	tristate
1004
1005config CRYPTO_SM3_GENERIC
1006	tristate "SM3 (ShangMi 3)"
1007	select CRYPTO_HASH
1008	select CRYPTO_SM3
1009	help
1010	  SM3 (ShangMi 3) secure hash function (OSCCA GM/T 0004-2012, ISO/IEC 10118-3)
1011
1012	  This is part of the Chinese Commercial Cryptography suite.
1013
1014	  References:
1015	  http://www.oscca.gov.cn/UpFile/20101222141857786.pdf
1016	  https://datatracker.ietf.org/doc/html/draft-shen-sm3-hash
1017
1018config CRYPTO_STREEBOG
1019	tristate "Streebog"
1020	select CRYPTO_HASH
1021	help
1022	  Streebog Hash Function (GOST R 34.11-2012, RFC 6986, ISO/IEC 10118-3)
1023
1024	  This is one of the Russian cryptographic standard algorithms (called
1025	  GOST algorithms). This setting enables two hash algorithms with
1026	  256 and 512 bits output.
1027
1028	  References:
1029	  https://tc26.ru/upload/iblock/fed/feddbb4d26b685903faa2ba11aea43f6.pdf
1030	  https://tools.ietf.org/html/rfc6986
1031
1032config CRYPTO_VMAC
1033	tristate "VMAC"
1034	select CRYPTO_HASH
1035	select CRYPTO_MANAGER
1036	help
1037	  VMAC is a message authentication algorithm designed for
1038	  very high speed on 64-bit architectures.
1039
1040	  See https://fastcrypto.org/vmac for further information.
1041
1042config CRYPTO_WP512
1043	tristate "Whirlpool"
1044	select CRYPTO_HASH
1045	help
1046	  Whirlpool hash function (ISO/IEC 10118-3)
1047
1048	  512, 384 and 256-bit hashes.
1049
1050	  Whirlpool-512 is part of the NESSIE cryptographic primitives.
1051
1052	  See https://web.archive.org/web/20171129084214/http://www.larc.usp.br/~pbarreto/WhirlpoolPage.html
1053	  for further information.
1054
1055config CRYPTO_XCBC
1056	tristate "XCBC-MAC (Extended Cipher Block Chaining MAC)"
1057	select CRYPTO_HASH
1058	select CRYPTO_MANAGER
1059	help
1060	  XCBC-MAC (Extended Cipher Block Chaining Message Authentication
1061	  Code) (RFC3566)
1062
1063config CRYPTO_XXHASH
1064	tristate "xxHash"
1065	select CRYPTO_HASH
1066	select XXHASH
1067	help
1068	  xxHash non-cryptographic hash algorithm
1069
1070	  Extremely fast, working at speeds close to RAM limits.
1071
1072	  Used by the btrfs filesystem.
1073
1074endmenu
1075
1076menu "CRCs (cyclic redundancy checks)"
1077
1078config CRYPTO_CRC32C
1079	tristate "CRC32c"
1080	select CRYPTO_HASH
1081	select CRC32
1082	help
1083	  CRC32c CRC algorithm with the iSCSI polynomial (RFC 3385 and RFC 3720)
1084
1085	  A 32-bit CRC (cyclic redundancy check) with a polynomial defined
1086	  by G. Castagnoli, S. Braeuer and M. Herrman in "Optimization of Cyclic
1087	  Redundancy-Check Codes with 24 and 32 Parity Bits", IEEE Transactions
1088	  on Communications, Vol. 41, No. 6, June 1993, selected for use with
1089	  iSCSI.
1090
1091	  Used by btrfs, ext4, jbd2, NVMeoF/TCP, and iSCSI.
1092
1093config CRYPTO_CRC32
1094	tristate "CRC32"
1095	select CRYPTO_HASH
1096	select CRC32
1097	help
1098	  CRC32 CRC algorithm (IEEE 802.3)
1099
1100	  Used by RoCEv2 and f2fs.
1101
1102config CRYPTO_CRCT10DIF
1103	tristate "CRCT10DIF"
1104	select CRYPTO_HASH
1105	help
1106	  CRC16 CRC algorithm used for the T10 (SCSI) Data Integrity Field (DIF)
1107
1108	  CRC algorithm used by the SCSI Block Commands standard.
1109
1110config CRYPTO_CRC64_ROCKSOFT
1111	tristate "CRC64 based on Rocksoft Model algorithm"
1112	depends on CRC64
1113	select CRYPTO_HASH
1114	help
1115	  CRC64 CRC algorithm based on the Rocksoft Model CRC Algorithm
1116
1117	  Used by the NVMe implementation of T10 DIF (BLK_DEV_INTEGRITY)
1118
1119	  See https://zlib.net/crc_v3.txt
1120
1121endmenu
1122
1123menu "Compression"
1124
1125config CRYPTO_DEFLATE
1126	tristate "Deflate"
1127	select CRYPTO_ALGAPI
1128	select CRYPTO_ACOMP2
1129	select ZLIB_INFLATE
1130	select ZLIB_DEFLATE
1131	help
1132	  Deflate compression algorithm (RFC1951)
1133
1134	  Used by IPSec with the IPCOMP protocol (RFC3173, RFC2394)
1135
1136config CRYPTO_LZO
1137	tristate "LZO"
1138	select CRYPTO_ALGAPI
1139	select CRYPTO_ACOMP2
1140	select LZO_COMPRESS
1141	select LZO_DECOMPRESS
1142	help
1143	  LZO compression algorithm
1144
1145	  See https://www.oberhumer.com/opensource/lzo/ for further information.
1146
1147config CRYPTO_842
1148	tristate "842"
1149	select CRYPTO_ALGAPI
1150	select CRYPTO_ACOMP2
1151	select 842_COMPRESS
1152	select 842_DECOMPRESS
1153	help
1154	  842 compression algorithm by IBM
1155
1156	  See https://github.com/plauth/lib842 for further information.
1157
1158config CRYPTO_LZ4
1159	tristate "LZ4"
1160	select CRYPTO_ALGAPI
1161	select CRYPTO_ACOMP2
1162	select LZ4_COMPRESS
1163	select LZ4_DECOMPRESS
1164	help
1165	  LZ4 compression algorithm
1166
1167	  See https://github.com/lz4/lz4 for further information.
1168
1169config CRYPTO_LZ4HC
1170	tristate "LZ4HC"
1171	select CRYPTO_ALGAPI
1172	select CRYPTO_ACOMP2
1173	select LZ4HC_COMPRESS
1174	select LZ4_DECOMPRESS
1175	help
1176	  LZ4 high compression mode algorithm
1177
1178	  See https://github.com/lz4/lz4 for further information.
1179
1180config CRYPTO_ZSTD
1181	tristate "Zstd"
1182	select CRYPTO_ALGAPI
1183	select CRYPTO_ACOMP2
1184	select ZSTD_COMPRESS
1185	select ZSTD_DECOMPRESS
1186	help
1187	  zstd compression algorithm
1188
1189	  See https://github.com/facebook/zstd for further information.
1190
1191endmenu
1192
1193menu "Random number generation"
1194
1195config CRYPTO_ANSI_CPRNG
1196	tristate "ANSI PRNG (Pseudo Random Number Generator)"
1197	select CRYPTO_AES
1198	select CRYPTO_RNG
1199	help
1200	  Pseudo RNG (random number generator) (ANSI X9.31 Appendix A.2.4)
1201
1202	  This uses the AES cipher algorithm.
1203
1204	  Note that this option must be enabled if CRYPTO_FIPS is selected
1205
1206menuconfig CRYPTO_DRBG_MENU
1207	tristate "NIST SP800-90A DRBG (Deterministic Random Bit Generator)"
1208	help
1209	  DRBG (Deterministic Random Bit Generator) (NIST SP800-90A)
1210
1211	  In the following submenu, one or more of the DRBG types must be selected.
1212
1213if CRYPTO_DRBG_MENU
1214
1215config CRYPTO_DRBG_HMAC
1216	bool
1217	default y
1218	select CRYPTO_HMAC
1219	select CRYPTO_SHA512
1220
1221config CRYPTO_DRBG_HASH
1222	bool "Hash_DRBG"
1223	select CRYPTO_SHA256
1224	help
1225	  Hash_DRBG variant as defined in NIST SP800-90A.
1226
1227	  This uses the SHA-1, SHA-256, SHA-384, or SHA-512 hash algorithms.
1228
1229config CRYPTO_DRBG_CTR
1230	bool "CTR_DRBG"
1231	select CRYPTO_AES
1232	select CRYPTO_CTR
1233	help
1234	  CTR_DRBG variant as defined in NIST SP800-90A.
1235
1236	  This uses the AES cipher algorithm with the counter block mode.
1237
1238config CRYPTO_DRBG
1239	tristate
1240	default CRYPTO_DRBG_MENU
1241	select CRYPTO_RNG
1242	select CRYPTO_JITTERENTROPY
1243
1244endif	# if CRYPTO_DRBG_MENU
1245
1246config CRYPTO_JITTERENTROPY
1247	tristate "CPU Jitter Non-Deterministic RNG (Random Number Generator)"
1248	select CRYPTO_RNG
1249	select CRYPTO_SHA3
1250	help
1251	  CPU Jitter RNG (Random Number Generator) from the Jitterentropy library
1252
1253	  A non-physical non-deterministic ("true") RNG (e.g., an entropy source
1254	  compliant with NIST SP800-90B) intended to provide a seed to a
1255	  deterministic RNG (e.g., per NIST SP800-90C).
1256	  This RNG does not perform any cryptographic whitening of the generated
1257	  random numbers.
1258
1259	  See https://www.chronox.de/jent/
1260
1261if CRYPTO_JITTERENTROPY
1262if CRYPTO_FIPS && EXPERT
1263
1264choice
1265	prompt "CPU Jitter RNG Memory Size"
1266	default CRYPTO_JITTERENTROPY_MEMSIZE_2
1267	help
1268	  The Jitter RNG measures the execution time of memory accesses.
1269	  Multiple consecutive memory accesses are performed. If the memory
1270	  size fits into a cache (e.g. L1), only the memory access timing
1271	  to that cache is measured. The closer the cache is to the CPU
1272	  the less variations are measured and thus the less entropy is
1273	  obtained. Thus, if the memory size fits into the L1 cache, the
1274	  obtained entropy is less than if the memory size fits within
1275	  L1 + L2, which in turn is less if the memory fits into
1276	  L1 + L2 + L3. Thus, by selecting a different memory size,
1277	  the entropy rate produced by the Jitter RNG can be modified.
1278
1279	config CRYPTO_JITTERENTROPY_MEMSIZE_2
1280		bool "2048 Bytes (default)"
1281
1282	config CRYPTO_JITTERENTROPY_MEMSIZE_128
1283		bool "128 kBytes"
1284
1285	config CRYPTO_JITTERENTROPY_MEMSIZE_1024
1286		bool "1024 kBytes"
1287
1288	config CRYPTO_JITTERENTROPY_MEMSIZE_8192
1289		bool "8192 kBytes"
1290endchoice
1291
1292config CRYPTO_JITTERENTROPY_MEMORY_BLOCKS
1293	int
1294	default 64 if CRYPTO_JITTERENTROPY_MEMSIZE_2
1295	default 512 if CRYPTO_JITTERENTROPY_MEMSIZE_128
1296	default 1024 if CRYPTO_JITTERENTROPY_MEMSIZE_1024
1297	default 4096 if CRYPTO_JITTERENTROPY_MEMSIZE_8192
1298
1299config CRYPTO_JITTERENTROPY_MEMORY_BLOCKSIZE
1300	int
1301	default 32 if CRYPTO_JITTERENTROPY_MEMSIZE_2
1302	default 256 if CRYPTO_JITTERENTROPY_MEMSIZE_128
1303	default 1024 if CRYPTO_JITTERENTROPY_MEMSIZE_1024
1304	default 2048 if CRYPTO_JITTERENTROPY_MEMSIZE_8192
1305
1306config CRYPTO_JITTERENTROPY_OSR
1307	int "CPU Jitter RNG Oversampling Rate"
1308	range 1 15
1309	default 3
1310	help
1311	  The Jitter RNG allows the specification of an oversampling rate (OSR).
1312	  The Jitter RNG operation requires a fixed amount of timing
1313	  measurements to produce one output block of random numbers. The
1314	  OSR value is multiplied with the amount of timing measurements to
1315	  generate one output block. Thus, the timing measurement is oversampled
1316	  by the OSR factor. The oversampling allows the Jitter RNG to operate
1317	  on hardware whose timers deliver limited amount of entropy (e.g.
1318	  the timer is coarse) by setting the OSR to a higher value. The
1319	  trade-off, however, is that the Jitter RNG now requires more time
1320	  to generate random numbers.
1321
1322config CRYPTO_JITTERENTROPY_TESTINTERFACE
1323	bool "CPU Jitter RNG Test Interface"
1324	help
1325	  The test interface allows a privileged process to capture
1326	  the raw unconditioned high resolution time stamp noise that
1327	  is collected by the Jitter RNG for statistical analysis. As
1328	  this data is used at the same time to generate random bits,
1329	  the Jitter RNG operates in an insecure mode as long as the
1330	  recording is enabled. This interface therefore is only
1331	  intended for testing purposes and is not suitable for
1332	  production systems.
1333
1334	  The raw noise data can be obtained using the jent_raw_hires
1335	  debugfs file. Using the option
1336	  jitterentropy_testing.boot_raw_hires_test=1 the raw noise of
1337	  the first 1000 entropy events since boot can be sampled.
1338
1339	  If unsure, select N.
1340
1341endif	# if CRYPTO_FIPS && EXPERT
1342
1343if !(CRYPTO_FIPS && EXPERT)
1344
1345config CRYPTO_JITTERENTROPY_MEMORY_BLOCKS
1346	int
1347	default 64
1348
1349config CRYPTO_JITTERENTROPY_MEMORY_BLOCKSIZE
1350	int
1351	default 32
1352
1353config CRYPTO_JITTERENTROPY_OSR
1354	int
1355	default 1
1356
1357config CRYPTO_JITTERENTROPY_TESTINTERFACE
1358	bool
1359
1360endif	# if !(CRYPTO_FIPS && EXPERT)
1361endif	# if CRYPTO_JITTERENTROPY
1362
1363config CRYPTO_KDF800108_CTR
1364	tristate
1365	select CRYPTO_HMAC
1366	select CRYPTO_SHA256
1367
1368endmenu
1369menu "Userspace interface"
1370
1371config CRYPTO_USER_API
1372	tristate
1373
1374config CRYPTO_USER_API_HASH
1375	tristate "Hash algorithms"
1376	depends on NET
1377	select CRYPTO_HASH
1378	select CRYPTO_USER_API
1379	help
1380	  Enable the userspace interface for hash algorithms.
1381
1382	  See Documentation/crypto/userspace-if.rst and
1383	  https://www.chronox.de/libkcapi/html/index.html
1384
1385config CRYPTO_USER_API_SKCIPHER
1386	tristate "Symmetric key cipher algorithms"
1387	depends on NET
1388	select CRYPTO_SKCIPHER
1389	select CRYPTO_USER_API
1390	help
1391	  Enable the userspace interface for symmetric key cipher algorithms.
1392
1393	  See Documentation/crypto/userspace-if.rst and
1394	  https://www.chronox.de/libkcapi/html/index.html
1395
1396config CRYPTO_USER_API_RNG
1397	tristate "RNG (random number generator) algorithms"
1398	depends on NET
1399	select CRYPTO_RNG
1400	select CRYPTO_USER_API
1401	help
1402	  Enable the userspace interface for RNG (random number generator)
1403	  algorithms.
1404
1405	  See Documentation/crypto/userspace-if.rst and
1406	  https://www.chronox.de/libkcapi/html/index.html
1407
1408config CRYPTO_USER_API_RNG_CAVP
1409	bool "Enable CAVP testing of DRBG"
1410	depends on CRYPTO_USER_API_RNG && CRYPTO_DRBG
1411	help
1412	  Enable extra APIs in the userspace interface for NIST CAVP
1413	  (Cryptographic Algorithm Validation Program) testing:
1414	  - resetting DRBG entropy
1415	  - providing Additional Data
1416
1417	  This should only be enabled for CAVP testing. You should say
1418	  no unless you know what this is.
1419
1420config CRYPTO_USER_API_AEAD
1421	tristate "AEAD cipher algorithms"
1422	depends on NET
1423	select CRYPTO_AEAD
1424	select CRYPTO_SKCIPHER
1425	select CRYPTO_NULL
1426	select CRYPTO_USER_API
1427	help
1428	  Enable the userspace interface for AEAD cipher algorithms.
1429
1430	  See Documentation/crypto/userspace-if.rst and
1431	  https://www.chronox.de/libkcapi/html/index.html
1432
1433config CRYPTO_USER_API_ENABLE_OBSOLETE
1434	bool "Obsolete cryptographic algorithms"
1435	depends on CRYPTO_USER_API
1436	default y
1437	help
1438	  Allow obsolete cryptographic algorithms to be selected that have
1439	  already been phased out from internal use by the kernel, and are
1440	  only useful for userspace clients that still rely on them.
1441
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1442endmenu
1443
1444config CRYPTO_HASH_INFO
1445	bool
1446
1447if !KMSAN # avoid false positives from assembly
1448if ARM
1449source "arch/arm/crypto/Kconfig"
1450endif
1451if ARM64
1452source "arch/arm64/crypto/Kconfig"
1453endif
1454if LOONGARCH
1455source "arch/loongarch/crypto/Kconfig"
1456endif
1457if MIPS
1458source "arch/mips/crypto/Kconfig"
1459endif
1460if PPC
1461source "arch/powerpc/crypto/Kconfig"
1462endif
1463if RISCV
1464source "arch/riscv/crypto/Kconfig"
1465endif
1466if S390
1467source "arch/s390/crypto/Kconfig"
1468endif
1469if SPARC
1470source "arch/sparc/crypto/Kconfig"
1471endif
1472if X86
1473source "arch/x86/crypto/Kconfig"
1474endif
1475endif
1476
1477source "drivers/crypto/Kconfig"
1478source "crypto/asymmetric_keys/Kconfig"
1479source "certs/Kconfig"
1480
1481endif	# if CRYPTO

   1# SPDX-License-Identifier: GPL-2.0
   2#
   3# Generic algorithms support
   4#
   5config XOR_BLOCKS
   6	tristate
   7
   8#
   9# async_tx api: hardware offloaded memory transfer/transform support
  10#
  11source "crypto/async_tx/Kconfig"
  12
  13#
  14# Cryptographic API Configuration
  15#
  16menuconfig CRYPTO
  17	tristate "Cryptographic API"
  18	select CRYPTO_LIB_UTILS
  19	help
  20	  This option provides the core Cryptographic API.
  21
  22if CRYPTO
  23
  24menu "Crypto core or helper"
  25
  26config CRYPTO_FIPS
  27	bool "FIPS 200 compliance"
  28	depends on (CRYPTO_ANSI_CPRNG || CRYPTO_DRBG) && !CRYPTO_MANAGER_DISABLE_TESTS
  29	depends on (MODULE_SIG || !MODULES)
  30	help
  31	  This option enables the fips boot option which is
  32	  required if you want the system to operate in a FIPS 200
  33	  certification.  You should say no unless you know what
  34	  this is.
  35
  36config CRYPTO_FIPS_NAME
  37	string "FIPS Module Name"
  38	default "Linux Kernel Cryptographic API"
  39	depends on CRYPTO_FIPS
  40	help
  41	  This option sets the FIPS Module name reported by the Crypto API via
  42	  the /proc/sys/crypto/fips_name file.
  43
  44config CRYPTO_FIPS_CUSTOM_VERSION
  45	bool "Use Custom FIPS Module Version"
  46	depends on CRYPTO_FIPS
  47	default n
  48
  49config CRYPTO_FIPS_VERSION
  50	string "FIPS Module Version"
  51	default "(none)"
  52	depends on CRYPTO_FIPS_CUSTOM_VERSION
  53	help
  54	  This option provides the ability to override the FIPS Module Version.
  55	  By default the KERNELRELEASE value is used.
  56
  57config CRYPTO_ALGAPI
  58	tristate
  59	select CRYPTO_ALGAPI2
  60	help
  61	  This option provides the API for cryptographic algorithms.
  62
  63config CRYPTO_ALGAPI2
  64	tristate
  65
  66config CRYPTO_AEAD
  67	tristate
  68	select CRYPTO_AEAD2
  69	select CRYPTO_ALGAPI
  70
  71config CRYPTO_AEAD2
  72	tristate
  73	select CRYPTO_ALGAPI2
  74	select CRYPTO_NULL2
  75	select CRYPTO_RNG2
 
 
 
 
 
 
 
  76
  77config CRYPTO_SKCIPHER
  78	tristate
  79	select CRYPTO_SKCIPHER2
  80	select CRYPTO_ALGAPI
 
  81
  82config CRYPTO_SKCIPHER2
  83	tristate
  84	select CRYPTO_ALGAPI2
  85	select CRYPTO_RNG2
  86
  87config CRYPTO_HASH
  88	tristate
  89	select CRYPTO_HASH2
  90	select CRYPTO_ALGAPI
  91
  92config CRYPTO_HASH2
  93	tristate
  94	select CRYPTO_ALGAPI2
  95
  96config CRYPTO_RNG
  97	tristate
  98	select CRYPTO_RNG2
  99	select CRYPTO_ALGAPI
 100
 101config CRYPTO_RNG2
 102	tristate
 103	select CRYPTO_ALGAPI2
 104
 105config CRYPTO_RNG_DEFAULT
 106	tristate
 107	select CRYPTO_DRBG_MENU
 108
 109config CRYPTO_AKCIPHER2
 110	tristate
 111	select CRYPTO_ALGAPI2
 112
 113config CRYPTO_AKCIPHER
 114	tristate
 115	select CRYPTO_AKCIPHER2
 116	select CRYPTO_ALGAPI
 117
 118config CRYPTO_KPP2
 119	tristate
 120	select CRYPTO_ALGAPI2
 121
 122config CRYPTO_KPP
 123	tristate
 124	select CRYPTO_ALGAPI
 125	select CRYPTO_KPP2
 126
 127config CRYPTO_ACOMP2
 128	tristate
 129	select CRYPTO_ALGAPI2
 130	select SGL_ALLOC
 131
 132config CRYPTO_ACOMP
 133	tristate
 134	select CRYPTO_ALGAPI
 135	select CRYPTO_ACOMP2
 136
 137config CRYPTO_MANAGER
 138	tristate "Cryptographic algorithm manager"
 139	select CRYPTO_MANAGER2
 140	help
 141	  Create default cryptographic template instantiations such as
 142	  cbc(aes).
 143
 144config CRYPTO_MANAGER2
 145	def_tristate CRYPTO_MANAGER || (CRYPTO_MANAGER!=n && CRYPTO_ALGAPI=y)
 
 146	select CRYPTO_AEAD2
 
 
 147	select CRYPTO_HASH2
 
 
 148	select CRYPTO_SKCIPHER2
 149	select CRYPTO_AKCIPHER2
 150	select CRYPTO_KPP2
 151	select CRYPTO_ACOMP2
 152
 153config CRYPTO_USER
 154	tristate "Userspace cryptographic algorithm configuration"
 155	depends on NET
 156	select CRYPTO_MANAGER
 157	help
 158	  Userspace configuration for cryptographic instantiations such as
 159	  cbc(aes).
 160
 161config CRYPTO_MANAGER_DISABLE_TESTS
 162	bool "Disable run-time self tests"
 163	default y
 164	help
 165	  Disable run-time self tests that normally take place at
 166	  algorithm registration.
 167
 168config CRYPTO_MANAGER_EXTRA_TESTS
 169	bool "Enable extra run-time crypto self tests"
 170	depends on DEBUG_KERNEL && !CRYPTO_MANAGER_DISABLE_TESTS && CRYPTO_MANAGER
 171	help
 172	  Enable extra run-time self tests of registered crypto algorithms,
 173	  including randomized fuzz tests.
 174
 175	  This is intended for developer use only, as these tests take much
 176	  longer to run than the normal self tests.
 177
 178config CRYPTO_NULL
 179	tristate "Null algorithms"
 180	select CRYPTO_NULL2
 181	help
 182	  These are 'Null' algorithms, used by IPsec, which do nothing.
 183
 184config CRYPTO_NULL2
 185	tristate
 186	select CRYPTO_ALGAPI2
 187	select CRYPTO_SKCIPHER2
 188	select CRYPTO_HASH2
 189
 190config CRYPTO_PCRYPT
 191	tristate "Parallel crypto engine"
 192	depends on SMP
 193	select PADATA
 194	select CRYPTO_MANAGER
 195	select CRYPTO_AEAD
 196	help
 197	  This converts an arbitrary crypto algorithm into a parallel
 198	  algorithm that executes in kernel threads.
 199
 200config CRYPTO_CRYPTD
 201	tristate "Software async crypto daemon"
 202	select CRYPTO_SKCIPHER
 203	select CRYPTO_HASH
 204	select CRYPTO_MANAGER
 205	help
 206	  This is a generic software asynchronous crypto daemon that
 207	  converts an arbitrary synchronous software crypto algorithm
 208	  into an asynchronous algorithm that executes in a kernel thread.
 209
 210config CRYPTO_AUTHENC
 211	tristate "Authenc support"
 212	select CRYPTO_AEAD
 213	select CRYPTO_SKCIPHER
 214	select CRYPTO_MANAGER
 215	select CRYPTO_HASH
 216	select CRYPTO_NULL
 217	help
 218	  Authenc: Combined mode wrapper for IPsec.
 219
 220	  This is required for IPSec ESP (XFRM_ESP).
 221
 222config CRYPTO_TEST
 223	tristate "Testing module"
 224	depends on m || EXPERT
 225	select CRYPTO_MANAGER
 226	help
 227	  Quick & dirty crypto test module.
 228
 229config CRYPTO_SIMD
 230	tristate
 231	select CRYPTO_CRYPTD
 232
 233config CRYPTO_ENGINE
 234	tristate
 235
 236endmenu
 237
 238menu "Public-key cryptography"
 239
 240config CRYPTO_RSA
 241	tristate "RSA (Rivest-Shamir-Adleman)"
 242	select CRYPTO_AKCIPHER
 243	select CRYPTO_MANAGER
 
 244	select MPILIB
 245	select ASN1
 246	help
 247	  RSA (Rivest-Shamir-Adleman) public key algorithm (RFC8017)
 248
 249config CRYPTO_DH
 250	tristate "DH (Diffie-Hellman)"
 251	select CRYPTO_KPP
 252	select MPILIB
 253	help
 254	  DH (Diffie-Hellman) key exchange algorithm
 255
 256config CRYPTO_DH_RFC7919_GROUPS
 257	bool "RFC 7919 FFDHE groups"
 258	depends on CRYPTO_DH
 259	select CRYPTO_RNG_DEFAULT
 260	help
 261	  FFDHE (Finite-Field-based Diffie-Hellman Ephemeral) groups
 262	  defined in RFC7919.
 263
 264	  Support these finite-field groups in DH key exchanges:
 265	  - ffdhe2048, ffdhe3072, ffdhe4096, ffdhe6144, ffdhe8192
 266
 267	  If unsure, say N.
 268
 269config CRYPTO_ECC
 270	tristate
 271	select CRYPTO_RNG_DEFAULT
 272
 273config CRYPTO_ECDH
 274	tristate "ECDH (Elliptic Curve Diffie-Hellman)"
 275	select CRYPTO_ECC
 276	select CRYPTO_KPP
 277	help
 278	  ECDH (Elliptic Curve Diffie-Hellman) key exchange algorithm
 279	  using curves P-192, P-256, and P-384 (FIPS 186)
 280
 281config CRYPTO_ECDSA
 282	tristate "ECDSA (Elliptic Curve Digital Signature Algorithm)"
 283	select CRYPTO_ECC
 284	select CRYPTO_AKCIPHER
 285	select ASN1
 286	help
 287	  ECDSA (Elliptic Curve Digital Signature Algorithm) (FIPS 186,
 288	  ISO/IEC 14888-3)
 289	  using curves P-192, P-256, and P-384
 290
 291	  Only signature verification is implemented.
 292
 293config CRYPTO_ECRDSA
 294	tristate "EC-RDSA (Elliptic Curve Russian Digital Signature Algorithm)"
 295	select CRYPTO_ECC
 296	select CRYPTO_AKCIPHER
 297	select CRYPTO_STREEBOG
 298	select OID_REGISTRY
 299	select ASN1
 300	help
 301	  Elliptic Curve Russian Digital Signature Algorithm (GOST R 34.10-2012,
 302	  RFC 7091, ISO/IEC 14888-3)
 303
 304	  One of the Russian cryptographic standard algorithms (called GOST
 305	  algorithms). Only signature verification is implemented.
 306
 307config CRYPTO_SM2
 308	tristate "SM2 (ShangMi 2)"
 309	select CRYPTO_SM3
 310	select CRYPTO_AKCIPHER
 311	select CRYPTO_MANAGER
 312	select MPILIB
 313	select ASN1
 314	help
 315	  SM2 (ShangMi 2) public key algorithm
 316
 317	  Published by State Encryption Management Bureau, China,
 318	  as specified by OSCCA GM/T 0003.1-2012 -- 0003.5-2012.
 319
 320	  References:
 321	  https://datatracker.ietf.org/doc/draft-shen-sm2-ecdsa/
 322	  http://www.oscca.gov.cn/sca/xxgk/2010-12/17/content_1002386.shtml
 323	  http://www.gmbz.org.cn/main/bzlb.html
 324
 325config CRYPTO_CURVE25519
 326	tristate "Curve25519"
 327	select CRYPTO_KPP
 328	select CRYPTO_LIB_CURVE25519_GENERIC
 329	help
 330	  Curve25519 elliptic curve (RFC7748)
 331
 332endmenu
 333
 334menu "Block ciphers"
 335
 336config CRYPTO_AES
 337	tristate "AES (Advanced Encryption Standard)"
 338	select CRYPTO_ALGAPI
 339	select CRYPTO_LIB_AES
 340	help
 341	  AES cipher algorithms (Rijndael)(FIPS-197, ISO/IEC 18033-3)
 342
 343	  Rijndael appears to be consistently a very good performer in
 344	  both hardware and software across a wide range of computing
 345	  environments regardless of its use in feedback or non-feedback
 346	  modes. Its key setup time is excellent, and its key agility is
 347	  good. Rijndael's very low memory requirements make it very well
 348	  suited for restricted-space environments, in which it also
 349	  demonstrates excellent performance. Rijndael's operations are
 350	  among the easiest to defend against power and timing attacks.
 351
 352	  The AES specifies three key sizes: 128, 192 and 256 bits
 353
 354config CRYPTO_AES_TI
 355	tristate "AES (Advanced Encryption Standard) (fixed time)"
 356	select CRYPTO_ALGAPI
 357	select CRYPTO_LIB_AES
 358	help
 359	  AES cipher algorithms (Rijndael)(FIPS-197, ISO/IEC 18033-3)
 360
 361	  This is a generic implementation of AES that attempts to eliminate
 362	  data dependent latencies as much as possible without affecting
 363	  performance too much. It is intended for use by the generic CCM
 364	  and GCM drivers, and other CTR or CMAC/XCBC based modes that rely
 365	  solely on encryption (although decryption is supported as well, but
 366	  with a more dramatic performance hit)
 367
 368	  Instead of using 16 lookup tables of 1 KB each, (8 for encryption and
 369	  8 for decryption), this implementation only uses just two S-boxes of
 370	  256 bytes each, and attempts to eliminate data dependent latencies by
 371	  prefetching the entire table into the cache at the start of each
 372	  block. Interrupts are also disabled to avoid races where cachelines
 373	  are evicted when the CPU is interrupted to do something else.
 374
 375config CRYPTO_ANUBIS
 376	tristate "Anubis"
 377	depends on CRYPTO_USER_API_ENABLE_OBSOLETE
 378	select CRYPTO_ALGAPI
 379	help
 380	  Anubis cipher algorithm
 381
 382	  Anubis is a variable key length cipher which can use keys from
 383	  128 bits to 320 bits in length.  It was evaluated as a entrant
 384	  in the NESSIE competition.
 385
 386	  See https://web.archive.org/web/20160606112246/http://www.larc.usp.br/~pbarreto/AnubisPage.html
 387	  for further information.
 388
 389config CRYPTO_ARIA
 390	tristate "ARIA"
 391	select CRYPTO_ALGAPI
 392	help
 393	  ARIA cipher algorithm (RFC5794)
 394
 395	  ARIA is a standard encryption algorithm of the Republic of Korea.
 396	  The ARIA specifies three key sizes and rounds.
 397	  128-bit: 12 rounds.
 398	  192-bit: 14 rounds.
 399	  256-bit: 16 rounds.
 400
 401	  See:
 402	  https://seed.kisa.or.kr/kisa/algorithm/EgovAriaInfo.do
 403
 404config CRYPTO_BLOWFISH
 405	tristate "Blowfish"
 406	select CRYPTO_ALGAPI
 407	select CRYPTO_BLOWFISH_COMMON
 408	help
 409	  Blowfish cipher algorithm, by Bruce Schneier
 410
 411	  This is a variable key length cipher which can use keys from 32
 412	  bits to 448 bits in length.  It's fast, simple and specifically
 413	  designed for use on "large microprocessors".
 414
 415	  See https://www.schneier.com/blowfish.html for further information.
 416
 417config CRYPTO_BLOWFISH_COMMON
 418	tristate
 419	help
 420	  Common parts of the Blowfish cipher algorithm shared by the
 421	  generic c and the assembler implementations.
 422
 423config CRYPTO_CAMELLIA
 424	tristate "Camellia"
 425	select CRYPTO_ALGAPI
 426	help
 427	  Camellia cipher algorithms (ISO/IEC 18033-3)
 428
 429	  Camellia is a symmetric key block cipher developed jointly
 430	  at NTT and Mitsubishi Electric Corporation.
 431
 432	  The Camellia specifies three key sizes: 128, 192 and 256 bits.
 433
 434	  See https://info.isl.ntt.co.jp/crypt/eng/camellia/ for further information.
 435
 436config CRYPTO_CAST_COMMON
 437	tristate
 438	help
 439	  Common parts of the CAST cipher algorithms shared by the
 440	  generic c and the assembler implementations.
 441
 442config CRYPTO_CAST5
 443	tristate "CAST5 (CAST-128)"
 444	select CRYPTO_ALGAPI
 445	select CRYPTO_CAST_COMMON
 446	help
 447	  CAST5 (CAST-128) cipher algorithm (RFC2144, ISO/IEC 18033-3)
 448
 449config CRYPTO_CAST6
 450	tristate "CAST6 (CAST-256)"
 451	select CRYPTO_ALGAPI
 452	select CRYPTO_CAST_COMMON
 453	help
 454	  CAST6 (CAST-256) encryption algorithm (RFC2612)
 455
 456config CRYPTO_DES
 457	tristate "DES and Triple DES EDE"
 458	select CRYPTO_ALGAPI
 459	select CRYPTO_LIB_DES
 460	help
 461	  DES (Data Encryption Standard)(FIPS 46-2, ISO/IEC 18033-3) and
 462	  Triple DES EDE (Encrypt/Decrypt/Encrypt) (FIPS 46-3, ISO/IEC 18033-3)
 463	  cipher algorithms
 464
 465config CRYPTO_FCRYPT
 466	tristate "FCrypt"
 467	select CRYPTO_ALGAPI
 468	select CRYPTO_SKCIPHER
 469	help
 470	  FCrypt algorithm used by RxRPC
 471
 472	  See https://ota.polyonymo.us/fcrypt-paper.txt
 473
 474config CRYPTO_KHAZAD
 475	tristate "Khazad"
 476	depends on CRYPTO_USER_API_ENABLE_OBSOLETE
 477	select CRYPTO_ALGAPI
 478	help
 479	  Khazad cipher algorithm
 480
 481	  Khazad was a finalist in the initial NESSIE competition.  It is
 482	  an algorithm optimized for 64-bit processors with good performance
 483	  on 32-bit processors.  Khazad uses an 128 bit key size.
 484
 485	  See https://web.archive.org/web/20171011071731/http://www.larc.usp.br/~pbarreto/KhazadPage.html
 486	  for further information.
 487
 488config CRYPTO_SEED
 489	tristate "SEED"
 490	depends on CRYPTO_USER_API_ENABLE_OBSOLETE
 491	select CRYPTO_ALGAPI
 492	help
 493	  SEED cipher algorithm (RFC4269, ISO/IEC 18033-3)
 494
 495	  SEED is a 128-bit symmetric key block cipher that has been
 496	  developed by KISA (Korea Information Security Agency) as a
 497	  national standard encryption algorithm of the Republic of Korea.
 498	  It is a 16 round block cipher with the key size of 128 bit.
 499
 500	  See https://seed.kisa.or.kr/kisa/algorithm/EgovSeedInfo.do
 501	  for further information.
 502
 503config CRYPTO_SERPENT
 504	tristate "Serpent"
 505	select CRYPTO_ALGAPI
 506	help
 507	  Serpent cipher algorithm, by Anderson, Biham & Knudsen
 508
 509	  Keys are allowed to be from 0 to 256 bits in length, in steps
 510	  of 8 bits.
 511
 512	  See https://www.cl.cam.ac.uk/~rja14/serpent.html for further information.
 513
 514config CRYPTO_SM4
 515	tristate
 516
 517config CRYPTO_SM4_GENERIC
 518	tristate "SM4 (ShangMi 4)"
 519	select CRYPTO_ALGAPI
 520	select CRYPTO_SM4
 521	help
 522	  SM4 cipher algorithms (OSCCA GB/T 32907-2016,
 523	  ISO/IEC 18033-3:2010/Amd 1:2021)
 524
 525	  SM4 (GBT.32907-2016) is a cryptographic standard issued by the
 526	  Organization of State Commercial Administration of China (OSCCA)
 527	  as an authorized cryptographic algorithms for the use within China.
 528
 529	  SMS4 was originally created for use in protecting wireless
 530	  networks, and is mandated in the Chinese National Standard for
 531	  Wireless LAN WAPI (Wired Authentication and Privacy Infrastructure)
 532	  (GB.15629.11-2003).
 533
 534	  The latest SM4 standard (GBT.32907-2016) was proposed by OSCCA and
 535	  standardized through TC 260 of the Standardization Administration
 536	  of the People's Republic of China (SAC).
 537
 538	  The input, output, and key of SMS4 are each 128 bits.
 539
 540	  See https://eprint.iacr.org/2008/329.pdf for further information.
 541
 542	  If unsure, say N.
 543
 544config CRYPTO_TEA
 545	tristate "TEA, XTEA and XETA"
 546	depends on CRYPTO_USER_API_ENABLE_OBSOLETE
 547	select CRYPTO_ALGAPI
 548	help
 549	  TEA (Tiny Encryption Algorithm) cipher algorithms
 550
 551	  Tiny Encryption Algorithm is a simple cipher that uses
 552	  many rounds for security.  It is very fast and uses
 553	  little memory.
 554
 555	  Xtendend Tiny Encryption Algorithm is a modification to
 556	  the TEA algorithm to address a potential key weakness
 557	  in the TEA algorithm.
 558
 559	  Xtendend Encryption Tiny Algorithm is a mis-implementation
 560	  of the XTEA algorithm for compatibility purposes.
 561
 562config CRYPTO_TWOFISH
 563	tristate "Twofish"
 564	select CRYPTO_ALGAPI
 565	select CRYPTO_TWOFISH_COMMON
 566	help
 567	  Twofish cipher algorithm
 568
 569	  Twofish was submitted as an AES (Advanced Encryption Standard)
 570	  candidate cipher by researchers at CounterPane Systems.  It is a
 571	  16 round block cipher supporting key sizes of 128, 192, and 256
 572	  bits.
 573
 574	  See https://www.schneier.com/twofish.html for further information.
 575
 576config CRYPTO_TWOFISH_COMMON
 577	tristate
 578	help
 579	  Common parts of the Twofish cipher algorithm shared by the
 580	  generic c and the assembler implementations.
 581
 582endmenu
 583
 584menu "Length-preserving ciphers and modes"
 585
 586config CRYPTO_ADIANTUM
 587	tristate "Adiantum"
 588	select CRYPTO_CHACHA20
 589	select CRYPTO_LIB_POLY1305_GENERIC
 590	select CRYPTO_NHPOLY1305
 591	select CRYPTO_MANAGER
 592	help
 593	  Adiantum tweakable, length-preserving encryption mode
 594
 595	  Designed for fast and secure disk encryption, especially on
 596	  CPUs without dedicated crypto instructions.  It encrypts
 597	  each sector using the XChaCha12 stream cipher, two passes of
 598	  an ε-almost-∆-universal hash function, and an invocation of
 599	  the AES-256 block cipher on a single 16-byte block.  On CPUs
 600	  without AES instructions, Adiantum is much faster than
 601	  AES-XTS.
 602
 603	  Adiantum's security is provably reducible to that of its
 604	  underlying stream and block ciphers, subject to a security
 605	  bound.  Unlike XTS, Adiantum is a true wide-block encryption
 606	  mode, so it actually provides an even stronger notion of
 607	  security than XTS, subject to the security bound.
 608
 609	  If unsure, say N.
 610
 611config CRYPTO_ARC4
 612	tristate "ARC4 (Alleged Rivest Cipher 4)"
 613	depends on CRYPTO_USER_API_ENABLE_OBSOLETE
 614	select CRYPTO_SKCIPHER
 615	select CRYPTO_LIB_ARC4
 616	help
 617	  ARC4 cipher algorithm
 618
 619	  ARC4 is a stream cipher using keys ranging from 8 bits to 2048
 620	  bits in length.  This algorithm is required for driver-based
 621	  WEP, but it should not be for other purposes because of the
 622	  weakness of the algorithm.
 623
 624config CRYPTO_CHACHA20
 625	tristate "ChaCha"
 626	select CRYPTO_LIB_CHACHA_GENERIC
 627	select CRYPTO_SKCIPHER
 628	help
 629	  The ChaCha20, XChaCha20, and XChaCha12 stream cipher algorithms
 630
 631	  ChaCha20 is a 256-bit high-speed stream cipher designed by Daniel J.
 632	  Bernstein and further specified in RFC7539 for use in IETF protocols.
 633	  This is the portable C implementation of ChaCha20.  See
 634	  https://cr.yp.to/chacha/chacha-20080128.pdf for further information.
 635
 636	  XChaCha20 is the application of the XSalsa20 construction to ChaCha20
 637	  rather than to Salsa20.  XChaCha20 extends ChaCha20's nonce length
 638	  from 64 bits (or 96 bits using the RFC7539 convention) to 192 bits,
 639	  while provably retaining ChaCha20's security.  See
 640	  https://cr.yp.to/snuffle/xsalsa-20081128.pdf for further information.
 641
 642	  XChaCha12 is XChaCha20 reduced to 12 rounds, with correspondingly
 643	  reduced security margin but increased performance.  It can be needed
 644	  in some performance-sensitive scenarios.
 645
 646config CRYPTO_CBC
 647	tristate "CBC (Cipher Block Chaining)"
 648	select CRYPTO_SKCIPHER
 649	select CRYPTO_MANAGER
 650	help
 651	  CBC (Cipher Block Chaining) mode (NIST SP800-38A)
 652
 653	  This block cipher mode is required for IPSec ESP (XFRM_ESP).
 654
 655config CRYPTO_CFB
 656	tristate "CFB (Cipher Feedback)"
 657	select CRYPTO_SKCIPHER
 658	select CRYPTO_MANAGER
 659	help
 660	  CFB (Cipher Feedback) mode (NIST SP800-38A)
 661
 662	  This block cipher mode is required for TPM2 Cryptography.
 663
 664config CRYPTO_CTR
 665	tristate "CTR (Counter)"
 666	select CRYPTO_SKCIPHER
 667	select CRYPTO_MANAGER
 668	help
 669	  CTR (Counter) mode (NIST SP800-38A)
 670
 671config CRYPTO_CTS
 672	tristate "CTS (Cipher Text Stealing)"
 673	select CRYPTO_SKCIPHER
 674	select CRYPTO_MANAGER
 675	help
 676	  CBC-CS3 variant of CTS (Cipher Text Stealing) (NIST
 677	  Addendum to SP800-38A (October 2010))
 678
 679	  This mode is required for Kerberos gss mechanism support
 680	  for AES encryption.
 681
 682config CRYPTO_ECB
 683	tristate "ECB (Electronic Codebook)"
 684	select CRYPTO_SKCIPHER
 685	select CRYPTO_MANAGER
 686	help
 687	  ECB (Electronic Codebook) mode (NIST SP800-38A)
 688
 689config CRYPTO_HCTR2
 690	tristate "HCTR2"
 691	select CRYPTO_XCTR
 692	select CRYPTO_POLYVAL
 693	select CRYPTO_MANAGER
 694	help
 695	  HCTR2 length-preserving encryption mode
 696
 697	  A mode for storage encryption that is efficient on processors with
 698	  instructions to accelerate AES and carryless multiplication, e.g.
 699	  x86 processors with AES-NI and CLMUL, and ARM processors with the
 700	  ARMv8 crypto extensions.
 701
 702	  See https://eprint.iacr.org/2021/1441
 703
 704config CRYPTO_KEYWRAP
 705	tristate "KW (AES Key Wrap)"
 706	select CRYPTO_SKCIPHER
 707	select CRYPTO_MANAGER
 708	help
 709	  KW (AES Key Wrap) authenticated encryption mode (NIST SP800-38F
 710	  and RFC3394) without padding.
 711
 712config CRYPTO_LRW
 713	tristate "LRW (Liskov Rivest Wagner)"
 714	select CRYPTO_LIB_GF128MUL
 715	select CRYPTO_SKCIPHER
 716	select CRYPTO_MANAGER
 717	select CRYPTO_ECB
 718	help
 719	  LRW (Liskov Rivest Wagner) mode
 720
 721	  A tweakable, non malleable, non movable
 722	  narrow block cipher mode for dm-crypt.  Use it with cipher
 723	  specification string aes-lrw-benbi, the key must be 256, 320 or 384.
 724	  The first 128, 192 or 256 bits in the key are used for AES and the
 725	  rest is used to tie each cipher block to its logical position.
 726
 727	  See https://people.csail.mit.edu/rivest/pubs/LRW02.pdf
 728
 729config CRYPTO_OFB
 730	tristate "OFB (Output Feedback)"
 731	select CRYPTO_SKCIPHER
 732	select CRYPTO_MANAGER
 733	help
 734	  OFB (Output Feedback) mode (NIST SP800-38A)
 735
 736	  This mode makes a block cipher into a synchronous
 737	  stream cipher. It generates keystream blocks, which are then XORed
 738	  with the plaintext blocks to get the ciphertext. Flipping a bit in the
 739	  ciphertext produces a flipped bit in the plaintext at the same
 740	  location. This property allows many error correcting codes to function
 741	  normally even when applied before encryption.
 742
 743config CRYPTO_PCBC
 744	tristate "PCBC (Propagating Cipher Block Chaining)"
 745	select CRYPTO_SKCIPHER
 746	select CRYPTO_MANAGER
 747	help
 748	  PCBC (Propagating Cipher Block Chaining) mode
 749
 750	  This block cipher mode is required for RxRPC.
 751
 752config CRYPTO_XCTR
 753	tristate
 754	select CRYPTO_SKCIPHER
 755	select CRYPTO_MANAGER
 756	help
 757	  XCTR (XOR Counter) mode for HCTR2
 758
 759	  This blockcipher mode is a variant of CTR mode using XORs and little-endian
 760	  addition rather than big-endian arithmetic.
 761
 762	  XCTR mode is used to implement HCTR2.
 763
 764config CRYPTO_XTS
 765	tristate "XTS (XOR Encrypt XOR with ciphertext stealing)"
 766	select CRYPTO_SKCIPHER
 767	select CRYPTO_MANAGER
 768	select CRYPTO_ECB
 769	help
 770	  XTS (XOR Encrypt XOR with ciphertext stealing) mode (NIST SP800-38E
 771	  and IEEE 1619)
 772
 773	  Use with aes-xts-plain, key size 256, 384 or 512 bits. This
 774	  implementation currently can't handle a sectorsize which is not a
 775	  multiple of 16 bytes.
 776
 777config CRYPTO_NHPOLY1305
 778	tristate
 779	select CRYPTO_HASH
 780	select CRYPTO_LIB_POLY1305_GENERIC
 781
 782endmenu
 783
 784menu "AEAD (authenticated encryption with associated data) ciphers"
 785
 786config CRYPTO_AEGIS128
 787	tristate "AEGIS-128"
 788	select CRYPTO_AEAD
 789	select CRYPTO_AES  # for AES S-box tables
 790	help
 791	  AEGIS-128 AEAD algorithm
 792
 793config CRYPTO_AEGIS128_SIMD
 794	bool "AEGIS-128 (arm NEON, arm64 NEON)"
 795	depends on CRYPTO_AEGIS128 && ((ARM || ARM64) && KERNEL_MODE_NEON)
 796	default y
 797	help
 798	  AEGIS-128 AEAD algorithm
 799
 800	  Architecture: arm or arm64 using:
 801	  - NEON (Advanced SIMD) extension
 802
 803config CRYPTO_CHACHA20POLY1305
 804	tristate "ChaCha20-Poly1305"
 805	select CRYPTO_CHACHA20
 806	select CRYPTO_POLY1305
 807	select CRYPTO_AEAD
 808	select CRYPTO_MANAGER
 809	help
 810	  ChaCha20 stream cipher and Poly1305 authenticator combined
 811	  mode (RFC8439)
 812
 813config CRYPTO_CCM
 814	tristate "CCM (Counter with Cipher Block Chaining-MAC)"
 815	select CRYPTO_CTR
 816	select CRYPTO_HASH
 817	select CRYPTO_AEAD
 818	select CRYPTO_MANAGER
 819	help
 820	  CCM (Counter with Cipher Block Chaining-Message Authentication Code)
 821	  authenticated encryption mode (NIST SP800-38C)
 822
 823config CRYPTO_GCM
 824	tristate "GCM (Galois/Counter Mode) and GMAC (GCM MAC)"
 825	select CRYPTO_CTR
 826	select CRYPTO_AEAD
 827	select CRYPTO_GHASH
 828	select CRYPTO_NULL
 829	select CRYPTO_MANAGER
 830	help
 831	  GCM (Galois/Counter Mode) authenticated encryption mode and GMAC
 832	  (GCM Message Authentication Code) (NIST SP800-38D)
 833
 834	  This is required for IPSec ESP (XFRM_ESP).
 835
 836config CRYPTO_SEQIV
 837	tristate "Sequence Number IV Generator"
 838	select CRYPTO_AEAD
 839	select CRYPTO_SKCIPHER
 840	select CRYPTO_NULL
 
 841	select CRYPTO_RNG_DEFAULT
 842	select CRYPTO_MANAGER
 
 
 
 843	help
 844	  Sequence Number IV generator
 845
 846	  This IV generator generates an IV based on a sequence number by
 847	  xoring it with a salt.  This algorithm is mainly useful for CTR.
 848
 849	  This is required for IPsec ESP (XFRM_ESP).
 850
 851config CRYPTO_ECHAINIV
 852	tristate "Encrypted Chain IV Generator"
 853	select CRYPTO_AEAD
 854	select CRYPTO_NULL
 855	select CRYPTO_RNG_DEFAULT
 856	select CRYPTO_MANAGER
 857	help
 858	  Encrypted Chain IV generator
 859
 860	  This IV generator generates an IV based on the encryption of
 861	  a sequence number xored with a salt.  This is the default
 862	  algorithm for CBC.
 863
 864config CRYPTO_ESSIV
 865	tristate "Encrypted Salt-Sector IV Generator"
 866	select CRYPTO_AUTHENC
 867	help
 868	  Encrypted Salt-Sector IV generator
 869
 870	  This IV generator is used in some cases by fscrypt and/or
 871	  dm-crypt. It uses the hash of the block encryption key as the
 872	  symmetric key for a block encryption pass applied to the input
 873	  IV, making low entropy IV sources more suitable for block
 874	  encryption.
 875
 876	  This driver implements a crypto API template that can be
 877	  instantiated either as an skcipher or as an AEAD (depending on the
 878	  type of the first template argument), and which defers encryption
 879	  and decryption requests to the encapsulated cipher after applying
 880	  ESSIV to the input IV. Note that in the AEAD case, it is assumed
 881	  that the keys are presented in the same format used by the authenc
 882	  template, and that the IV appears at the end of the authenticated
 883	  associated data (AAD) region (which is how dm-crypt uses it.)
 884
 885	  Note that the use of ESSIV is not recommended for new deployments,
 886	  and so this only needs to be enabled when interoperability with
 887	  existing encrypted volumes of filesystems is required, or when
 888	  building for a particular system that requires it (e.g., when
 889	  the SoC in question has accelerated CBC but not XTS, making CBC
 890	  combined with ESSIV the only feasible mode for h/w accelerated
 891	  block encryption)
 892
 893endmenu
 894
 895menu "Hashes, digests, and MACs"
 896
 897config CRYPTO_BLAKE2B
 898	tristate "BLAKE2b"
 899	select CRYPTO_HASH
 900	help
 901	  BLAKE2b cryptographic hash function (RFC 7693)
 902
 903	  BLAKE2b is optimized for 64-bit platforms and can produce digests
 904	  of any size between 1 and 64 bytes. The keyed hash is also implemented.
 905
 906	  This module provides the following algorithms:
 907	  - blake2b-160
 908	  - blake2b-256
 909	  - blake2b-384
 910	  - blake2b-512
 911
 912	  Used by the btrfs filesystem.
 913
 914	  See https://blake2.net for further information.
 915
 916config CRYPTO_CMAC
 917	tristate "CMAC (Cipher-based MAC)"
 918	select CRYPTO_HASH
 919	select CRYPTO_MANAGER
 920	help
 921	  CMAC (Cipher-based Message Authentication Code) authentication
 922	  mode (NIST SP800-38B and IETF RFC4493)
 923
 924config CRYPTO_GHASH
 925	tristate "GHASH"
 926	select CRYPTO_HASH
 927	select CRYPTO_LIB_GF128MUL
 928	help
 929	  GCM GHASH function (NIST SP800-38D)
 930
 931config CRYPTO_HMAC
 932	tristate "HMAC (Keyed-Hash MAC)"
 933	select CRYPTO_HASH
 934	select CRYPTO_MANAGER
 935	help
 936	  HMAC (Keyed-Hash Message Authentication Code) (FIPS 198 and
 937	  RFC2104)
 938
 939	  This is required for IPsec AH (XFRM_AH) and IPsec ESP (XFRM_ESP).
 940
 941config CRYPTO_MD4
 942	tristate "MD4"
 943	select CRYPTO_HASH
 944	help
 945	  MD4 message digest algorithm (RFC1320)
 946
 947config CRYPTO_MD5
 948	tristate "MD5"
 949	select CRYPTO_HASH
 950	help
 951	  MD5 message digest algorithm (RFC1321)
 952
 953config CRYPTO_MICHAEL_MIC
 954	tristate "Michael MIC"
 955	select CRYPTO_HASH
 956	help
 957	  Michael MIC (Message Integrity Code) (IEEE 802.11i)
 958
 959	  Defined by the IEEE 802.11i TKIP (Temporal Key Integrity Protocol),
 960	  known as WPA (Wif-Fi Protected Access).
 961
 962	  This algorithm is required for TKIP, but it should not be used for
 963	  other purposes because of the weakness of the algorithm.
 964
 965config CRYPTO_POLYVAL
 966	tristate
 967	select CRYPTO_HASH
 968	select CRYPTO_LIB_GF128MUL
 969	help
 970	  POLYVAL hash function for HCTR2
 971
 972	  This is used in HCTR2.  It is not a general-purpose
 973	  cryptographic hash function.
 974
 975config CRYPTO_POLY1305
 976	tristate "Poly1305"
 977	select CRYPTO_HASH
 978	select CRYPTO_LIB_POLY1305_GENERIC
 979	help
 980	  Poly1305 authenticator algorithm (RFC7539)
 981
 982	  Poly1305 is an authenticator algorithm designed by Daniel J. Bernstein.
 983	  It is used for the ChaCha20-Poly1305 AEAD, specified in RFC7539 for use
 984	  in IETF protocols. This is the portable C implementation of Poly1305.
 985
 986config CRYPTO_RMD160
 987	tristate "RIPEMD-160"
 988	select CRYPTO_HASH
 989	help
 990	  RIPEMD-160 hash function (ISO/IEC 10118-3)
 991
 992	  RIPEMD-160 is a 160-bit cryptographic hash function. It is intended
 993	  to be used as a secure replacement for the 128-bit hash functions
 994	  MD4, MD5 and its predecessor RIPEMD
 995	  (not to be confused with RIPEMD-128).
 996
 997	  Its speed is comparable to SHA-1 and there are no known attacks
 998	  against RIPEMD-160.
 999
1000	  Developed by Hans Dobbertin, Antoon Bosselaers and Bart Preneel.
1001	  See https://homes.esat.kuleuven.be/~bosselae/ripemd160.html
1002	  for further information.
1003
1004config CRYPTO_SHA1
1005	tristate "SHA-1"
1006	select CRYPTO_HASH
1007	select CRYPTO_LIB_SHA1
1008	help
1009	  SHA-1 secure hash algorithm (FIPS 180, ISO/IEC 10118-3)
1010
1011config CRYPTO_SHA256
1012	tristate "SHA-224 and SHA-256"
1013	select CRYPTO_HASH
1014	select CRYPTO_LIB_SHA256
1015	help
1016	  SHA-224 and SHA-256 secure hash algorithms (FIPS 180, ISO/IEC 10118-3)
1017
1018	  This is required for IPsec AH (XFRM_AH) and IPsec ESP (XFRM_ESP).
1019	  Used by the btrfs filesystem, Ceph, NFS, and SMB.
1020
1021config CRYPTO_SHA512
1022	tristate "SHA-384 and SHA-512"
1023	select CRYPTO_HASH
1024	help
1025	  SHA-384 and SHA-512 secure hash algorithms (FIPS 180, ISO/IEC 10118-3)
1026
1027config CRYPTO_SHA3
1028	tristate "SHA-3"
1029	select CRYPTO_HASH
1030	help
1031	  SHA-3 secure hash algorithms (FIPS 202, ISO/IEC 10118-3)
1032
1033config CRYPTO_SM3
1034	tristate
1035
1036config CRYPTO_SM3_GENERIC
1037	tristate "SM3 (ShangMi 3)"
1038	select CRYPTO_HASH
1039	select CRYPTO_SM3
1040	help
1041	  SM3 (ShangMi 3) secure hash function (OSCCA GM/T 0004-2012, ISO/IEC 10118-3)
1042
1043	  This is part of the Chinese Commercial Cryptography suite.
1044
1045	  References:
1046	  http://www.oscca.gov.cn/UpFile/20101222141857786.pdf
1047	  https://datatracker.ietf.org/doc/html/draft-shen-sm3-hash
1048
1049config CRYPTO_STREEBOG
1050	tristate "Streebog"
1051	select CRYPTO_HASH
1052	help
1053	  Streebog Hash Function (GOST R 34.11-2012, RFC 6986, ISO/IEC 10118-3)
1054
1055	  This is one of the Russian cryptographic standard algorithms (called
1056	  GOST algorithms). This setting enables two hash algorithms with
1057	  256 and 512 bits output.
1058
1059	  References:
1060	  https://tc26.ru/upload/iblock/fed/feddbb4d26b685903faa2ba11aea43f6.pdf
1061	  https://tools.ietf.org/html/rfc6986
1062
1063config CRYPTO_VMAC
1064	tristate "VMAC"
1065	select CRYPTO_HASH
1066	select CRYPTO_MANAGER
1067	help
1068	  VMAC is a message authentication algorithm designed for
1069	  very high speed on 64-bit architectures.
1070
1071	  See https://fastcrypto.org/vmac for further information.
1072
1073config CRYPTO_WP512
1074	tristate "Whirlpool"
1075	select CRYPTO_HASH
1076	help
1077	  Whirlpool hash function (ISO/IEC 10118-3)
1078
1079	  512, 384 and 256-bit hashes.
1080
1081	  Whirlpool-512 is part of the NESSIE cryptographic primitives.
1082
1083	  See https://web.archive.org/web/20171129084214/http://www.larc.usp.br/~pbarreto/WhirlpoolPage.html
1084	  for further information.
1085
1086config CRYPTO_XCBC
1087	tristate "XCBC-MAC (Extended Cipher Block Chaining MAC)"
1088	select CRYPTO_HASH
1089	select CRYPTO_MANAGER
1090	help
1091	  XCBC-MAC (Extended Cipher Block Chaining Message Authentication
1092	  Code) (RFC3566)
1093
1094config CRYPTO_XXHASH
1095	tristate "xxHash"
1096	select CRYPTO_HASH
1097	select XXHASH
1098	help
1099	  xxHash non-cryptographic hash algorithm
1100
1101	  Extremely fast, working at speeds close to RAM limits.
1102
1103	  Used by the btrfs filesystem.
1104
1105endmenu
1106
1107menu "CRCs (cyclic redundancy checks)"
1108
1109config CRYPTO_CRC32C
1110	tristate "CRC32c"
1111	select CRYPTO_HASH
1112	select CRC32
1113	help
1114	  CRC32c CRC algorithm with the iSCSI polynomial (RFC 3385 and RFC 3720)
1115
1116	  A 32-bit CRC (cyclic redundancy check) with a polynomial defined
1117	  by G. Castagnoli, S. Braeuer and M. Herrman in "Optimization of Cyclic
1118	  Redundancy-Check Codes with 24 and 32 Parity Bits", IEEE Transactions
1119	  on Communications, Vol. 41, No. 6, June 1993, selected for use with
1120	  iSCSI.
1121
1122	  Used by btrfs, ext4, jbd2, NVMeoF/TCP, and iSCSI.
1123
1124config CRYPTO_CRC32
1125	tristate "CRC32"
1126	select CRYPTO_HASH
1127	select CRC32
1128	help
1129	  CRC32 CRC algorithm (IEEE 802.3)
1130
1131	  Used by RoCEv2 and f2fs.
1132
1133config CRYPTO_CRCT10DIF
1134	tristate "CRCT10DIF"
1135	select CRYPTO_HASH
1136	help
1137	  CRC16 CRC algorithm used for the T10 (SCSI) Data Integrity Field (DIF)
1138
1139	  CRC algorithm used by the SCSI Block Commands standard.
1140
1141config CRYPTO_CRC64_ROCKSOFT
1142	tristate "CRC64 based on Rocksoft Model algorithm"
1143	depends on CRC64
1144	select CRYPTO_HASH
1145	help
1146	  CRC64 CRC algorithm based on the Rocksoft Model CRC Algorithm
1147
1148	  Used by the NVMe implementation of T10 DIF (BLK_DEV_INTEGRITY)
1149
1150	  See https://zlib.net/crc_v3.txt
1151
1152endmenu
1153
1154menu "Compression"
1155
1156config CRYPTO_DEFLATE
1157	tristate "Deflate"
1158	select CRYPTO_ALGAPI
1159	select CRYPTO_ACOMP2
1160	select ZLIB_INFLATE
1161	select ZLIB_DEFLATE
1162	help
1163	  Deflate compression algorithm (RFC1951)
1164
1165	  Used by IPSec with the IPCOMP protocol (RFC3173, RFC2394)
1166
1167config CRYPTO_LZO
1168	tristate "LZO"
1169	select CRYPTO_ALGAPI
1170	select CRYPTO_ACOMP2
1171	select LZO_COMPRESS
1172	select LZO_DECOMPRESS
1173	help
1174	  LZO compression algorithm
1175
1176	  See https://www.oberhumer.com/opensource/lzo/ for further information.
1177
1178config CRYPTO_842
1179	tristate "842"
1180	select CRYPTO_ALGAPI
1181	select CRYPTO_ACOMP2
1182	select 842_COMPRESS
1183	select 842_DECOMPRESS
1184	help
1185	  842 compression algorithm by IBM
1186
1187	  See https://github.com/plauth/lib842 for further information.
1188
1189config CRYPTO_LZ4
1190	tristate "LZ4"
1191	select CRYPTO_ALGAPI
1192	select CRYPTO_ACOMP2
1193	select LZ4_COMPRESS
1194	select LZ4_DECOMPRESS
1195	help
1196	  LZ4 compression algorithm
1197
1198	  See https://github.com/lz4/lz4 for further information.
1199
1200config CRYPTO_LZ4HC
1201	tristate "LZ4HC"
1202	select CRYPTO_ALGAPI
1203	select CRYPTO_ACOMP2
1204	select LZ4HC_COMPRESS
1205	select LZ4_DECOMPRESS
1206	help
1207	  LZ4 high compression mode algorithm
1208
1209	  See https://github.com/lz4/lz4 for further information.
1210
1211config CRYPTO_ZSTD
1212	tristate "Zstd"
1213	select CRYPTO_ALGAPI
1214	select CRYPTO_ACOMP2
1215	select ZSTD_COMPRESS
1216	select ZSTD_DECOMPRESS
1217	help
1218	  zstd compression algorithm
1219
1220	  See https://github.com/facebook/zstd for further information.
1221
1222endmenu
1223
1224menu "Random number generation"
1225
1226config CRYPTO_ANSI_CPRNG
1227	tristate "ANSI PRNG (Pseudo Random Number Generator)"
1228	select CRYPTO_AES
1229	select CRYPTO_RNG
1230	help
1231	  Pseudo RNG (random number generator) (ANSI X9.31 Appendix A.2.4)
1232
1233	  This uses the AES cipher algorithm.
1234
1235	  Note that this option must be enabled if CRYPTO_FIPS is selected
1236
1237menuconfig CRYPTO_DRBG_MENU
1238	tristate "NIST SP800-90A DRBG (Deterministic Random Bit Generator)"
1239	help
1240	  DRBG (Deterministic Random Bit Generator) (NIST SP800-90A)
1241
1242	  In the following submenu, one or more of the DRBG types must be selected.
1243
1244if CRYPTO_DRBG_MENU
1245
1246config CRYPTO_DRBG_HMAC
1247	bool
1248	default y
1249	select CRYPTO_HMAC
1250	select CRYPTO_SHA512
1251
1252config CRYPTO_DRBG_HASH
1253	bool "Hash_DRBG"
1254	select CRYPTO_SHA256
1255	help
1256	  Hash_DRBG variant as defined in NIST SP800-90A.
1257
1258	  This uses the SHA-1, SHA-256, SHA-384, or SHA-512 hash algorithms.
1259
1260config CRYPTO_DRBG_CTR
1261	bool "CTR_DRBG"
1262	select CRYPTO_AES
1263	select CRYPTO_CTR
1264	help
1265	  CTR_DRBG variant as defined in NIST SP800-90A.
1266
1267	  This uses the AES cipher algorithm with the counter block mode.
1268
1269config CRYPTO_DRBG
1270	tristate
1271	default CRYPTO_DRBG_MENU
1272	select CRYPTO_RNG
1273	select CRYPTO_JITTERENTROPY
1274
1275endif	# if CRYPTO_DRBG_MENU
1276
1277config CRYPTO_JITTERENTROPY
1278	tristate "CPU Jitter Non-Deterministic RNG (Random Number Generator)"
1279	select CRYPTO_RNG
 
1280	help
1281	  CPU Jitter RNG (Random Number Generator) from the Jitterentropy library
1282
1283	  A non-physical non-deterministic ("true") RNG (e.g., an entropy source
1284	  compliant with NIST SP800-90B) intended to provide a seed to a
1285	  deterministic RNG (e.g.  per NIST SP800-90C).
1286	  This RNG does not perform any cryptographic whitening of the generated
 
 
 
1287
1288	  See https://www.chronox.de/jent.html
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1289
1290config CRYPTO_KDF800108_CTR
1291	tristate
1292	select CRYPTO_HMAC
1293	select CRYPTO_SHA256
1294
1295endmenu
1296menu "Userspace interface"
1297
1298config CRYPTO_USER_API
1299	tristate
1300
1301config CRYPTO_USER_API_HASH
1302	tristate "Hash algorithms"
1303	depends on NET
1304	select CRYPTO_HASH
1305	select CRYPTO_USER_API
1306	help
1307	  Enable the userspace interface for hash algorithms.
1308
1309	  See Documentation/crypto/userspace-if.rst and
1310	  https://www.chronox.de/libkcapi/html/index.html
1311
1312config CRYPTO_USER_API_SKCIPHER
1313	tristate "Symmetric key cipher algorithms"
1314	depends on NET
1315	select CRYPTO_SKCIPHER
1316	select CRYPTO_USER_API
1317	help
1318	  Enable the userspace interface for symmetric key cipher algorithms.
1319
1320	  See Documentation/crypto/userspace-if.rst and
1321	  https://www.chronox.de/libkcapi/html/index.html
1322
1323config CRYPTO_USER_API_RNG
1324	tristate "RNG (random number generator) algorithms"
1325	depends on NET
1326	select CRYPTO_RNG
1327	select CRYPTO_USER_API
1328	help
1329	  Enable the userspace interface for RNG (random number generator)
1330	  algorithms.
1331
1332	  See Documentation/crypto/userspace-if.rst and
1333	  https://www.chronox.de/libkcapi/html/index.html
1334
1335config CRYPTO_USER_API_RNG_CAVP
1336	bool "Enable CAVP testing of DRBG"
1337	depends on CRYPTO_USER_API_RNG && CRYPTO_DRBG
1338	help
1339	  Enable extra APIs in the userspace interface for NIST CAVP
1340	  (Cryptographic Algorithm Validation Program) testing:
1341	  - resetting DRBG entropy
1342	  - providing Additional Data
1343
1344	  This should only be enabled for CAVP testing. You should say
1345	  no unless you know what this is.
1346
1347config CRYPTO_USER_API_AEAD
1348	tristate "AEAD cipher algorithms"
1349	depends on NET
1350	select CRYPTO_AEAD
1351	select CRYPTO_SKCIPHER
1352	select CRYPTO_NULL
1353	select CRYPTO_USER_API
1354	help
1355	  Enable the userspace interface for AEAD cipher algorithms.
1356
1357	  See Documentation/crypto/userspace-if.rst and
1358	  https://www.chronox.de/libkcapi/html/index.html
1359
1360config CRYPTO_USER_API_ENABLE_OBSOLETE
1361	bool "Obsolete cryptographic algorithms"
1362	depends on CRYPTO_USER_API
1363	default y
1364	help
1365	  Allow obsolete cryptographic algorithms to be selected that have
1366	  already been phased out from internal use by the kernel, and are
1367	  only useful for userspace clients that still rely on them.
1368
1369config CRYPTO_STATS
1370	bool "Crypto usage statistics"
1371	depends on CRYPTO_USER
1372	help
1373	  Enable the gathering of crypto stats.
1374
1375	  This collects data sizes, numbers of requests, and numbers
1376	  of errors processed by:
1377	  - AEAD ciphers (encrypt, decrypt)
1378	  - asymmetric key ciphers (encrypt, decrypt, verify, sign)
1379	  - symmetric key ciphers (encrypt, decrypt)
1380	  - compression algorithms (compress, decompress)
1381	  - hash algorithms (hash)
1382	  - key-agreement protocol primitives (setsecret, generate
1383	    public key, compute shared secret)
1384	  - RNG (generate, seed)
1385
1386endmenu
1387
1388config CRYPTO_HASH_INFO
1389	bool
1390
1391if !KMSAN # avoid false positives from assembly
1392if ARM
1393source "arch/arm/crypto/Kconfig"
1394endif
1395if ARM64
1396source "arch/arm64/crypto/Kconfig"
1397endif
 
 
 
1398if MIPS
1399source "arch/mips/crypto/Kconfig"
1400endif
1401if PPC
1402source "arch/powerpc/crypto/Kconfig"
 
 
 
1403endif
1404if S390
1405source "arch/s390/crypto/Kconfig"
1406endif
1407if SPARC
1408source "arch/sparc/crypto/Kconfig"
1409endif
1410if X86
1411source "arch/x86/crypto/Kconfig"
1412endif
1413endif
1414
1415source "drivers/crypto/Kconfig"
1416source "crypto/asymmetric_keys/Kconfig"
1417source "certs/Kconfig"
1418
1419endif	# if CRYPTO