Loading...
1# SPDX-License-Identifier: GPL-2.0
2menuconfig ASYMMETRIC_KEY_TYPE
3 bool "Asymmetric (public-key cryptographic) key type"
4 depends on KEYS
5 help
6 This option provides support for a key type that holds the data for
7 the asymmetric keys used for public key cryptographic operations such
8 as encryption, decryption, signature generation and signature
9 verification.
10
11if ASYMMETRIC_KEY_TYPE
12
13config ASYMMETRIC_PUBLIC_KEY_SUBTYPE
14 tristate "Asymmetric public-key crypto algorithm subtype"
15 select MPILIB
16 select CRYPTO_HASH_INFO
17 select CRYPTO_AKCIPHER
18 select CRYPTO_SIG
19 select CRYPTO_HASH
20 help
21 This option provides support for asymmetric public key type handling.
22 If signature generation and/or verification are to be used,
23 appropriate hash algorithms (such as SHA-1) must be available.
24 ENOPKG will be reported if the requisite algorithm is unavailable.
25
26config X509_CERTIFICATE_PARSER
27 tristate "X.509 certificate parser"
28 depends on ASYMMETRIC_PUBLIC_KEY_SUBTYPE
29 select ASN1
30 select OID_REGISTRY
31 help
32 This option provides support for parsing X.509 format blobs for key
33 data and provides the ability to instantiate a crypto key from a
34 public key packet found inside the certificate.
35
36config PKCS8_PRIVATE_KEY_PARSER
37 tristate "PKCS#8 private key parser"
38 depends on ASYMMETRIC_PUBLIC_KEY_SUBTYPE
39 select ASN1
40 select OID_REGISTRY
41 help
42 This option provides support for parsing PKCS#8 format blobs for
43 private key data and provides the ability to instantiate a crypto key
44 from that data.
45
46config PKCS7_MESSAGE_PARSER
47 tristate "PKCS#7 message parser"
48 depends on X509_CERTIFICATE_PARSER
49 select CRYPTO_HASH
50 select ASN1
51 select OID_REGISTRY
52 help
53 This option provides support for parsing PKCS#7 format messages for
54 signature data and provides the ability to verify the signature.
55
56config PKCS7_TEST_KEY
57 tristate "PKCS#7 testing key type"
58 depends on SYSTEM_DATA_VERIFICATION
59 help
60 This option provides a type of key that can be loaded up from a
61 PKCS#7 message - provided the message is signed by a trusted key. If
62 it is, the PKCS#7 wrapper is discarded and reading the key returns
63 just the payload. If it isn't, adding the key will fail with an
64 error.
65
66 This is intended for testing the PKCS#7 parser.
67
68config SIGNED_PE_FILE_VERIFICATION
69 bool "Support for PE file signature verification"
70 depends on PKCS7_MESSAGE_PARSER=y
71 depends on SYSTEM_DATA_VERIFICATION
72 select CRYPTO_HASH
73 select ASN1
74 select OID_REGISTRY
75 help
76 This option provides support for verifying the signature(s) on a
77 signed PE binary.
78
79config FIPS_SIGNATURE_SELFTEST
80 tristate "Run FIPS selftests on the X.509+PKCS7 signature verification"
81 help
82 This option causes some selftests to be run on the signature
83 verification code, using some built in data. This is required
84 for FIPS.
85 depends on KEYS
86 depends on ASYMMETRIC_KEY_TYPE
87 depends on PKCS7_MESSAGE_PARSER=X509_CERTIFICATE_PARSER
88 depends on X509_CERTIFICATE_PARSER
89 depends on CRYPTO_RSA
90 depends on CRYPTO_SHA256
91
92config FIPS_SIGNATURE_SELFTEST_RSA
93 bool
94 default y
95 depends on FIPS_SIGNATURE_SELFTEST
96 depends on CRYPTO_SHA256=y || CRYPTO_SHA256=FIPS_SIGNATURE_SELFTEST
97 depends on CRYPTO_RSA=y || CRYPTO_RSA=FIPS_SIGNATURE_SELFTEST
98
99config FIPS_SIGNATURE_SELFTEST_ECDSA
100 bool
101 default y
102 depends on FIPS_SIGNATURE_SELFTEST
103 depends on CRYPTO_SHA256=y || CRYPTO_SHA256=FIPS_SIGNATURE_SELFTEST
104 depends on CRYPTO_ECDSA=y || CRYPTO_ECDSA=FIPS_SIGNATURE_SELFTEST
105
106endif # ASYMMETRIC_KEY_TYPE
1# SPDX-License-Identifier: GPL-2.0
2menuconfig ASYMMETRIC_KEY_TYPE
3 bool "Asymmetric (public-key cryptographic) key type"
4 depends on KEYS
5 help
6 This option provides support for a key type that holds the data for
7 the asymmetric keys used for public key cryptographic operations such
8 as encryption, decryption, signature generation and signature
9 verification.
10
11if ASYMMETRIC_KEY_TYPE
12
13config ASYMMETRIC_PUBLIC_KEY_SUBTYPE
14 tristate "Asymmetric public-key crypto algorithm subtype"
15 select MPILIB
16 select CRYPTO_HASH_INFO
17 select CRYPTO_AKCIPHER
18 select CRYPTO_HASH
19 help
20 This option provides support for asymmetric public key type handling.
21 If signature generation and/or verification are to be used,
22 appropriate hash algorithms (such as SHA-1) must be available.
23 ENOPKG will be reported if the requisite algorithm is unavailable.
24
25config X509_CERTIFICATE_PARSER
26 tristate "X.509 certificate parser"
27 depends on ASYMMETRIC_PUBLIC_KEY_SUBTYPE
28 select ASN1
29 select OID_REGISTRY
30 help
31 This option provides support for parsing X.509 format blobs for key
32 data and provides the ability to instantiate a crypto key from a
33 public key packet found inside the certificate.
34
35config PKCS8_PRIVATE_KEY_PARSER
36 tristate "PKCS#8 private key parser"
37 depends on ASYMMETRIC_PUBLIC_KEY_SUBTYPE
38 select ASN1
39 select OID_REGISTRY
40 help
41 This option provides support for parsing PKCS#8 format blobs for
42 private key data and provides the ability to instantiate a crypto key
43 from that data.
44
45config PKCS7_MESSAGE_PARSER
46 tristate "PKCS#7 message parser"
47 depends on X509_CERTIFICATE_PARSER
48 select CRYPTO_HASH
49 select ASN1
50 select OID_REGISTRY
51 help
52 This option provides support for parsing PKCS#7 format messages for
53 signature data and provides the ability to verify the signature.
54
55config PKCS7_TEST_KEY
56 tristate "PKCS#7 testing key type"
57 depends on SYSTEM_DATA_VERIFICATION
58 help
59 This option provides a type of key that can be loaded up from a
60 PKCS#7 message - provided the message is signed by a trusted key. If
61 it is, the PKCS#7 wrapper is discarded and reading the key returns
62 just the payload. If it isn't, adding the key will fail with an
63 error.
64
65 This is intended for testing the PKCS#7 parser.
66
67config SIGNED_PE_FILE_VERIFICATION
68 bool "Support for PE file signature verification"
69 depends on PKCS7_MESSAGE_PARSER=y
70 depends on SYSTEM_DATA_VERIFICATION
71 select CRYPTO_HASH
72 select ASN1
73 select OID_REGISTRY
74 help
75 This option provides support for verifying the signature(s) on a
76 signed PE binary.
77
78config FIPS_SIGNATURE_SELFTEST
79 bool "Run FIPS selftests on the X.509+PKCS7 signature verification"
80 help
81 This option causes some selftests to be run on the signature
82 verification code, using some built in data. This is required
83 for FIPS.
84 depends on KEYS
85 depends on ASYMMETRIC_KEY_TYPE
86 depends on PKCS7_MESSAGE_PARSER
87
88endif # ASYMMETRIC_KEY_TYPE