Loading...
1# SPDX-License-Identifier: GPL-2.0
2#
3# Generic algorithms support
4#
5config XOR_BLOCKS
6 tristate
7
8#
9# async_tx api: hardware offloaded memory transfer/transform support
10#
11source "crypto/async_tx/Kconfig"
12
13#
14# Cryptographic API Configuration
15#
16menuconfig CRYPTO
17 tristate "Cryptographic API"
18 select CRYPTO_LIB_UTILS
19 help
20 This option provides the core Cryptographic API.
21
22if CRYPTO
23
24menu "Crypto core or helper"
25
26config CRYPTO_FIPS
27 bool "FIPS 200 compliance"
28 depends on (CRYPTO_ANSI_CPRNG || CRYPTO_DRBG) && !CRYPTO_MANAGER_DISABLE_TESTS
29 depends on (MODULE_SIG || !MODULES)
30 help
31 This option enables the fips boot option which is
32 required if you want the system to operate in a FIPS 200
33 certification. You should say no unless you know what
34 this is.
35
36config CRYPTO_FIPS_NAME
37 string "FIPS Module Name"
38 default "Linux Kernel Cryptographic API"
39 depends on CRYPTO_FIPS
40 help
41 This option sets the FIPS Module name reported by the Crypto API via
42 the /proc/sys/crypto/fips_name file.
43
44config CRYPTO_FIPS_CUSTOM_VERSION
45 bool "Use Custom FIPS Module Version"
46 depends on CRYPTO_FIPS
47 default n
48
49config CRYPTO_FIPS_VERSION
50 string "FIPS Module Version"
51 default "(none)"
52 depends on CRYPTO_FIPS_CUSTOM_VERSION
53 help
54 This option provides the ability to override the FIPS Module Version.
55 By default the KERNELRELEASE value is used.
56
57config CRYPTO_ALGAPI
58 tristate
59 select CRYPTO_ALGAPI2
60 help
61 This option provides the API for cryptographic algorithms.
62
63config CRYPTO_ALGAPI2
64 tristate
65
66config CRYPTO_AEAD
67 tristate
68 select CRYPTO_AEAD2
69 select CRYPTO_ALGAPI
70
71config CRYPTO_AEAD2
72 tristate
73 select CRYPTO_ALGAPI2
74
75config CRYPTO_SIG
76 tristate
77 select CRYPTO_SIG2
78 select CRYPTO_ALGAPI
79
80config CRYPTO_SIG2
81 tristate
82 select CRYPTO_ALGAPI2
83
84config CRYPTO_SKCIPHER
85 tristate
86 select CRYPTO_SKCIPHER2
87 select CRYPTO_ALGAPI
88 select CRYPTO_ECB
89
90config CRYPTO_SKCIPHER2
91 tristate
92 select CRYPTO_ALGAPI2
93
94config CRYPTO_HASH
95 tristate
96 select CRYPTO_HASH2
97 select CRYPTO_ALGAPI
98
99config CRYPTO_HASH2
100 tristate
101 select CRYPTO_ALGAPI2
102
103config CRYPTO_RNG
104 tristate
105 select CRYPTO_RNG2
106 select CRYPTO_ALGAPI
107
108config CRYPTO_RNG2
109 tristate
110 select CRYPTO_ALGAPI2
111
112config CRYPTO_RNG_DEFAULT
113 tristate
114 select CRYPTO_DRBG_MENU
115
116config CRYPTO_AKCIPHER2
117 tristate
118 select CRYPTO_ALGAPI2
119
120config CRYPTO_AKCIPHER
121 tristate
122 select CRYPTO_AKCIPHER2
123 select CRYPTO_ALGAPI
124
125config CRYPTO_KPP2
126 tristate
127 select CRYPTO_ALGAPI2
128
129config CRYPTO_KPP
130 tristate
131 select CRYPTO_ALGAPI
132 select CRYPTO_KPP2
133
134config CRYPTO_ACOMP2
135 tristate
136 select CRYPTO_ALGAPI2
137 select SGL_ALLOC
138
139config CRYPTO_ACOMP
140 tristate
141 select CRYPTO_ALGAPI
142 select CRYPTO_ACOMP2
143
144config CRYPTO_MANAGER
145 tristate "Cryptographic algorithm manager"
146 select CRYPTO_MANAGER2
147 help
148 Create default cryptographic template instantiations such as
149 cbc(aes).
150
151config CRYPTO_MANAGER2
152 def_tristate CRYPTO_MANAGER || (CRYPTO_MANAGER!=n && CRYPTO_ALGAPI=y)
153 select CRYPTO_ACOMP2
154 select CRYPTO_AEAD2
155 select CRYPTO_AKCIPHER2
156 select CRYPTO_SIG2
157 select CRYPTO_HASH2
158 select CRYPTO_KPP2
159 select CRYPTO_RNG2
160 select CRYPTO_SKCIPHER2
161
162config CRYPTO_USER
163 tristate "Userspace cryptographic algorithm configuration"
164 depends on NET
165 select CRYPTO_MANAGER
166 help
167 Userspace configuration for cryptographic instantiations such as
168 cbc(aes).
169
170config CRYPTO_MANAGER_DISABLE_TESTS
171 bool "Disable run-time self tests"
172 default y
173 help
174 Disable run-time self tests that normally take place at
175 algorithm registration.
176
177config CRYPTO_MANAGER_EXTRA_TESTS
178 bool "Enable extra run-time crypto self tests"
179 depends on DEBUG_KERNEL && !CRYPTO_MANAGER_DISABLE_TESTS && CRYPTO_MANAGER
180 help
181 Enable extra run-time self tests of registered crypto algorithms,
182 including randomized fuzz tests.
183
184 This is intended for developer use only, as these tests take much
185 longer to run than the normal self tests.
186
187config CRYPTO_NULL
188 tristate "Null algorithms"
189 select CRYPTO_NULL2
190 help
191 These are 'Null' algorithms, used by IPsec, which do nothing.
192
193config CRYPTO_NULL2
194 tristate
195 select CRYPTO_ALGAPI2
196 select CRYPTO_SKCIPHER2
197 select CRYPTO_HASH2
198
199config CRYPTO_PCRYPT
200 tristate "Parallel crypto engine"
201 depends on SMP
202 select PADATA
203 select CRYPTO_MANAGER
204 select CRYPTO_AEAD
205 help
206 This converts an arbitrary crypto algorithm into a parallel
207 algorithm that executes in kernel threads.
208
209config CRYPTO_CRYPTD
210 tristate "Software async crypto daemon"
211 select CRYPTO_SKCIPHER
212 select CRYPTO_HASH
213 select CRYPTO_MANAGER
214 help
215 This is a generic software asynchronous crypto daemon that
216 converts an arbitrary synchronous software crypto algorithm
217 into an asynchronous algorithm that executes in a kernel thread.
218
219config CRYPTO_AUTHENC
220 tristate "Authenc support"
221 select CRYPTO_AEAD
222 select CRYPTO_SKCIPHER
223 select CRYPTO_MANAGER
224 select CRYPTO_HASH
225 select CRYPTO_NULL
226 help
227 Authenc: Combined mode wrapper for IPsec.
228
229 This is required for IPSec ESP (XFRM_ESP).
230
231config CRYPTO_TEST
232 tristate "Testing module"
233 depends on m || EXPERT
234 select CRYPTO_MANAGER
235 help
236 Quick & dirty crypto test module.
237
238config CRYPTO_SIMD
239 tristate
240 select CRYPTO_CRYPTD
241
242config CRYPTO_ENGINE
243 tristate
244
245endmenu
246
247menu "Public-key cryptography"
248
249config CRYPTO_RSA
250 tristate "RSA (Rivest-Shamir-Adleman)"
251 select CRYPTO_AKCIPHER
252 select CRYPTO_MANAGER
253 select MPILIB
254 select ASN1
255 help
256 RSA (Rivest-Shamir-Adleman) public key algorithm (RFC8017)
257
258config CRYPTO_DH
259 tristate "DH (Diffie-Hellman)"
260 select CRYPTO_KPP
261 select MPILIB
262 help
263 DH (Diffie-Hellman) key exchange algorithm
264
265config CRYPTO_DH_RFC7919_GROUPS
266 bool "RFC 7919 FFDHE groups"
267 depends on CRYPTO_DH
268 select CRYPTO_RNG_DEFAULT
269 help
270 FFDHE (Finite-Field-based Diffie-Hellman Ephemeral) groups
271 defined in RFC7919.
272
273 Support these finite-field groups in DH key exchanges:
274 - ffdhe2048, ffdhe3072, ffdhe4096, ffdhe6144, ffdhe8192
275
276 If unsure, say N.
277
278config CRYPTO_ECC
279 tristate
280 select CRYPTO_RNG_DEFAULT
281
282config CRYPTO_ECDH
283 tristate "ECDH (Elliptic Curve Diffie-Hellman)"
284 select CRYPTO_ECC
285 select CRYPTO_KPP
286 help
287 ECDH (Elliptic Curve Diffie-Hellman) key exchange algorithm
288 using curves P-192, P-256, and P-384 (FIPS 186)
289
290config CRYPTO_ECDSA
291 tristate "ECDSA (Elliptic Curve Digital Signature Algorithm)"
292 select CRYPTO_ECC
293 select CRYPTO_AKCIPHER
294 select ASN1
295 help
296 ECDSA (Elliptic Curve Digital Signature Algorithm) (FIPS 186,
297 ISO/IEC 14888-3)
298 using curves P-192, P-256, and P-384
299
300 Only signature verification is implemented.
301
302config CRYPTO_ECRDSA
303 tristate "EC-RDSA (Elliptic Curve Russian Digital Signature Algorithm)"
304 select CRYPTO_ECC
305 select CRYPTO_AKCIPHER
306 select CRYPTO_STREEBOG
307 select OID_REGISTRY
308 select ASN1
309 help
310 Elliptic Curve Russian Digital Signature Algorithm (GOST R 34.10-2012,
311 RFC 7091, ISO/IEC 14888-3)
312
313 One of the Russian cryptographic standard algorithms (called GOST
314 algorithms). Only signature verification is implemented.
315
316config CRYPTO_SM2
317 tristate "SM2 (ShangMi 2)"
318 select CRYPTO_SM3
319 select CRYPTO_AKCIPHER
320 select CRYPTO_MANAGER
321 select MPILIB
322 select ASN1
323 help
324 SM2 (ShangMi 2) public key algorithm
325
326 Published by State Encryption Management Bureau, China,
327 as specified by OSCCA GM/T 0003.1-2012 -- 0003.5-2012.
328
329 References:
330 https://datatracker.ietf.org/doc/draft-shen-sm2-ecdsa/
331 http://www.oscca.gov.cn/sca/xxgk/2010-12/17/content_1002386.shtml
332 http://www.gmbz.org.cn/main/bzlb.html
333
334config CRYPTO_CURVE25519
335 tristate "Curve25519"
336 select CRYPTO_KPP
337 select CRYPTO_LIB_CURVE25519_GENERIC
338 help
339 Curve25519 elliptic curve (RFC7748)
340
341endmenu
342
343menu "Block ciphers"
344
345config CRYPTO_AES
346 tristate "AES (Advanced Encryption Standard)"
347 select CRYPTO_ALGAPI
348 select CRYPTO_LIB_AES
349 help
350 AES cipher algorithms (Rijndael)(FIPS-197, ISO/IEC 18033-3)
351
352 Rijndael appears to be consistently a very good performer in
353 both hardware and software across a wide range of computing
354 environments regardless of its use in feedback or non-feedback
355 modes. Its key setup time is excellent, and its key agility is
356 good. Rijndael's very low memory requirements make it very well
357 suited for restricted-space environments, in which it also
358 demonstrates excellent performance. Rijndael's operations are
359 among the easiest to defend against power and timing attacks.
360
361 The AES specifies three key sizes: 128, 192 and 256 bits
362
363config CRYPTO_AES_TI
364 tristate "AES (Advanced Encryption Standard) (fixed time)"
365 select CRYPTO_ALGAPI
366 select CRYPTO_LIB_AES
367 help
368 AES cipher algorithms (Rijndael)(FIPS-197, ISO/IEC 18033-3)
369
370 This is a generic implementation of AES that attempts to eliminate
371 data dependent latencies as much as possible without affecting
372 performance too much. It is intended for use by the generic CCM
373 and GCM drivers, and other CTR or CMAC/XCBC based modes that rely
374 solely on encryption (although decryption is supported as well, but
375 with a more dramatic performance hit)
376
377 Instead of using 16 lookup tables of 1 KB each, (8 for encryption and
378 8 for decryption), this implementation only uses just two S-boxes of
379 256 bytes each, and attempts to eliminate data dependent latencies by
380 prefetching the entire table into the cache at the start of each
381 block. Interrupts are also disabled to avoid races where cachelines
382 are evicted when the CPU is interrupted to do something else.
383
384config CRYPTO_ANUBIS
385 tristate "Anubis"
386 depends on CRYPTO_USER_API_ENABLE_OBSOLETE
387 select CRYPTO_ALGAPI
388 help
389 Anubis cipher algorithm
390
391 Anubis is a variable key length cipher which can use keys from
392 128 bits to 320 bits in length. It was evaluated as a entrant
393 in the NESSIE competition.
394
395 See https://web.archive.org/web/20160606112246/http://www.larc.usp.br/~pbarreto/AnubisPage.html
396 for further information.
397
398config CRYPTO_ARIA
399 tristate "ARIA"
400 select CRYPTO_ALGAPI
401 help
402 ARIA cipher algorithm (RFC5794)
403
404 ARIA is a standard encryption algorithm of the Republic of Korea.
405 The ARIA specifies three key sizes and rounds.
406 128-bit: 12 rounds.
407 192-bit: 14 rounds.
408 256-bit: 16 rounds.
409
410 See:
411 https://seed.kisa.or.kr/kisa/algorithm/EgovAriaInfo.do
412
413config CRYPTO_BLOWFISH
414 tristate "Blowfish"
415 select CRYPTO_ALGAPI
416 select CRYPTO_BLOWFISH_COMMON
417 help
418 Blowfish cipher algorithm, by Bruce Schneier
419
420 This is a variable key length cipher which can use keys from 32
421 bits to 448 bits in length. It's fast, simple and specifically
422 designed for use on "large microprocessors".
423
424 See https://www.schneier.com/blowfish.html for further information.
425
426config CRYPTO_BLOWFISH_COMMON
427 tristate
428 help
429 Common parts of the Blowfish cipher algorithm shared by the
430 generic c and the assembler implementations.
431
432config CRYPTO_CAMELLIA
433 tristate "Camellia"
434 select CRYPTO_ALGAPI
435 help
436 Camellia cipher algorithms (ISO/IEC 18033-3)
437
438 Camellia is a symmetric key block cipher developed jointly
439 at NTT and Mitsubishi Electric Corporation.
440
441 The Camellia specifies three key sizes: 128, 192 and 256 bits.
442
443 See https://info.isl.ntt.co.jp/crypt/eng/camellia/ for further information.
444
445config CRYPTO_CAST_COMMON
446 tristate
447 help
448 Common parts of the CAST cipher algorithms shared by the
449 generic c and the assembler implementations.
450
451config CRYPTO_CAST5
452 tristate "CAST5 (CAST-128)"
453 select CRYPTO_ALGAPI
454 select CRYPTO_CAST_COMMON
455 help
456 CAST5 (CAST-128) cipher algorithm (RFC2144, ISO/IEC 18033-3)
457
458config CRYPTO_CAST6
459 tristate "CAST6 (CAST-256)"
460 select CRYPTO_ALGAPI
461 select CRYPTO_CAST_COMMON
462 help
463 CAST6 (CAST-256) encryption algorithm (RFC2612)
464
465config CRYPTO_DES
466 tristate "DES and Triple DES EDE"
467 select CRYPTO_ALGAPI
468 select CRYPTO_LIB_DES
469 help
470 DES (Data Encryption Standard)(FIPS 46-2, ISO/IEC 18033-3) and
471 Triple DES EDE (Encrypt/Decrypt/Encrypt) (FIPS 46-3, ISO/IEC 18033-3)
472 cipher algorithms
473
474config CRYPTO_FCRYPT
475 tristate "FCrypt"
476 select CRYPTO_ALGAPI
477 select CRYPTO_SKCIPHER
478 help
479 FCrypt algorithm used by RxRPC
480
481 See https://ota.polyonymo.us/fcrypt-paper.txt
482
483config CRYPTO_KHAZAD
484 tristate "Khazad"
485 depends on CRYPTO_USER_API_ENABLE_OBSOLETE
486 select CRYPTO_ALGAPI
487 help
488 Khazad cipher algorithm
489
490 Khazad was a finalist in the initial NESSIE competition. It is
491 an algorithm optimized for 64-bit processors with good performance
492 on 32-bit processors. Khazad uses an 128 bit key size.
493
494 See https://web.archive.org/web/20171011071731/http://www.larc.usp.br/~pbarreto/KhazadPage.html
495 for further information.
496
497config CRYPTO_SEED
498 tristate "SEED"
499 depends on CRYPTO_USER_API_ENABLE_OBSOLETE
500 select CRYPTO_ALGAPI
501 help
502 SEED cipher algorithm (RFC4269, ISO/IEC 18033-3)
503
504 SEED is a 128-bit symmetric key block cipher that has been
505 developed by KISA (Korea Information Security Agency) as a
506 national standard encryption algorithm of the Republic of Korea.
507 It is a 16 round block cipher with the key size of 128 bit.
508
509 See https://seed.kisa.or.kr/kisa/algorithm/EgovSeedInfo.do
510 for further information.
511
512config CRYPTO_SERPENT
513 tristate "Serpent"
514 select CRYPTO_ALGAPI
515 help
516 Serpent cipher algorithm, by Anderson, Biham & Knudsen
517
518 Keys are allowed to be from 0 to 256 bits in length, in steps
519 of 8 bits.
520
521 See https://www.cl.cam.ac.uk/~rja14/serpent.html for further information.
522
523config CRYPTO_SM4
524 tristate
525
526config CRYPTO_SM4_GENERIC
527 tristate "SM4 (ShangMi 4)"
528 select CRYPTO_ALGAPI
529 select CRYPTO_SM4
530 help
531 SM4 cipher algorithms (OSCCA GB/T 32907-2016,
532 ISO/IEC 18033-3:2010/Amd 1:2021)
533
534 SM4 (GBT.32907-2016) is a cryptographic standard issued by the
535 Organization of State Commercial Administration of China (OSCCA)
536 as an authorized cryptographic algorithms for the use within China.
537
538 SMS4 was originally created for use in protecting wireless
539 networks, and is mandated in the Chinese National Standard for
540 Wireless LAN WAPI (Wired Authentication and Privacy Infrastructure)
541 (GB.15629.11-2003).
542
543 The latest SM4 standard (GBT.32907-2016) was proposed by OSCCA and
544 standardized through TC 260 of the Standardization Administration
545 of the People's Republic of China (SAC).
546
547 The input, output, and key of SMS4 are each 128 bits.
548
549 See https://eprint.iacr.org/2008/329.pdf for further information.
550
551 If unsure, say N.
552
553config CRYPTO_TEA
554 tristate "TEA, XTEA and XETA"
555 depends on CRYPTO_USER_API_ENABLE_OBSOLETE
556 select CRYPTO_ALGAPI
557 help
558 TEA (Tiny Encryption Algorithm) cipher algorithms
559
560 Tiny Encryption Algorithm is a simple cipher that uses
561 many rounds for security. It is very fast and uses
562 little memory.
563
564 Xtendend Tiny Encryption Algorithm is a modification to
565 the TEA algorithm to address a potential key weakness
566 in the TEA algorithm.
567
568 Xtendend Encryption Tiny Algorithm is a mis-implementation
569 of the XTEA algorithm for compatibility purposes.
570
571config CRYPTO_TWOFISH
572 tristate "Twofish"
573 select CRYPTO_ALGAPI
574 select CRYPTO_TWOFISH_COMMON
575 help
576 Twofish cipher algorithm
577
578 Twofish was submitted as an AES (Advanced Encryption Standard)
579 candidate cipher by researchers at CounterPane Systems. It is a
580 16 round block cipher supporting key sizes of 128, 192, and 256
581 bits.
582
583 See https://www.schneier.com/twofish.html for further information.
584
585config CRYPTO_TWOFISH_COMMON
586 tristate
587 help
588 Common parts of the Twofish cipher algorithm shared by the
589 generic c and the assembler implementations.
590
591endmenu
592
593menu "Length-preserving ciphers and modes"
594
595config CRYPTO_ADIANTUM
596 tristate "Adiantum"
597 select CRYPTO_CHACHA20
598 select CRYPTO_LIB_POLY1305_GENERIC
599 select CRYPTO_NHPOLY1305
600 select CRYPTO_MANAGER
601 help
602 Adiantum tweakable, length-preserving encryption mode
603
604 Designed for fast and secure disk encryption, especially on
605 CPUs without dedicated crypto instructions. It encrypts
606 each sector using the XChaCha12 stream cipher, two passes of
607 an ε-almost-∆-universal hash function, and an invocation of
608 the AES-256 block cipher on a single 16-byte block. On CPUs
609 without AES instructions, Adiantum is much faster than
610 AES-XTS.
611
612 Adiantum's security is provably reducible to that of its
613 underlying stream and block ciphers, subject to a security
614 bound. Unlike XTS, Adiantum is a true wide-block encryption
615 mode, so it actually provides an even stronger notion of
616 security than XTS, subject to the security bound.
617
618 If unsure, say N.
619
620config CRYPTO_ARC4
621 tristate "ARC4 (Alleged Rivest Cipher 4)"
622 depends on CRYPTO_USER_API_ENABLE_OBSOLETE
623 select CRYPTO_SKCIPHER
624 select CRYPTO_LIB_ARC4
625 help
626 ARC4 cipher algorithm
627
628 ARC4 is a stream cipher using keys ranging from 8 bits to 2048
629 bits in length. This algorithm is required for driver-based
630 WEP, but it should not be for other purposes because of the
631 weakness of the algorithm.
632
633config CRYPTO_CHACHA20
634 tristate "ChaCha"
635 select CRYPTO_LIB_CHACHA_GENERIC
636 select CRYPTO_SKCIPHER
637 help
638 The ChaCha20, XChaCha20, and XChaCha12 stream cipher algorithms
639
640 ChaCha20 is a 256-bit high-speed stream cipher designed by Daniel J.
641 Bernstein and further specified in RFC7539 for use in IETF protocols.
642 This is the portable C implementation of ChaCha20. See
643 https://cr.yp.to/chacha/chacha-20080128.pdf for further information.
644
645 XChaCha20 is the application of the XSalsa20 construction to ChaCha20
646 rather than to Salsa20. XChaCha20 extends ChaCha20's nonce length
647 from 64 bits (or 96 bits using the RFC7539 convention) to 192 bits,
648 while provably retaining ChaCha20's security. See
649 https://cr.yp.to/snuffle/xsalsa-20081128.pdf for further information.
650
651 XChaCha12 is XChaCha20 reduced to 12 rounds, with correspondingly
652 reduced security margin but increased performance. It can be needed
653 in some performance-sensitive scenarios.
654
655config CRYPTO_CBC
656 tristate "CBC (Cipher Block Chaining)"
657 select CRYPTO_SKCIPHER
658 select CRYPTO_MANAGER
659 help
660 CBC (Cipher Block Chaining) mode (NIST SP800-38A)
661
662 This block cipher mode is required for IPSec ESP (XFRM_ESP).
663
664config CRYPTO_CTR
665 tristate "CTR (Counter)"
666 select CRYPTO_SKCIPHER
667 select CRYPTO_MANAGER
668 help
669 CTR (Counter) mode (NIST SP800-38A)
670
671config CRYPTO_CTS
672 tristate "CTS (Cipher Text Stealing)"
673 select CRYPTO_SKCIPHER
674 select CRYPTO_MANAGER
675 help
676 CBC-CS3 variant of CTS (Cipher Text Stealing) (NIST
677 Addendum to SP800-38A (October 2010))
678
679 This mode is required for Kerberos gss mechanism support
680 for AES encryption.
681
682config CRYPTO_ECB
683 tristate "ECB (Electronic Codebook)"
684 select CRYPTO_SKCIPHER2
685 select CRYPTO_MANAGER
686 help
687 ECB (Electronic Codebook) mode (NIST SP800-38A)
688
689config CRYPTO_HCTR2
690 tristate "HCTR2"
691 select CRYPTO_XCTR
692 select CRYPTO_POLYVAL
693 select CRYPTO_MANAGER
694 help
695 HCTR2 length-preserving encryption mode
696
697 A mode for storage encryption that is efficient on processors with
698 instructions to accelerate AES and carryless multiplication, e.g.
699 x86 processors with AES-NI and CLMUL, and ARM processors with the
700 ARMv8 crypto extensions.
701
702 See https://eprint.iacr.org/2021/1441
703
704config CRYPTO_KEYWRAP
705 tristate "KW (AES Key Wrap)"
706 select CRYPTO_SKCIPHER
707 select CRYPTO_MANAGER
708 help
709 KW (AES Key Wrap) authenticated encryption mode (NIST SP800-38F
710 and RFC3394) without padding.
711
712config CRYPTO_LRW
713 tristate "LRW (Liskov Rivest Wagner)"
714 select CRYPTO_LIB_GF128MUL
715 select CRYPTO_SKCIPHER
716 select CRYPTO_MANAGER
717 select CRYPTO_ECB
718 help
719 LRW (Liskov Rivest Wagner) mode
720
721 A tweakable, non malleable, non movable
722 narrow block cipher mode for dm-crypt. Use it with cipher
723 specification string aes-lrw-benbi, the key must be 256, 320 or 384.
724 The first 128, 192 or 256 bits in the key are used for AES and the
725 rest is used to tie each cipher block to its logical position.
726
727 See https://people.csail.mit.edu/rivest/pubs/LRW02.pdf
728
729config CRYPTO_PCBC
730 tristate "PCBC (Propagating Cipher Block Chaining)"
731 select CRYPTO_SKCIPHER
732 select CRYPTO_MANAGER
733 help
734 PCBC (Propagating Cipher Block Chaining) mode
735
736 This block cipher mode is required for RxRPC.
737
738config CRYPTO_XCTR
739 tristate
740 select CRYPTO_SKCIPHER
741 select CRYPTO_MANAGER
742 help
743 XCTR (XOR Counter) mode for HCTR2
744
745 This blockcipher mode is a variant of CTR mode using XORs and little-endian
746 addition rather than big-endian arithmetic.
747
748 XCTR mode is used to implement HCTR2.
749
750config CRYPTO_XTS
751 tristate "XTS (XOR Encrypt XOR with ciphertext stealing)"
752 select CRYPTO_SKCIPHER
753 select CRYPTO_MANAGER
754 select CRYPTO_ECB
755 help
756 XTS (XOR Encrypt XOR with ciphertext stealing) mode (NIST SP800-38E
757 and IEEE 1619)
758
759 Use with aes-xts-plain, key size 256, 384 or 512 bits. This
760 implementation currently can't handle a sectorsize which is not a
761 multiple of 16 bytes.
762
763config CRYPTO_NHPOLY1305
764 tristate
765 select CRYPTO_HASH
766 select CRYPTO_LIB_POLY1305_GENERIC
767
768endmenu
769
770menu "AEAD (authenticated encryption with associated data) ciphers"
771
772config CRYPTO_AEGIS128
773 tristate "AEGIS-128"
774 select CRYPTO_AEAD
775 select CRYPTO_AES # for AES S-box tables
776 help
777 AEGIS-128 AEAD algorithm
778
779config CRYPTO_AEGIS128_SIMD
780 bool "AEGIS-128 (arm NEON, arm64 NEON)"
781 depends on CRYPTO_AEGIS128 && ((ARM || ARM64) && KERNEL_MODE_NEON)
782 default y
783 help
784 AEGIS-128 AEAD algorithm
785
786 Architecture: arm or arm64 using:
787 - NEON (Advanced SIMD) extension
788
789config CRYPTO_CHACHA20POLY1305
790 tristate "ChaCha20-Poly1305"
791 select CRYPTO_CHACHA20
792 select CRYPTO_POLY1305
793 select CRYPTO_AEAD
794 select CRYPTO_MANAGER
795 help
796 ChaCha20 stream cipher and Poly1305 authenticator combined
797 mode (RFC8439)
798
799config CRYPTO_CCM
800 tristate "CCM (Counter with Cipher Block Chaining-MAC)"
801 select CRYPTO_CTR
802 select CRYPTO_HASH
803 select CRYPTO_AEAD
804 select CRYPTO_MANAGER
805 help
806 CCM (Counter with Cipher Block Chaining-Message Authentication Code)
807 authenticated encryption mode (NIST SP800-38C)
808
809config CRYPTO_GCM
810 tristate "GCM (Galois/Counter Mode) and GMAC (GCM MAC)"
811 select CRYPTO_CTR
812 select CRYPTO_AEAD
813 select CRYPTO_GHASH
814 select CRYPTO_NULL
815 select CRYPTO_MANAGER
816 help
817 GCM (Galois/Counter Mode) authenticated encryption mode and GMAC
818 (GCM Message Authentication Code) (NIST SP800-38D)
819
820 This is required for IPSec ESP (XFRM_ESP).
821
822config CRYPTO_GENIV
823 tristate
824 select CRYPTO_AEAD
825 select CRYPTO_NULL
826 select CRYPTO_MANAGER
827 select CRYPTO_RNG_DEFAULT
828
829config CRYPTO_SEQIV
830 tristate "Sequence Number IV Generator"
831 select CRYPTO_GENIV
832 help
833 Sequence Number IV generator
834
835 This IV generator generates an IV based on a sequence number by
836 xoring it with a salt. This algorithm is mainly useful for CTR.
837
838 This is required for IPsec ESP (XFRM_ESP).
839
840config CRYPTO_ECHAINIV
841 tristate "Encrypted Chain IV Generator"
842 select CRYPTO_GENIV
843 help
844 Encrypted Chain IV generator
845
846 This IV generator generates an IV based on the encryption of
847 a sequence number xored with a salt. This is the default
848 algorithm for CBC.
849
850config CRYPTO_ESSIV
851 tristate "Encrypted Salt-Sector IV Generator"
852 select CRYPTO_AUTHENC
853 help
854 Encrypted Salt-Sector IV generator
855
856 This IV generator is used in some cases by fscrypt and/or
857 dm-crypt. It uses the hash of the block encryption key as the
858 symmetric key for a block encryption pass applied to the input
859 IV, making low entropy IV sources more suitable for block
860 encryption.
861
862 This driver implements a crypto API template that can be
863 instantiated either as an skcipher or as an AEAD (depending on the
864 type of the first template argument), and which defers encryption
865 and decryption requests to the encapsulated cipher after applying
866 ESSIV to the input IV. Note that in the AEAD case, it is assumed
867 that the keys are presented in the same format used by the authenc
868 template, and that the IV appears at the end of the authenticated
869 associated data (AAD) region (which is how dm-crypt uses it.)
870
871 Note that the use of ESSIV is not recommended for new deployments,
872 and so this only needs to be enabled when interoperability with
873 existing encrypted volumes of filesystems is required, or when
874 building for a particular system that requires it (e.g., when
875 the SoC in question has accelerated CBC but not XTS, making CBC
876 combined with ESSIV the only feasible mode for h/w accelerated
877 block encryption)
878
879endmenu
880
881menu "Hashes, digests, and MACs"
882
883config CRYPTO_BLAKE2B
884 tristate "BLAKE2b"
885 select CRYPTO_HASH
886 help
887 BLAKE2b cryptographic hash function (RFC 7693)
888
889 BLAKE2b is optimized for 64-bit platforms and can produce digests
890 of any size between 1 and 64 bytes. The keyed hash is also implemented.
891
892 This module provides the following algorithms:
893 - blake2b-160
894 - blake2b-256
895 - blake2b-384
896 - blake2b-512
897
898 Used by the btrfs filesystem.
899
900 See https://blake2.net for further information.
901
902config CRYPTO_CMAC
903 tristate "CMAC (Cipher-based MAC)"
904 select CRYPTO_HASH
905 select CRYPTO_MANAGER
906 help
907 CMAC (Cipher-based Message Authentication Code) authentication
908 mode (NIST SP800-38B and IETF RFC4493)
909
910config CRYPTO_GHASH
911 tristate "GHASH"
912 select CRYPTO_HASH
913 select CRYPTO_LIB_GF128MUL
914 help
915 GCM GHASH function (NIST SP800-38D)
916
917config CRYPTO_HMAC
918 tristate "HMAC (Keyed-Hash MAC)"
919 select CRYPTO_HASH
920 select CRYPTO_MANAGER
921 help
922 HMAC (Keyed-Hash Message Authentication Code) (FIPS 198 and
923 RFC2104)
924
925 This is required for IPsec AH (XFRM_AH) and IPsec ESP (XFRM_ESP).
926
927config CRYPTO_MD4
928 tristate "MD4"
929 select CRYPTO_HASH
930 help
931 MD4 message digest algorithm (RFC1320)
932
933config CRYPTO_MD5
934 tristate "MD5"
935 select CRYPTO_HASH
936 help
937 MD5 message digest algorithm (RFC1321)
938
939config CRYPTO_MICHAEL_MIC
940 tristate "Michael MIC"
941 select CRYPTO_HASH
942 help
943 Michael MIC (Message Integrity Code) (IEEE 802.11i)
944
945 Defined by the IEEE 802.11i TKIP (Temporal Key Integrity Protocol),
946 known as WPA (Wif-Fi Protected Access).
947
948 This algorithm is required for TKIP, but it should not be used for
949 other purposes because of the weakness of the algorithm.
950
951config CRYPTO_POLYVAL
952 tristate
953 select CRYPTO_HASH
954 select CRYPTO_LIB_GF128MUL
955 help
956 POLYVAL hash function for HCTR2
957
958 This is used in HCTR2. It is not a general-purpose
959 cryptographic hash function.
960
961config CRYPTO_POLY1305
962 tristate "Poly1305"
963 select CRYPTO_HASH
964 select CRYPTO_LIB_POLY1305_GENERIC
965 help
966 Poly1305 authenticator algorithm (RFC7539)
967
968 Poly1305 is an authenticator algorithm designed by Daniel J. Bernstein.
969 It is used for the ChaCha20-Poly1305 AEAD, specified in RFC7539 for use
970 in IETF protocols. This is the portable C implementation of Poly1305.
971
972config CRYPTO_RMD160
973 tristate "RIPEMD-160"
974 select CRYPTO_HASH
975 help
976 RIPEMD-160 hash function (ISO/IEC 10118-3)
977
978 RIPEMD-160 is a 160-bit cryptographic hash function. It is intended
979 to be used as a secure replacement for the 128-bit hash functions
980 MD4, MD5 and its predecessor RIPEMD
981 (not to be confused with RIPEMD-128).
982
983 Its speed is comparable to SHA-1 and there are no known attacks
984 against RIPEMD-160.
985
986 Developed by Hans Dobbertin, Antoon Bosselaers and Bart Preneel.
987 See https://homes.esat.kuleuven.be/~bosselae/ripemd160.html
988 for further information.
989
990config CRYPTO_SHA1
991 tristate "SHA-1"
992 select CRYPTO_HASH
993 select CRYPTO_LIB_SHA1
994 help
995 SHA-1 secure hash algorithm (FIPS 180, ISO/IEC 10118-3)
996
997config CRYPTO_SHA256
998 tristate "SHA-224 and SHA-256"
999 select CRYPTO_HASH
1000 select CRYPTO_LIB_SHA256
1001 help
1002 SHA-224 and SHA-256 secure hash algorithms (FIPS 180, ISO/IEC 10118-3)
1003
1004 This is required for IPsec AH (XFRM_AH) and IPsec ESP (XFRM_ESP).
1005 Used by the btrfs filesystem, Ceph, NFS, and SMB.
1006
1007config CRYPTO_SHA512
1008 tristate "SHA-384 and SHA-512"
1009 select CRYPTO_HASH
1010 help
1011 SHA-384 and SHA-512 secure hash algorithms (FIPS 180, ISO/IEC 10118-3)
1012
1013config CRYPTO_SHA3
1014 tristate "SHA-3"
1015 select CRYPTO_HASH
1016 help
1017 SHA-3 secure hash algorithms (FIPS 202, ISO/IEC 10118-3)
1018
1019config CRYPTO_SM3
1020 tristate
1021
1022config CRYPTO_SM3_GENERIC
1023 tristate "SM3 (ShangMi 3)"
1024 select CRYPTO_HASH
1025 select CRYPTO_SM3
1026 help
1027 SM3 (ShangMi 3) secure hash function (OSCCA GM/T 0004-2012, ISO/IEC 10118-3)
1028
1029 This is part of the Chinese Commercial Cryptography suite.
1030
1031 References:
1032 http://www.oscca.gov.cn/UpFile/20101222141857786.pdf
1033 https://datatracker.ietf.org/doc/html/draft-shen-sm3-hash
1034
1035config CRYPTO_STREEBOG
1036 tristate "Streebog"
1037 select CRYPTO_HASH
1038 help
1039 Streebog Hash Function (GOST R 34.11-2012, RFC 6986, ISO/IEC 10118-3)
1040
1041 This is one of the Russian cryptographic standard algorithms (called
1042 GOST algorithms). This setting enables two hash algorithms with
1043 256 and 512 bits output.
1044
1045 References:
1046 https://tc26.ru/upload/iblock/fed/feddbb4d26b685903faa2ba11aea43f6.pdf
1047 https://tools.ietf.org/html/rfc6986
1048
1049config CRYPTO_VMAC
1050 tristate "VMAC"
1051 select CRYPTO_HASH
1052 select CRYPTO_MANAGER
1053 help
1054 VMAC is a message authentication algorithm designed for
1055 very high speed on 64-bit architectures.
1056
1057 See https://fastcrypto.org/vmac for further information.
1058
1059config CRYPTO_WP512
1060 tristate "Whirlpool"
1061 select CRYPTO_HASH
1062 help
1063 Whirlpool hash function (ISO/IEC 10118-3)
1064
1065 512, 384 and 256-bit hashes.
1066
1067 Whirlpool-512 is part of the NESSIE cryptographic primitives.
1068
1069 See https://web.archive.org/web/20171129084214/http://www.larc.usp.br/~pbarreto/WhirlpoolPage.html
1070 for further information.
1071
1072config CRYPTO_XCBC
1073 tristate "XCBC-MAC (Extended Cipher Block Chaining MAC)"
1074 select CRYPTO_HASH
1075 select CRYPTO_MANAGER
1076 help
1077 XCBC-MAC (Extended Cipher Block Chaining Message Authentication
1078 Code) (RFC3566)
1079
1080config CRYPTO_XXHASH
1081 tristate "xxHash"
1082 select CRYPTO_HASH
1083 select XXHASH
1084 help
1085 xxHash non-cryptographic hash algorithm
1086
1087 Extremely fast, working at speeds close to RAM limits.
1088
1089 Used by the btrfs filesystem.
1090
1091endmenu
1092
1093menu "CRCs (cyclic redundancy checks)"
1094
1095config CRYPTO_CRC32C
1096 tristate "CRC32c"
1097 select CRYPTO_HASH
1098 select CRC32
1099 help
1100 CRC32c CRC algorithm with the iSCSI polynomial (RFC 3385 and RFC 3720)
1101
1102 A 32-bit CRC (cyclic redundancy check) with a polynomial defined
1103 by G. Castagnoli, S. Braeuer and M. Herrman in "Optimization of Cyclic
1104 Redundancy-Check Codes with 24 and 32 Parity Bits", IEEE Transactions
1105 on Communications, Vol. 41, No. 6, June 1993, selected for use with
1106 iSCSI.
1107
1108 Used by btrfs, ext4, jbd2, NVMeoF/TCP, and iSCSI.
1109
1110config CRYPTO_CRC32
1111 tristate "CRC32"
1112 select CRYPTO_HASH
1113 select CRC32
1114 help
1115 CRC32 CRC algorithm (IEEE 802.3)
1116
1117 Used by RoCEv2 and f2fs.
1118
1119config CRYPTO_CRCT10DIF
1120 tristate "CRCT10DIF"
1121 select CRYPTO_HASH
1122 help
1123 CRC16 CRC algorithm used for the T10 (SCSI) Data Integrity Field (DIF)
1124
1125 CRC algorithm used by the SCSI Block Commands standard.
1126
1127config CRYPTO_CRC64_ROCKSOFT
1128 tristate "CRC64 based on Rocksoft Model algorithm"
1129 depends on CRC64
1130 select CRYPTO_HASH
1131 help
1132 CRC64 CRC algorithm based on the Rocksoft Model CRC Algorithm
1133
1134 Used by the NVMe implementation of T10 DIF (BLK_DEV_INTEGRITY)
1135
1136 See https://zlib.net/crc_v3.txt
1137
1138endmenu
1139
1140menu "Compression"
1141
1142config CRYPTO_DEFLATE
1143 tristate "Deflate"
1144 select CRYPTO_ALGAPI
1145 select CRYPTO_ACOMP2
1146 select ZLIB_INFLATE
1147 select ZLIB_DEFLATE
1148 help
1149 Deflate compression algorithm (RFC1951)
1150
1151 Used by IPSec with the IPCOMP protocol (RFC3173, RFC2394)
1152
1153config CRYPTO_LZO
1154 tristate "LZO"
1155 select CRYPTO_ALGAPI
1156 select CRYPTO_ACOMP2
1157 select LZO_COMPRESS
1158 select LZO_DECOMPRESS
1159 help
1160 LZO compression algorithm
1161
1162 See https://www.oberhumer.com/opensource/lzo/ for further information.
1163
1164config CRYPTO_842
1165 tristate "842"
1166 select CRYPTO_ALGAPI
1167 select CRYPTO_ACOMP2
1168 select 842_COMPRESS
1169 select 842_DECOMPRESS
1170 help
1171 842 compression algorithm by IBM
1172
1173 See https://github.com/plauth/lib842 for further information.
1174
1175config CRYPTO_LZ4
1176 tristate "LZ4"
1177 select CRYPTO_ALGAPI
1178 select CRYPTO_ACOMP2
1179 select LZ4_COMPRESS
1180 select LZ4_DECOMPRESS
1181 help
1182 LZ4 compression algorithm
1183
1184 See https://github.com/lz4/lz4 for further information.
1185
1186config CRYPTO_LZ4HC
1187 tristate "LZ4HC"
1188 select CRYPTO_ALGAPI
1189 select CRYPTO_ACOMP2
1190 select LZ4HC_COMPRESS
1191 select LZ4_DECOMPRESS
1192 help
1193 LZ4 high compression mode algorithm
1194
1195 See https://github.com/lz4/lz4 for further information.
1196
1197config CRYPTO_ZSTD
1198 tristate "Zstd"
1199 select CRYPTO_ALGAPI
1200 select CRYPTO_ACOMP2
1201 select ZSTD_COMPRESS
1202 select ZSTD_DECOMPRESS
1203 help
1204 zstd compression algorithm
1205
1206 See https://github.com/facebook/zstd for further information.
1207
1208endmenu
1209
1210menu "Random number generation"
1211
1212config CRYPTO_ANSI_CPRNG
1213 tristate "ANSI PRNG (Pseudo Random Number Generator)"
1214 select CRYPTO_AES
1215 select CRYPTO_RNG
1216 help
1217 Pseudo RNG (random number generator) (ANSI X9.31 Appendix A.2.4)
1218
1219 This uses the AES cipher algorithm.
1220
1221 Note that this option must be enabled if CRYPTO_FIPS is selected
1222
1223menuconfig CRYPTO_DRBG_MENU
1224 tristate "NIST SP800-90A DRBG (Deterministic Random Bit Generator)"
1225 help
1226 DRBG (Deterministic Random Bit Generator) (NIST SP800-90A)
1227
1228 In the following submenu, one or more of the DRBG types must be selected.
1229
1230if CRYPTO_DRBG_MENU
1231
1232config CRYPTO_DRBG_HMAC
1233 bool
1234 default y
1235 select CRYPTO_HMAC
1236 select CRYPTO_SHA512
1237
1238config CRYPTO_DRBG_HASH
1239 bool "Hash_DRBG"
1240 select CRYPTO_SHA256
1241 help
1242 Hash_DRBG variant as defined in NIST SP800-90A.
1243
1244 This uses the SHA-1, SHA-256, SHA-384, or SHA-512 hash algorithms.
1245
1246config CRYPTO_DRBG_CTR
1247 bool "CTR_DRBG"
1248 select CRYPTO_AES
1249 select CRYPTO_CTR
1250 help
1251 CTR_DRBG variant as defined in NIST SP800-90A.
1252
1253 This uses the AES cipher algorithm with the counter block mode.
1254
1255config CRYPTO_DRBG
1256 tristate
1257 default CRYPTO_DRBG_MENU
1258 select CRYPTO_RNG
1259 select CRYPTO_JITTERENTROPY
1260
1261endif # if CRYPTO_DRBG_MENU
1262
1263config CRYPTO_JITTERENTROPY
1264 tristate "CPU Jitter Non-Deterministic RNG (Random Number Generator)"
1265 select CRYPTO_RNG
1266 select CRYPTO_SHA3
1267 help
1268 CPU Jitter RNG (Random Number Generator) from the Jitterentropy library
1269
1270 A non-physical non-deterministic ("true") RNG (e.g., an entropy source
1271 compliant with NIST SP800-90B) intended to provide a seed to a
1272 deterministic RNG (e.g. per NIST SP800-90C).
1273 This RNG does not perform any cryptographic whitening of the generated
1274
1275 See https://www.chronox.de/jent.html
1276
1277if CRYPTO_JITTERENTROPY
1278if CRYPTO_FIPS && EXPERT
1279
1280choice
1281 prompt "CPU Jitter RNG Memory Size"
1282 default CRYPTO_JITTERENTROPY_MEMSIZE_2
1283 help
1284 The Jitter RNG measures the execution time of memory accesses.
1285 Multiple consecutive memory accesses are performed. If the memory
1286 size fits into a cache (e.g. L1), only the memory access timing
1287 to that cache is measured. The closer the cache is to the CPU
1288 the less variations are measured and thus the less entropy is
1289 obtained. Thus, if the memory size fits into the L1 cache, the
1290 obtained entropy is less than if the memory size fits within
1291 L1 + L2, which in turn is less if the memory fits into
1292 L1 + L2 + L3. Thus, by selecting a different memory size,
1293 the entropy rate produced by the Jitter RNG can be modified.
1294
1295 config CRYPTO_JITTERENTROPY_MEMSIZE_2
1296 bool "2048 Bytes (default)"
1297
1298 config CRYPTO_JITTERENTROPY_MEMSIZE_128
1299 bool "128 kBytes"
1300
1301 config CRYPTO_JITTERENTROPY_MEMSIZE_1024
1302 bool "1024 kBytes"
1303
1304 config CRYPTO_JITTERENTROPY_MEMSIZE_8192
1305 bool "8192 kBytes"
1306endchoice
1307
1308config CRYPTO_JITTERENTROPY_MEMORY_BLOCKS
1309 int
1310 default 64 if CRYPTO_JITTERENTROPY_MEMSIZE_2
1311 default 512 if CRYPTO_JITTERENTROPY_MEMSIZE_128
1312 default 1024 if CRYPTO_JITTERENTROPY_MEMSIZE_1024
1313 default 4096 if CRYPTO_JITTERENTROPY_MEMSIZE_8192
1314
1315config CRYPTO_JITTERENTROPY_MEMORY_BLOCKSIZE
1316 int
1317 default 32 if CRYPTO_JITTERENTROPY_MEMSIZE_2
1318 default 256 if CRYPTO_JITTERENTROPY_MEMSIZE_128
1319 default 1024 if CRYPTO_JITTERENTROPY_MEMSIZE_1024
1320 default 2048 if CRYPTO_JITTERENTROPY_MEMSIZE_8192
1321
1322config CRYPTO_JITTERENTROPY_OSR
1323 int "CPU Jitter RNG Oversampling Rate"
1324 range 1 15
1325 default 1
1326 help
1327 The Jitter RNG allows the specification of an oversampling rate (OSR).
1328 The Jitter RNG operation requires a fixed amount of timing
1329 measurements to produce one output block of random numbers. The
1330 OSR value is multiplied with the amount of timing measurements to
1331 generate one output block. Thus, the timing measurement is oversampled
1332 by the OSR factor. The oversampling allows the Jitter RNG to operate
1333 on hardware whose timers deliver limited amount of entropy (e.g.
1334 the timer is coarse) by setting the OSR to a higher value. The
1335 trade-off, however, is that the Jitter RNG now requires more time
1336 to generate random numbers.
1337
1338config CRYPTO_JITTERENTROPY_TESTINTERFACE
1339 bool "CPU Jitter RNG Test Interface"
1340 help
1341 The test interface allows a privileged process to capture
1342 the raw unconditioned high resolution time stamp noise that
1343 is collected by the Jitter RNG for statistical analysis. As
1344 this data is used at the same time to generate random bits,
1345 the Jitter RNG operates in an insecure mode as long as the
1346 recording is enabled. This interface therefore is only
1347 intended for testing purposes and is not suitable for
1348 production systems.
1349
1350 The raw noise data can be obtained using the jent_raw_hires
1351 debugfs file. Using the option
1352 jitterentropy_testing.boot_raw_hires_test=1 the raw noise of
1353 the first 1000 entropy events since boot can be sampled.
1354
1355 If unsure, select N.
1356
1357endif # if CRYPTO_FIPS && EXPERT
1358
1359if !(CRYPTO_FIPS && EXPERT)
1360
1361config CRYPTO_JITTERENTROPY_MEMORY_BLOCKS
1362 int
1363 default 64
1364
1365config CRYPTO_JITTERENTROPY_MEMORY_BLOCKSIZE
1366 int
1367 default 32
1368
1369config CRYPTO_JITTERENTROPY_OSR
1370 int
1371 default 1
1372
1373config CRYPTO_JITTERENTROPY_TESTINTERFACE
1374 bool
1375
1376endif # if !(CRYPTO_FIPS && EXPERT)
1377endif # if CRYPTO_JITTERENTROPY
1378
1379config CRYPTO_KDF800108_CTR
1380 tristate
1381 select CRYPTO_HMAC
1382 select CRYPTO_SHA256
1383
1384endmenu
1385menu "Userspace interface"
1386
1387config CRYPTO_USER_API
1388 tristate
1389
1390config CRYPTO_USER_API_HASH
1391 tristate "Hash algorithms"
1392 depends on NET
1393 select CRYPTO_HASH
1394 select CRYPTO_USER_API
1395 help
1396 Enable the userspace interface for hash algorithms.
1397
1398 See Documentation/crypto/userspace-if.rst and
1399 https://www.chronox.de/libkcapi/html/index.html
1400
1401config CRYPTO_USER_API_SKCIPHER
1402 tristate "Symmetric key cipher algorithms"
1403 depends on NET
1404 select CRYPTO_SKCIPHER
1405 select CRYPTO_USER_API
1406 help
1407 Enable the userspace interface for symmetric key cipher algorithms.
1408
1409 See Documentation/crypto/userspace-if.rst and
1410 https://www.chronox.de/libkcapi/html/index.html
1411
1412config CRYPTO_USER_API_RNG
1413 tristate "RNG (random number generator) algorithms"
1414 depends on NET
1415 select CRYPTO_RNG
1416 select CRYPTO_USER_API
1417 help
1418 Enable the userspace interface for RNG (random number generator)
1419 algorithms.
1420
1421 See Documentation/crypto/userspace-if.rst and
1422 https://www.chronox.de/libkcapi/html/index.html
1423
1424config CRYPTO_USER_API_RNG_CAVP
1425 bool "Enable CAVP testing of DRBG"
1426 depends on CRYPTO_USER_API_RNG && CRYPTO_DRBG
1427 help
1428 Enable extra APIs in the userspace interface for NIST CAVP
1429 (Cryptographic Algorithm Validation Program) testing:
1430 - resetting DRBG entropy
1431 - providing Additional Data
1432
1433 This should only be enabled for CAVP testing. You should say
1434 no unless you know what this is.
1435
1436config CRYPTO_USER_API_AEAD
1437 tristate "AEAD cipher algorithms"
1438 depends on NET
1439 select CRYPTO_AEAD
1440 select CRYPTO_SKCIPHER
1441 select CRYPTO_NULL
1442 select CRYPTO_USER_API
1443 help
1444 Enable the userspace interface for AEAD cipher algorithms.
1445
1446 See Documentation/crypto/userspace-if.rst and
1447 https://www.chronox.de/libkcapi/html/index.html
1448
1449config CRYPTO_USER_API_ENABLE_OBSOLETE
1450 bool "Obsolete cryptographic algorithms"
1451 depends on CRYPTO_USER_API
1452 default y
1453 help
1454 Allow obsolete cryptographic algorithms to be selected that have
1455 already been phased out from internal use by the kernel, and are
1456 only useful for userspace clients that still rely on them.
1457
1458config CRYPTO_STATS
1459 bool "Crypto usage statistics"
1460 depends on CRYPTO_USER
1461 help
1462 Enable the gathering of crypto stats.
1463
1464 Enabling this option reduces the performance of the crypto API. It
1465 should only be enabled when there is actually a use case for it.
1466
1467 This collects data sizes, numbers of requests, and numbers
1468 of errors processed by:
1469 - AEAD ciphers (encrypt, decrypt)
1470 - asymmetric key ciphers (encrypt, decrypt, verify, sign)
1471 - symmetric key ciphers (encrypt, decrypt)
1472 - compression algorithms (compress, decompress)
1473 - hash algorithms (hash)
1474 - key-agreement protocol primitives (setsecret, generate
1475 public key, compute shared secret)
1476 - RNG (generate, seed)
1477
1478endmenu
1479
1480config CRYPTO_HASH_INFO
1481 bool
1482
1483if !KMSAN # avoid false positives from assembly
1484if ARM
1485source "arch/arm/crypto/Kconfig"
1486endif
1487if ARM64
1488source "arch/arm64/crypto/Kconfig"
1489endif
1490if LOONGARCH
1491source "arch/loongarch/crypto/Kconfig"
1492endif
1493if MIPS
1494source "arch/mips/crypto/Kconfig"
1495endif
1496if PPC
1497source "arch/powerpc/crypto/Kconfig"
1498endif
1499if S390
1500source "arch/s390/crypto/Kconfig"
1501endif
1502if SPARC
1503source "arch/sparc/crypto/Kconfig"
1504endif
1505if X86
1506source "arch/x86/crypto/Kconfig"
1507endif
1508endif
1509
1510source "drivers/crypto/Kconfig"
1511source "crypto/asymmetric_keys/Kconfig"
1512source "certs/Kconfig"
1513
1514endif # if CRYPTO
1#
2# Generic algorithms support
3#
4config XOR_BLOCKS
5 tristate
6
7#
8# async_tx api: hardware offloaded memory transfer/transform support
9#
10source "crypto/async_tx/Kconfig"
11
12#
13# Cryptographic API Configuration
14#
15menuconfig CRYPTO
16 tristate "Cryptographic API"
17 help
18 This option provides the core Cryptographic API.
19
20if CRYPTO
21
22comment "Crypto core or helper"
23
24config CRYPTO_FIPS
25 bool "FIPS 200 compliance"
26 depends on (CRYPTO_ANSI_CPRNG || CRYPTO_DRBG) && !CRYPTO_MANAGER_DISABLE_TESTS
27 depends on (MODULE_SIG || !MODULES)
28 help
29 This options enables the fips boot option which is
30 required if you want to system to operate in a FIPS 200
31 certification. You should say no unless you know what
32 this is.
33
34config CRYPTO_ALGAPI
35 tristate
36 select CRYPTO_ALGAPI2
37 help
38 This option provides the API for cryptographic algorithms.
39
40config CRYPTO_ALGAPI2
41 tristate
42
43config CRYPTO_AEAD
44 tristate
45 select CRYPTO_AEAD2
46 select CRYPTO_ALGAPI
47
48config CRYPTO_AEAD2
49 tristate
50 select CRYPTO_ALGAPI2
51 select CRYPTO_NULL2
52 select CRYPTO_RNG2
53
54config CRYPTO_BLKCIPHER
55 tristate
56 select CRYPTO_BLKCIPHER2
57 select CRYPTO_ALGAPI
58
59config CRYPTO_BLKCIPHER2
60 tristate
61 select CRYPTO_ALGAPI2
62 select CRYPTO_RNG2
63 select CRYPTO_WORKQUEUE
64
65config CRYPTO_HASH
66 tristate
67 select CRYPTO_HASH2
68 select CRYPTO_ALGAPI
69
70config CRYPTO_HASH2
71 tristate
72 select CRYPTO_ALGAPI2
73
74config CRYPTO_RNG
75 tristate
76 select CRYPTO_RNG2
77 select CRYPTO_ALGAPI
78
79config CRYPTO_RNG2
80 tristate
81 select CRYPTO_ALGAPI2
82
83config CRYPTO_RNG_DEFAULT
84 tristate
85 select CRYPTO_DRBG_MENU
86
87config CRYPTO_AKCIPHER2
88 tristate
89 select CRYPTO_ALGAPI2
90
91config CRYPTO_AKCIPHER
92 tristate
93 select CRYPTO_AKCIPHER2
94 select CRYPTO_ALGAPI
95
96config CRYPTO_KPP2
97 tristate
98 select CRYPTO_ALGAPI2
99
100config CRYPTO_KPP
101 tristate
102 select CRYPTO_ALGAPI
103 select CRYPTO_KPP2
104
105config CRYPTO_ACOMP2
106 tristate
107 select CRYPTO_ALGAPI2
108
109config CRYPTO_ACOMP
110 tristate
111 select CRYPTO_ALGAPI
112 select CRYPTO_ACOMP2
113
114config CRYPTO_RSA
115 tristate "RSA algorithm"
116 select CRYPTO_AKCIPHER
117 select CRYPTO_MANAGER
118 select MPILIB
119 select ASN1
120 help
121 Generic implementation of the RSA public key algorithm.
122
123config CRYPTO_DH
124 tristate "Diffie-Hellman algorithm"
125 select CRYPTO_KPP
126 select MPILIB
127 help
128 Generic implementation of the Diffie-Hellman algorithm.
129
130config CRYPTO_ECDH
131 tristate "ECDH algorithm"
132 select CRYTPO_KPP
133 help
134 Generic implementation of the ECDH algorithm
135
136config CRYPTO_MANAGER
137 tristate "Cryptographic algorithm manager"
138 select CRYPTO_MANAGER2
139 help
140 Create default cryptographic template instantiations such as
141 cbc(aes).
142
143config CRYPTO_MANAGER2
144 def_tristate CRYPTO_MANAGER || (CRYPTO_MANAGER!=n && CRYPTO_ALGAPI=y)
145 select CRYPTO_AEAD2
146 select CRYPTO_HASH2
147 select CRYPTO_BLKCIPHER2
148 select CRYPTO_AKCIPHER2
149 select CRYPTO_KPP2
150 select CRYPTO_ACOMP2
151
152config CRYPTO_USER
153 tristate "Userspace cryptographic algorithm configuration"
154 depends on NET
155 select CRYPTO_MANAGER
156 help
157 Userspace configuration for cryptographic instantiations such as
158 cbc(aes).
159
160config CRYPTO_MANAGER_DISABLE_TESTS
161 bool "Disable run-time self tests"
162 default y
163 depends on CRYPTO_MANAGER2
164 help
165 Disable run-time self tests that normally take place at
166 algorithm registration.
167
168config CRYPTO_GF128MUL
169 tristate "GF(2^128) multiplication functions"
170 help
171 Efficient table driven implementation of multiplications in the
172 field GF(2^128). This is needed by some cypher modes. This
173 option will be selected automatically if you select such a
174 cipher mode. Only select this option by hand if you expect to load
175 an external module that requires these functions.
176
177config CRYPTO_NULL
178 tristate "Null algorithms"
179 select CRYPTO_NULL2
180 help
181 These are 'Null' algorithms, used by IPsec, which do nothing.
182
183config CRYPTO_NULL2
184 tristate
185 select CRYPTO_ALGAPI2
186 select CRYPTO_BLKCIPHER2
187 select CRYPTO_HASH2
188
189config CRYPTO_PCRYPT
190 tristate "Parallel crypto engine"
191 depends on SMP
192 select PADATA
193 select CRYPTO_MANAGER
194 select CRYPTO_AEAD
195 help
196 This converts an arbitrary crypto algorithm into a parallel
197 algorithm that executes in kernel threads.
198
199config CRYPTO_WORKQUEUE
200 tristate
201
202config CRYPTO_CRYPTD
203 tristate "Software async crypto daemon"
204 select CRYPTO_BLKCIPHER
205 select CRYPTO_HASH
206 select CRYPTO_MANAGER
207 select CRYPTO_WORKQUEUE
208 help
209 This is a generic software asynchronous crypto daemon that
210 converts an arbitrary synchronous software crypto algorithm
211 into an asynchronous algorithm that executes in a kernel thread.
212
213config CRYPTO_MCRYPTD
214 tristate "Software async multi-buffer crypto daemon"
215 select CRYPTO_BLKCIPHER
216 select CRYPTO_HASH
217 select CRYPTO_MANAGER
218 select CRYPTO_WORKQUEUE
219 help
220 This is a generic software asynchronous crypto daemon that
221 provides the kernel thread to assist multi-buffer crypto
222 algorithms for submitting jobs and flushing jobs in multi-buffer
223 crypto algorithms. Multi-buffer crypto algorithms are executed
224 in the context of this kernel thread and drivers can post
225 their crypto request asynchronously to be processed by this daemon.
226
227config CRYPTO_AUTHENC
228 tristate "Authenc support"
229 select CRYPTO_AEAD
230 select CRYPTO_BLKCIPHER
231 select CRYPTO_MANAGER
232 select CRYPTO_HASH
233 select CRYPTO_NULL
234 help
235 Authenc: Combined mode wrapper for IPsec.
236 This is required for IPSec.
237
238config CRYPTO_TEST
239 tristate "Testing module"
240 depends on m
241 select CRYPTO_MANAGER
242 help
243 Quick & dirty crypto test module.
244
245config CRYPTO_ABLK_HELPER
246 tristate
247 select CRYPTO_CRYPTD
248
249config CRYPTO_SIMD
250 tristate
251 select CRYPTO_CRYPTD
252
253config CRYPTO_GLUE_HELPER_X86
254 tristate
255 depends on X86
256 select CRYPTO_BLKCIPHER
257
258config CRYPTO_ENGINE
259 tristate
260
261comment "Authenticated Encryption with Associated Data"
262
263config CRYPTO_CCM
264 tristate "CCM support"
265 select CRYPTO_CTR
266 select CRYPTO_AEAD
267 help
268 Support for Counter with CBC MAC. Required for IPsec.
269
270config CRYPTO_GCM
271 tristate "GCM/GMAC support"
272 select CRYPTO_CTR
273 select CRYPTO_AEAD
274 select CRYPTO_GHASH
275 select CRYPTO_NULL
276 help
277 Support for Galois/Counter Mode (GCM) and Galois Message
278 Authentication Code (GMAC). Required for IPSec.
279
280config CRYPTO_CHACHA20POLY1305
281 tristate "ChaCha20-Poly1305 AEAD support"
282 select CRYPTO_CHACHA20
283 select CRYPTO_POLY1305
284 select CRYPTO_AEAD
285 help
286 ChaCha20-Poly1305 AEAD support, RFC7539.
287
288 Support for the AEAD wrapper using the ChaCha20 stream cipher combined
289 with the Poly1305 authenticator. It is defined in RFC7539 for use in
290 IETF protocols.
291
292config CRYPTO_SEQIV
293 tristate "Sequence Number IV Generator"
294 select CRYPTO_AEAD
295 select CRYPTO_BLKCIPHER
296 select CRYPTO_NULL
297 select CRYPTO_RNG_DEFAULT
298 help
299 This IV generator generates an IV based on a sequence number by
300 xoring it with a salt. This algorithm is mainly useful for CTR
301
302config CRYPTO_ECHAINIV
303 tristate "Encrypted Chain IV Generator"
304 select CRYPTO_AEAD
305 select CRYPTO_NULL
306 select CRYPTO_RNG_DEFAULT
307 default m
308 help
309 This IV generator generates an IV based on the encryption of
310 a sequence number xored with a salt. This is the default
311 algorithm for CBC.
312
313comment "Block modes"
314
315config CRYPTO_CBC
316 tristate "CBC support"
317 select CRYPTO_BLKCIPHER
318 select CRYPTO_MANAGER
319 help
320 CBC: Cipher Block Chaining mode
321 This block cipher algorithm is required for IPSec.
322
323config CRYPTO_CTR
324 tristate "CTR support"
325 select CRYPTO_BLKCIPHER
326 select CRYPTO_SEQIV
327 select CRYPTO_MANAGER
328 help
329 CTR: Counter mode
330 This block cipher algorithm is required for IPSec.
331
332config CRYPTO_CTS
333 tristate "CTS support"
334 select CRYPTO_BLKCIPHER
335 help
336 CTS: Cipher Text Stealing
337 This is the Cipher Text Stealing mode as described by
338 Section 8 of rfc2040 and referenced by rfc3962.
339 (rfc3962 includes errata information in its Appendix A)
340 This mode is required for Kerberos gss mechanism support
341 for AES encryption.
342
343config CRYPTO_ECB
344 tristate "ECB support"
345 select CRYPTO_BLKCIPHER
346 select CRYPTO_MANAGER
347 help
348 ECB: Electronic CodeBook mode
349 This is the simplest block cipher algorithm. It simply encrypts
350 the input block by block.
351
352config CRYPTO_LRW
353 tristate "LRW support"
354 select CRYPTO_BLKCIPHER
355 select CRYPTO_MANAGER
356 select CRYPTO_GF128MUL
357 help
358 LRW: Liskov Rivest Wagner, a tweakable, non malleable, non movable
359 narrow block cipher mode for dm-crypt. Use it with cipher
360 specification string aes-lrw-benbi, the key must be 256, 320 or 384.
361 The first 128, 192 or 256 bits in the key are used for AES and the
362 rest is used to tie each cipher block to its logical position.
363
364config CRYPTO_PCBC
365 tristate "PCBC support"
366 select CRYPTO_BLKCIPHER
367 select CRYPTO_MANAGER
368 help
369 PCBC: Propagating Cipher Block Chaining mode
370 This block cipher algorithm is required for RxRPC.
371
372config CRYPTO_XTS
373 tristate "XTS support"
374 select CRYPTO_BLKCIPHER
375 select CRYPTO_MANAGER
376 select CRYPTO_GF128MUL
377 select CRYPTO_ECB
378 help
379 XTS: IEEE1619/D16 narrow block cipher use with aes-xts-plain,
380 key size 256, 384 or 512 bits. This implementation currently
381 can't handle a sectorsize which is not a multiple of 16 bytes.
382
383config CRYPTO_KEYWRAP
384 tristate "Key wrapping support"
385 select CRYPTO_BLKCIPHER
386 help
387 Support for key wrapping (NIST SP800-38F / RFC3394) without
388 padding.
389
390comment "Hash modes"
391
392config CRYPTO_CMAC
393 tristate "CMAC support"
394 select CRYPTO_HASH
395 select CRYPTO_MANAGER
396 help
397 Cipher-based Message Authentication Code (CMAC) specified by
398 The National Institute of Standards and Technology (NIST).
399
400 https://tools.ietf.org/html/rfc4493
401 http://csrc.nist.gov/publications/nistpubs/800-38B/SP_800-38B.pdf
402
403config CRYPTO_HMAC
404 tristate "HMAC support"
405 select CRYPTO_HASH
406 select CRYPTO_MANAGER
407 help
408 HMAC: Keyed-Hashing for Message Authentication (RFC2104).
409 This is required for IPSec.
410
411config CRYPTO_XCBC
412 tristate "XCBC support"
413 select CRYPTO_HASH
414 select CRYPTO_MANAGER
415 help
416 XCBC: Keyed-Hashing with encryption algorithm
417 http://www.ietf.org/rfc/rfc3566.txt
418 http://csrc.nist.gov/encryption/modes/proposedmodes/
419 xcbc-mac/xcbc-mac-spec.pdf
420
421config CRYPTO_VMAC
422 tristate "VMAC support"
423 select CRYPTO_HASH
424 select CRYPTO_MANAGER
425 help
426 VMAC is a message authentication algorithm designed for
427 very high speed on 64-bit architectures.
428
429 See also:
430 <http://fastcrypto.org/vmac>
431
432comment "Digest"
433
434config CRYPTO_CRC32C
435 tristate "CRC32c CRC algorithm"
436 select CRYPTO_HASH
437 select CRC32
438 help
439 Castagnoli, et al Cyclic Redundancy-Check Algorithm. Used
440 by iSCSI for header and data digests and by others.
441 See Castagnoli93. Module will be crc32c.
442
443config CRYPTO_CRC32C_INTEL
444 tristate "CRC32c INTEL hardware acceleration"
445 depends on X86
446 select CRYPTO_HASH
447 help
448 In Intel processor with SSE4.2 supported, the processor will
449 support CRC32C implementation using hardware accelerated CRC32
450 instruction. This option will create 'crc32c-intel' module,
451 which will enable any routine to use the CRC32 instruction to
452 gain performance compared with software implementation.
453 Module will be crc32c-intel.
454
455config CRYPTO_CRC32C_VPMSUM
456 tristate "CRC32c CRC algorithm (powerpc64)"
457 depends on PPC64 && ALTIVEC
458 select CRYPTO_HASH
459 select CRC32
460 help
461 CRC32c algorithm implemented using vector polynomial multiply-sum
462 (vpmsum) instructions, introduced in POWER8. Enable on POWER8
463 and newer processors for improved performance.
464
465
466config CRYPTO_CRC32C_SPARC64
467 tristate "CRC32c CRC algorithm (SPARC64)"
468 depends on SPARC64
469 select CRYPTO_HASH
470 select CRC32
471 help
472 CRC32c CRC algorithm implemented using sparc64 crypto instructions,
473 when available.
474
475config CRYPTO_CRC32
476 tristate "CRC32 CRC algorithm"
477 select CRYPTO_HASH
478 select CRC32
479 help
480 CRC-32-IEEE 802.3 cyclic redundancy-check algorithm.
481 Shash crypto api wrappers to crc32_le function.
482
483config CRYPTO_CRC32_PCLMUL
484 tristate "CRC32 PCLMULQDQ hardware acceleration"
485 depends on X86
486 select CRYPTO_HASH
487 select CRC32
488 help
489 From Intel Westmere and AMD Bulldozer processor with SSE4.2
490 and PCLMULQDQ supported, the processor will support
491 CRC32 PCLMULQDQ implementation using hardware accelerated PCLMULQDQ
492 instruction. This option will create 'crc32-plcmul' module,
493 which will enable any routine to use the CRC-32-IEEE 802.3 checksum
494 and gain better performance as compared with the table implementation.
495
496config CRYPTO_CRCT10DIF
497 tristate "CRCT10DIF algorithm"
498 select CRYPTO_HASH
499 help
500 CRC T10 Data Integrity Field computation is being cast as
501 a crypto transform. This allows for faster crc t10 diff
502 transforms to be used if they are available.
503
504config CRYPTO_CRCT10DIF_PCLMUL
505 tristate "CRCT10DIF PCLMULQDQ hardware acceleration"
506 depends on X86 && 64BIT && CRC_T10DIF
507 select CRYPTO_HASH
508 help
509 For x86_64 processors with SSE4.2 and PCLMULQDQ supported,
510 CRC T10 DIF PCLMULQDQ computation can be hardware
511 accelerated PCLMULQDQ instruction. This option will create
512 'crct10dif-plcmul' module, which is faster when computing the
513 crct10dif checksum as compared with the generic table implementation.
514
515config CRYPTO_GHASH
516 tristate "GHASH digest algorithm"
517 select CRYPTO_GF128MUL
518 select CRYPTO_HASH
519 help
520 GHASH is message digest algorithm for GCM (Galois/Counter Mode).
521
522config CRYPTO_POLY1305
523 tristate "Poly1305 authenticator algorithm"
524 select CRYPTO_HASH
525 help
526 Poly1305 authenticator algorithm, RFC7539.
527
528 Poly1305 is an authenticator algorithm designed by Daniel J. Bernstein.
529 It is used for the ChaCha20-Poly1305 AEAD, specified in RFC7539 for use
530 in IETF protocols. This is the portable C implementation of Poly1305.
531
532config CRYPTO_POLY1305_X86_64
533 tristate "Poly1305 authenticator algorithm (x86_64/SSE2/AVX2)"
534 depends on X86 && 64BIT
535 select CRYPTO_POLY1305
536 help
537 Poly1305 authenticator algorithm, RFC7539.
538
539 Poly1305 is an authenticator algorithm designed by Daniel J. Bernstein.
540 It is used for the ChaCha20-Poly1305 AEAD, specified in RFC7539 for use
541 in IETF protocols. This is the x86_64 assembler implementation using SIMD
542 instructions.
543
544config CRYPTO_MD4
545 tristate "MD4 digest algorithm"
546 select CRYPTO_HASH
547 help
548 MD4 message digest algorithm (RFC1320).
549
550config CRYPTO_MD5
551 tristate "MD5 digest algorithm"
552 select CRYPTO_HASH
553 help
554 MD5 message digest algorithm (RFC1321).
555
556config CRYPTO_MD5_OCTEON
557 tristate "MD5 digest algorithm (OCTEON)"
558 depends on CPU_CAVIUM_OCTEON
559 select CRYPTO_MD5
560 select CRYPTO_HASH
561 help
562 MD5 message digest algorithm (RFC1321) implemented
563 using OCTEON crypto instructions, when available.
564
565config CRYPTO_MD5_PPC
566 tristate "MD5 digest algorithm (PPC)"
567 depends on PPC
568 select CRYPTO_HASH
569 help
570 MD5 message digest algorithm (RFC1321) implemented
571 in PPC assembler.
572
573config CRYPTO_MD5_SPARC64
574 tristate "MD5 digest algorithm (SPARC64)"
575 depends on SPARC64
576 select CRYPTO_MD5
577 select CRYPTO_HASH
578 help
579 MD5 message digest algorithm (RFC1321) implemented
580 using sparc64 crypto instructions, when available.
581
582config CRYPTO_MICHAEL_MIC
583 tristate "Michael MIC keyed digest algorithm"
584 select CRYPTO_HASH
585 help
586 Michael MIC is used for message integrity protection in TKIP
587 (IEEE 802.11i). This algorithm is required for TKIP, but it
588 should not be used for other purposes because of the weakness
589 of the algorithm.
590
591config CRYPTO_RMD128
592 tristate "RIPEMD-128 digest algorithm"
593 select CRYPTO_HASH
594 help
595 RIPEMD-128 (ISO/IEC 10118-3:2004).
596
597 RIPEMD-128 is a 128-bit cryptographic hash function. It should only
598 be used as a secure replacement for RIPEMD. For other use cases,
599 RIPEMD-160 should be used.
600
601 Developed by Hans Dobbertin, Antoon Bosselaers and Bart Preneel.
602 See <http://homes.esat.kuleuven.be/~bosselae/ripemd160.html>
603
604config CRYPTO_RMD160
605 tristate "RIPEMD-160 digest algorithm"
606 select CRYPTO_HASH
607 help
608 RIPEMD-160 (ISO/IEC 10118-3:2004).
609
610 RIPEMD-160 is a 160-bit cryptographic hash function. It is intended
611 to be used as a secure replacement for the 128-bit hash functions
612 MD4, MD5 and it's predecessor RIPEMD
613 (not to be confused with RIPEMD-128).
614
615 It's speed is comparable to SHA1 and there are no known attacks
616 against RIPEMD-160.
617
618 Developed by Hans Dobbertin, Antoon Bosselaers and Bart Preneel.
619 See <http://homes.esat.kuleuven.be/~bosselae/ripemd160.html>
620
621config CRYPTO_RMD256
622 tristate "RIPEMD-256 digest algorithm"
623 select CRYPTO_HASH
624 help
625 RIPEMD-256 is an optional extension of RIPEMD-128 with a
626 256 bit hash. It is intended for applications that require
627 longer hash-results, without needing a larger security level
628 (than RIPEMD-128).
629
630 Developed by Hans Dobbertin, Antoon Bosselaers and Bart Preneel.
631 See <http://homes.esat.kuleuven.be/~bosselae/ripemd160.html>
632
633config CRYPTO_RMD320
634 tristate "RIPEMD-320 digest algorithm"
635 select CRYPTO_HASH
636 help
637 RIPEMD-320 is an optional extension of RIPEMD-160 with a
638 320 bit hash. It is intended for applications that require
639 longer hash-results, without needing a larger security level
640 (than RIPEMD-160).
641
642 Developed by Hans Dobbertin, Antoon Bosselaers and Bart Preneel.
643 See <http://homes.esat.kuleuven.be/~bosselae/ripemd160.html>
644
645config CRYPTO_SHA1
646 tristate "SHA1 digest algorithm"
647 select CRYPTO_HASH
648 help
649 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2).
650
651config CRYPTO_SHA1_SSSE3
652 tristate "SHA1 digest algorithm (SSSE3/AVX/AVX2/SHA-NI)"
653 depends on X86 && 64BIT
654 select CRYPTO_SHA1
655 select CRYPTO_HASH
656 help
657 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2) implemented
658 using Supplemental SSE3 (SSSE3) instructions or Advanced Vector
659 Extensions (AVX/AVX2) or SHA-NI(SHA Extensions New Instructions),
660 when available.
661
662config CRYPTO_SHA256_SSSE3
663 tristate "SHA256 digest algorithm (SSSE3/AVX/AVX2/SHA-NI)"
664 depends on X86 && 64BIT
665 select CRYPTO_SHA256
666 select CRYPTO_HASH
667 help
668 SHA-256 secure hash standard (DFIPS 180-2) implemented
669 using Supplemental SSE3 (SSSE3) instructions, or Advanced Vector
670 Extensions version 1 (AVX1), or Advanced Vector Extensions
671 version 2 (AVX2) instructions, or SHA-NI (SHA Extensions New
672 Instructions) when available.
673
674config CRYPTO_SHA512_SSSE3
675 tristate "SHA512 digest algorithm (SSSE3/AVX/AVX2)"
676 depends on X86 && 64BIT
677 select CRYPTO_SHA512
678 select CRYPTO_HASH
679 help
680 SHA-512 secure hash standard (DFIPS 180-2) implemented
681 using Supplemental SSE3 (SSSE3) instructions, or Advanced Vector
682 Extensions version 1 (AVX1), or Advanced Vector Extensions
683 version 2 (AVX2) instructions, when available.
684
685config CRYPTO_SHA1_OCTEON
686 tristate "SHA1 digest algorithm (OCTEON)"
687 depends on CPU_CAVIUM_OCTEON
688 select CRYPTO_SHA1
689 select CRYPTO_HASH
690 help
691 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2) implemented
692 using OCTEON crypto instructions, when available.
693
694config CRYPTO_SHA1_SPARC64
695 tristate "SHA1 digest algorithm (SPARC64)"
696 depends on SPARC64
697 select CRYPTO_SHA1
698 select CRYPTO_HASH
699 help
700 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2) implemented
701 using sparc64 crypto instructions, when available.
702
703config CRYPTO_SHA1_PPC
704 tristate "SHA1 digest algorithm (powerpc)"
705 depends on PPC
706 help
707 This is the powerpc hardware accelerated implementation of the
708 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2).
709
710config CRYPTO_SHA1_PPC_SPE
711 tristate "SHA1 digest algorithm (PPC SPE)"
712 depends on PPC && SPE
713 help
714 SHA-1 secure hash standard (DFIPS 180-4) implemented
715 using powerpc SPE SIMD instruction set.
716
717config CRYPTO_SHA1_MB
718 tristate "SHA1 digest algorithm (x86_64 Multi-Buffer, Experimental)"
719 depends on X86 && 64BIT
720 select CRYPTO_SHA1
721 select CRYPTO_HASH
722 select CRYPTO_MCRYPTD
723 help
724 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2) implemented
725 using multi-buffer technique. This algorithm computes on
726 multiple data lanes concurrently with SIMD instructions for
727 better throughput. It should not be enabled by default but
728 used when there is significant amount of work to keep the keep
729 the data lanes filled to get performance benefit. If the data
730 lanes remain unfilled, a flush operation will be initiated to
731 process the crypto jobs, adding a slight latency.
732
733config CRYPTO_SHA256_MB
734 tristate "SHA256 digest algorithm (x86_64 Multi-Buffer, Experimental)"
735 depends on X86 && 64BIT
736 select CRYPTO_SHA256
737 select CRYPTO_HASH
738 select CRYPTO_MCRYPTD
739 help
740 SHA-256 secure hash standard (FIPS 180-1/DFIPS 180-2) implemented
741 using multi-buffer technique. This algorithm computes on
742 multiple data lanes concurrently with SIMD instructions for
743 better throughput. It should not be enabled by default but
744 used when there is significant amount of work to keep the keep
745 the data lanes filled to get performance benefit. If the data
746 lanes remain unfilled, a flush operation will be initiated to
747 process the crypto jobs, adding a slight latency.
748
749config CRYPTO_SHA512_MB
750 tristate "SHA512 digest algorithm (x86_64 Multi-Buffer, Experimental)"
751 depends on X86 && 64BIT
752 select CRYPTO_SHA512
753 select CRYPTO_HASH
754 select CRYPTO_MCRYPTD
755 help
756 SHA-512 secure hash standard (FIPS 180-1/DFIPS 180-2) implemented
757 using multi-buffer technique. This algorithm computes on
758 multiple data lanes concurrently with SIMD instructions for
759 better throughput. It should not be enabled by default but
760 used when there is significant amount of work to keep the keep
761 the data lanes filled to get performance benefit. If the data
762 lanes remain unfilled, a flush operation will be initiated to
763 process the crypto jobs, adding a slight latency.
764
765config CRYPTO_SHA256
766 tristate "SHA224 and SHA256 digest algorithm"
767 select CRYPTO_HASH
768 help
769 SHA256 secure hash standard (DFIPS 180-2).
770
771 This version of SHA implements a 256 bit hash with 128 bits of
772 security against collision attacks.
773
774 This code also includes SHA-224, a 224 bit hash with 112 bits
775 of security against collision attacks.
776
777config CRYPTO_SHA256_PPC_SPE
778 tristate "SHA224 and SHA256 digest algorithm (PPC SPE)"
779 depends on PPC && SPE
780 select CRYPTO_SHA256
781 select CRYPTO_HASH
782 help
783 SHA224 and SHA256 secure hash standard (DFIPS 180-2)
784 implemented using powerpc SPE SIMD instruction set.
785
786config CRYPTO_SHA256_OCTEON
787 tristate "SHA224 and SHA256 digest algorithm (OCTEON)"
788 depends on CPU_CAVIUM_OCTEON
789 select CRYPTO_SHA256
790 select CRYPTO_HASH
791 help
792 SHA-256 secure hash standard (DFIPS 180-2) implemented
793 using OCTEON crypto instructions, when available.
794
795config CRYPTO_SHA256_SPARC64
796 tristate "SHA224 and SHA256 digest algorithm (SPARC64)"
797 depends on SPARC64
798 select CRYPTO_SHA256
799 select CRYPTO_HASH
800 help
801 SHA-256 secure hash standard (DFIPS 180-2) implemented
802 using sparc64 crypto instructions, when available.
803
804config CRYPTO_SHA512
805 tristate "SHA384 and SHA512 digest algorithms"
806 select CRYPTO_HASH
807 help
808 SHA512 secure hash standard (DFIPS 180-2).
809
810 This version of SHA implements a 512 bit hash with 256 bits of
811 security against collision attacks.
812
813 This code also includes SHA-384, a 384 bit hash with 192 bits
814 of security against collision attacks.
815
816config CRYPTO_SHA512_OCTEON
817 tristate "SHA384 and SHA512 digest algorithms (OCTEON)"
818 depends on CPU_CAVIUM_OCTEON
819 select CRYPTO_SHA512
820 select CRYPTO_HASH
821 help
822 SHA-512 secure hash standard (DFIPS 180-2) implemented
823 using OCTEON crypto instructions, when available.
824
825config CRYPTO_SHA512_SPARC64
826 tristate "SHA384 and SHA512 digest algorithm (SPARC64)"
827 depends on SPARC64
828 select CRYPTO_SHA512
829 select CRYPTO_HASH
830 help
831 SHA-512 secure hash standard (DFIPS 180-2) implemented
832 using sparc64 crypto instructions, when available.
833
834config CRYPTO_SHA3
835 tristate "SHA3 digest algorithm"
836 select CRYPTO_HASH
837 help
838 SHA-3 secure hash standard (DFIPS 202). It's based on
839 cryptographic sponge function family called Keccak.
840
841 References:
842 http://keccak.noekeon.org/
843
844config CRYPTO_TGR192
845 tristate "Tiger digest algorithms"
846 select CRYPTO_HASH
847 help
848 Tiger hash algorithm 192, 160 and 128-bit hashes
849
850 Tiger is a hash function optimized for 64-bit processors while
851 still having decent performance on 32-bit processors.
852 Tiger was developed by Ross Anderson and Eli Biham.
853
854 See also:
855 <http://www.cs.technion.ac.il/~biham/Reports/Tiger/>.
856
857config CRYPTO_WP512
858 tristate "Whirlpool digest algorithms"
859 select CRYPTO_HASH
860 help
861 Whirlpool hash algorithm 512, 384 and 256-bit hashes
862
863 Whirlpool-512 is part of the NESSIE cryptographic primitives.
864 Whirlpool will be part of the ISO/IEC 10118-3:2003(E) standard
865
866 See also:
867 <http://www.larc.usp.br/~pbarreto/WhirlpoolPage.html>
868
869config CRYPTO_GHASH_CLMUL_NI_INTEL
870 tristate "GHASH digest algorithm (CLMUL-NI accelerated)"
871 depends on X86 && 64BIT
872 select CRYPTO_CRYPTD
873 help
874 GHASH is message digest algorithm for GCM (Galois/Counter Mode).
875 The implementation is accelerated by CLMUL-NI of Intel.
876
877comment "Ciphers"
878
879config CRYPTO_AES
880 tristate "AES cipher algorithms"
881 select CRYPTO_ALGAPI
882 help
883 AES cipher algorithms (FIPS-197). AES uses the Rijndael
884 algorithm.
885
886 Rijndael appears to be consistently a very good performer in
887 both hardware and software across a wide range of computing
888 environments regardless of its use in feedback or non-feedback
889 modes. Its key setup time is excellent, and its key agility is
890 good. Rijndael's very low memory requirements make it very well
891 suited for restricted-space environments, in which it also
892 demonstrates excellent performance. Rijndael's operations are
893 among the easiest to defend against power and timing attacks.
894
895 The AES specifies three key sizes: 128, 192 and 256 bits
896
897 See <http://csrc.nist.gov/CryptoToolkit/aes/> for more information.
898
899config CRYPTO_AES_586
900 tristate "AES cipher algorithms (i586)"
901 depends on (X86 || UML_X86) && !64BIT
902 select CRYPTO_ALGAPI
903 select CRYPTO_AES
904 help
905 AES cipher algorithms (FIPS-197). AES uses the Rijndael
906 algorithm.
907
908 Rijndael appears to be consistently a very good performer in
909 both hardware and software across a wide range of computing
910 environments regardless of its use in feedback or non-feedback
911 modes. Its key setup time is excellent, and its key agility is
912 good. Rijndael's very low memory requirements make it very well
913 suited for restricted-space environments, in which it also
914 demonstrates excellent performance. Rijndael's operations are
915 among the easiest to defend against power and timing attacks.
916
917 The AES specifies three key sizes: 128, 192 and 256 bits
918
919 See <http://csrc.nist.gov/encryption/aes/> for more information.
920
921config CRYPTO_AES_X86_64
922 tristate "AES cipher algorithms (x86_64)"
923 depends on (X86 || UML_X86) && 64BIT
924 select CRYPTO_ALGAPI
925 select CRYPTO_AES
926 help
927 AES cipher algorithms (FIPS-197). AES uses the Rijndael
928 algorithm.
929
930 Rijndael appears to be consistently a very good performer in
931 both hardware and software across a wide range of computing
932 environments regardless of its use in feedback or non-feedback
933 modes. Its key setup time is excellent, and its key agility is
934 good. Rijndael's very low memory requirements make it very well
935 suited for restricted-space environments, in which it also
936 demonstrates excellent performance. Rijndael's operations are
937 among the easiest to defend against power and timing attacks.
938
939 The AES specifies three key sizes: 128, 192 and 256 bits
940
941 See <http://csrc.nist.gov/encryption/aes/> for more information.
942
943config CRYPTO_AES_NI_INTEL
944 tristate "AES cipher algorithms (AES-NI)"
945 depends on X86
946 select CRYPTO_AEAD
947 select CRYPTO_AES_X86_64 if 64BIT
948 select CRYPTO_AES_586 if !64BIT
949 select CRYPTO_ALGAPI
950 select CRYPTO_BLKCIPHER
951 select CRYPTO_GLUE_HELPER_X86 if 64BIT
952 select CRYPTO_SIMD
953 help
954 Use Intel AES-NI instructions for AES algorithm.
955
956 AES cipher algorithms (FIPS-197). AES uses the Rijndael
957 algorithm.
958
959 Rijndael appears to be consistently a very good performer in
960 both hardware and software across a wide range of computing
961 environments regardless of its use in feedback or non-feedback
962 modes. Its key setup time is excellent, and its key agility is
963 good. Rijndael's very low memory requirements make it very well
964 suited for restricted-space environments, in which it also
965 demonstrates excellent performance. Rijndael's operations are
966 among the easiest to defend against power and timing attacks.
967
968 The AES specifies three key sizes: 128, 192 and 256 bits
969
970 See <http://csrc.nist.gov/encryption/aes/> for more information.
971
972 In addition to AES cipher algorithm support, the acceleration
973 for some popular block cipher mode is supported too, including
974 ECB, CBC, LRW, PCBC, XTS. The 64 bit version has additional
975 acceleration for CTR.
976
977config CRYPTO_AES_SPARC64
978 tristate "AES cipher algorithms (SPARC64)"
979 depends on SPARC64
980 select CRYPTO_CRYPTD
981 select CRYPTO_ALGAPI
982 help
983 Use SPARC64 crypto opcodes for AES algorithm.
984
985 AES cipher algorithms (FIPS-197). AES uses the Rijndael
986 algorithm.
987
988 Rijndael appears to be consistently a very good performer in
989 both hardware and software across a wide range of computing
990 environments regardless of its use in feedback or non-feedback
991 modes. Its key setup time is excellent, and its key agility is
992 good. Rijndael's very low memory requirements make it very well
993 suited for restricted-space environments, in which it also
994 demonstrates excellent performance. Rijndael's operations are
995 among the easiest to defend against power and timing attacks.
996
997 The AES specifies three key sizes: 128, 192 and 256 bits
998
999 See <http://csrc.nist.gov/encryption/aes/> for more information.
1000
1001 In addition to AES cipher algorithm support, the acceleration
1002 for some popular block cipher mode is supported too, including
1003 ECB and CBC.
1004
1005config CRYPTO_AES_PPC_SPE
1006 tristate "AES cipher algorithms (PPC SPE)"
1007 depends on PPC && SPE
1008 help
1009 AES cipher algorithms (FIPS-197). Additionally the acceleration
1010 for popular block cipher modes ECB, CBC, CTR and XTS is supported.
1011 This module should only be used for low power (router) devices
1012 without hardware AES acceleration (e.g. caam crypto). It reduces the
1013 size of the AES tables from 16KB to 8KB + 256 bytes and mitigates
1014 timining attacks. Nevertheless it might be not as secure as other
1015 architecture specific assembler implementations that work on 1KB
1016 tables or 256 bytes S-boxes.
1017
1018config CRYPTO_ANUBIS
1019 tristate "Anubis cipher algorithm"
1020 select CRYPTO_ALGAPI
1021 help
1022 Anubis cipher algorithm.
1023
1024 Anubis is a variable key length cipher which can use keys from
1025 128 bits to 320 bits in length. It was evaluated as a entrant
1026 in the NESSIE competition.
1027
1028 See also:
1029 <https://www.cosic.esat.kuleuven.be/nessie/reports/>
1030 <http://www.larc.usp.br/~pbarreto/AnubisPage.html>
1031
1032config CRYPTO_ARC4
1033 tristate "ARC4 cipher algorithm"
1034 select CRYPTO_BLKCIPHER
1035 help
1036 ARC4 cipher algorithm.
1037
1038 ARC4 is a stream cipher using keys ranging from 8 bits to 2048
1039 bits in length. This algorithm is required for driver-based
1040 WEP, but it should not be for other purposes because of the
1041 weakness of the algorithm.
1042
1043config CRYPTO_BLOWFISH
1044 tristate "Blowfish cipher algorithm"
1045 select CRYPTO_ALGAPI
1046 select CRYPTO_BLOWFISH_COMMON
1047 help
1048 Blowfish cipher algorithm, by Bruce Schneier.
1049
1050 This is a variable key length cipher which can use keys from 32
1051 bits to 448 bits in length. It's fast, simple and specifically
1052 designed for use on "large microprocessors".
1053
1054 See also:
1055 <http://www.schneier.com/blowfish.html>
1056
1057config CRYPTO_BLOWFISH_COMMON
1058 tristate
1059 help
1060 Common parts of the Blowfish cipher algorithm shared by the
1061 generic c and the assembler implementations.
1062
1063 See also:
1064 <http://www.schneier.com/blowfish.html>
1065
1066config CRYPTO_BLOWFISH_X86_64
1067 tristate "Blowfish cipher algorithm (x86_64)"
1068 depends on X86 && 64BIT
1069 select CRYPTO_ALGAPI
1070 select CRYPTO_BLOWFISH_COMMON
1071 help
1072 Blowfish cipher algorithm (x86_64), by Bruce Schneier.
1073
1074 This is a variable key length cipher which can use keys from 32
1075 bits to 448 bits in length. It's fast, simple and specifically
1076 designed for use on "large microprocessors".
1077
1078 See also:
1079 <http://www.schneier.com/blowfish.html>
1080
1081config CRYPTO_CAMELLIA
1082 tristate "Camellia cipher algorithms"
1083 depends on CRYPTO
1084 select CRYPTO_ALGAPI
1085 help
1086 Camellia cipher algorithms module.
1087
1088 Camellia is a symmetric key block cipher developed jointly
1089 at NTT and Mitsubishi Electric Corporation.
1090
1091 The Camellia specifies three key sizes: 128, 192 and 256 bits.
1092
1093 See also:
1094 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
1095
1096config CRYPTO_CAMELLIA_X86_64
1097 tristate "Camellia cipher algorithm (x86_64)"
1098 depends on X86 && 64BIT
1099 depends on CRYPTO
1100 select CRYPTO_ALGAPI
1101 select CRYPTO_GLUE_HELPER_X86
1102 select CRYPTO_LRW
1103 select CRYPTO_XTS
1104 help
1105 Camellia cipher algorithm module (x86_64).
1106
1107 Camellia is a symmetric key block cipher developed jointly
1108 at NTT and Mitsubishi Electric Corporation.
1109
1110 The Camellia specifies three key sizes: 128, 192 and 256 bits.
1111
1112 See also:
1113 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
1114
1115config CRYPTO_CAMELLIA_AESNI_AVX_X86_64
1116 tristate "Camellia cipher algorithm (x86_64/AES-NI/AVX)"
1117 depends on X86 && 64BIT
1118 depends on CRYPTO
1119 select CRYPTO_ALGAPI
1120 select CRYPTO_CRYPTD
1121 select CRYPTO_ABLK_HELPER
1122 select CRYPTO_GLUE_HELPER_X86
1123 select CRYPTO_CAMELLIA_X86_64
1124 select CRYPTO_LRW
1125 select CRYPTO_XTS
1126 help
1127 Camellia cipher algorithm module (x86_64/AES-NI/AVX).
1128
1129 Camellia is a symmetric key block cipher developed jointly
1130 at NTT and Mitsubishi Electric Corporation.
1131
1132 The Camellia specifies three key sizes: 128, 192 and 256 bits.
1133
1134 See also:
1135 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
1136
1137config CRYPTO_CAMELLIA_AESNI_AVX2_X86_64
1138 tristate "Camellia cipher algorithm (x86_64/AES-NI/AVX2)"
1139 depends on X86 && 64BIT
1140 depends on CRYPTO
1141 select CRYPTO_ALGAPI
1142 select CRYPTO_CRYPTD
1143 select CRYPTO_ABLK_HELPER
1144 select CRYPTO_GLUE_HELPER_X86
1145 select CRYPTO_CAMELLIA_X86_64
1146 select CRYPTO_CAMELLIA_AESNI_AVX_X86_64
1147 select CRYPTO_LRW
1148 select CRYPTO_XTS
1149 help
1150 Camellia cipher algorithm module (x86_64/AES-NI/AVX2).
1151
1152 Camellia is a symmetric key block cipher developed jointly
1153 at NTT and Mitsubishi Electric Corporation.
1154
1155 The Camellia specifies three key sizes: 128, 192 and 256 bits.
1156
1157 See also:
1158 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
1159
1160config CRYPTO_CAMELLIA_SPARC64
1161 tristate "Camellia cipher algorithm (SPARC64)"
1162 depends on SPARC64
1163 depends on CRYPTO
1164 select CRYPTO_ALGAPI
1165 help
1166 Camellia cipher algorithm module (SPARC64).
1167
1168 Camellia is a symmetric key block cipher developed jointly
1169 at NTT and Mitsubishi Electric Corporation.
1170
1171 The Camellia specifies three key sizes: 128, 192 and 256 bits.
1172
1173 See also:
1174 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
1175
1176config CRYPTO_CAST_COMMON
1177 tristate
1178 help
1179 Common parts of the CAST cipher algorithms shared by the
1180 generic c and the assembler implementations.
1181
1182config CRYPTO_CAST5
1183 tristate "CAST5 (CAST-128) cipher algorithm"
1184 select CRYPTO_ALGAPI
1185 select CRYPTO_CAST_COMMON
1186 help
1187 The CAST5 encryption algorithm (synonymous with CAST-128) is
1188 described in RFC2144.
1189
1190config CRYPTO_CAST5_AVX_X86_64
1191 tristate "CAST5 (CAST-128) cipher algorithm (x86_64/AVX)"
1192 depends on X86 && 64BIT
1193 select CRYPTO_ALGAPI
1194 select CRYPTO_CRYPTD
1195 select CRYPTO_ABLK_HELPER
1196 select CRYPTO_CAST_COMMON
1197 select CRYPTO_CAST5
1198 help
1199 The CAST5 encryption algorithm (synonymous with CAST-128) is
1200 described in RFC2144.
1201
1202 This module provides the Cast5 cipher algorithm that processes
1203 sixteen blocks parallel using the AVX instruction set.
1204
1205config CRYPTO_CAST6
1206 tristate "CAST6 (CAST-256) cipher algorithm"
1207 select CRYPTO_ALGAPI
1208 select CRYPTO_CAST_COMMON
1209 help
1210 The CAST6 encryption algorithm (synonymous with CAST-256) is
1211 described in RFC2612.
1212
1213config CRYPTO_CAST6_AVX_X86_64
1214 tristate "CAST6 (CAST-256) cipher algorithm (x86_64/AVX)"
1215 depends on X86 && 64BIT
1216 select CRYPTO_ALGAPI
1217 select CRYPTO_CRYPTD
1218 select CRYPTO_ABLK_HELPER
1219 select CRYPTO_GLUE_HELPER_X86
1220 select CRYPTO_CAST_COMMON
1221 select CRYPTO_CAST6
1222 select CRYPTO_LRW
1223 select CRYPTO_XTS
1224 help
1225 The CAST6 encryption algorithm (synonymous with CAST-256) is
1226 described in RFC2612.
1227
1228 This module provides the Cast6 cipher algorithm that processes
1229 eight blocks parallel using the AVX instruction set.
1230
1231config CRYPTO_DES
1232 tristate "DES and Triple DES EDE cipher algorithms"
1233 select CRYPTO_ALGAPI
1234 help
1235 DES cipher algorithm (FIPS 46-2), and Triple DES EDE (FIPS 46-3).
1236
1237config CRYPTO_DES_SPARC64
1238 tristate "DES and Triple DES EDE cipher algorithms (SPARC64)"
1239 depends on SPARC64
1240 select CRYPTO_ALGAPI
1241 select CRYPTO_DES
1242 help
1243 DES cipher algorithm (FIPS 46-2), and Triple DES EDE (FIPS 46-3),
1244 optimized using SPARC64 crypto opcodes.
1245
1246config CRYPTO_DES3_EDE_X86_64
1247 tristate "Triple DES EDE cipher algorithm (x86-64)"
1248 depends on X86 && 64BIT
1249 select CRYPTO_ALGAPI
1250 select CRYPTO_DES
1251 help
1252 Triple DES EDE (FIPS 46-3) algorithm.
1253
1254 This module provides implementation of the Triple DES EDE cipher
1255 algorithm that is optimized for x86-64 processors. Two versions of
1256 algorithm are provided; regular processing one input block and
1257 one that processes three blocks parallel.
1258
1259config CRYPTO_FCRYPT
1260 tristate "FCrypt cipher algorithm"
1261 select CRYPTO_ALGAPI
1262 select CRYPTO_BLKCIPHER
1263 help
1264 FCrypt algorithm used by RxRPC.
1265
1266config CRYPTO_KHAZAD
1267 tristate "Khazad cipher algorithm"
1268 select CRYPTO_ALGAPI
1269 help
1270 Khazad cipher algorithm.
1271
1272 Khazad was a finalist in the initial NESSIE competition. It is
1273 an algorithm optimized for 64-bit processors with good performance
1274 on 32-bit processors. Khazad uses an 128 bit key size.
1275
1276 See also:
1277 <http://www.larc.usp.br/~pbarreto/KhazadPage.html>
1278
1279config CRYPTO_SALSA20
1280 tristate "Salsa20 stream cipher algorithm"
1281 select CRYPTO_BLKCIPHER
1282 help
1283 Salsa20 stream cipher algorithm.
1284
1285 Salsa20 is a stream cipher submitted to eSTREAM, the ECRYPT
1286 Stream Cipher Project. See <http://www.ecrypt.eu.org/stream/>
1287
1288 The Salsa20 stream cipher algorithm is designed by Daniel J.
1289 Bernstein <djb@cr.yp.to>. See <http://cr.yp.to/snuffle.html>
1290
1291config CRYPTO_SALSA20_586
1292 tristate "Salsa20 stream cipher algorithm (i586)"
1293 depends on (X86 || UML_X86) && !64BIT
1294 select CRYPTO_BLKCIPHER
1295 help
1296 Salsa20 stream cipher algorithm.
1297
1298 Salsa20 is a stream cipher submitted to eSTREAM, the ECRYPT
1299 Stream Cipher Project. See <http://www.ecrypt.eu.org/stream/>
1300
1301 The Salsa20 stream cipher algorithm is designed by Daniel J.
1302 Bernstein <djb@cr.yp.to>. See <http://cr.yp.to/snuffle.html>
1303
1304config CRYPTO_SALSA20_X86_64
1305 tristate "Salsa20 stream cipher algorithm (x86_64)"
1306 depends on (X86 || UML_X86) && 64BIT
1307 select CRYPTO_BLKCIPHER
1308 help
1309 Salsa20 stream cipher algorithm.
1310
1311 Salsa20 is a stream cipher submitted to eSTREAM, the ECRYPT
1312 Stream Cipher Project. See <http://www.ecrypt.eu.org/stream/>
1313
1314 The Salsa20 stream cipher algorithm is designed by Daniel J.
1315 Bernstein <djb@cr.yp.to>. See <http://cr.yp.to/snuffle.html>
1316
1317config CRYPTO_CHACHA20
1318 tristate "ChaCha20 cipher algorithm"
1319 select CRYPTO_BLKCIPHER
1320 help
1321 ChaCha20 cipher algorithm, RFC7539.
1322
1323 ChaCha20 is a 256-bit high-speed stream cipher designed by Daniel J.
1324 Bernstein and further specified in RFC7539 for use in IETF protocols.
1325 This is the portable C implementation of ChaCha20.
1326
1327 See also:
1328 <http://cr.yp.to/chacha/chacha-20080128.pdf>
1329
1330config CRYPTO_CHACHA20_X86_64
1331 tristate "ChaCha20 cipher algorithm (x86_64/SSSE3/AVX2)"
1332 depends on X86 && 64BIT
1333 select CRYPTO_BLKCIPHER
1334 select CRYPTO_CHACHA20
1335 help
1336 ChaCha20 cipher algorithm, RFC7539.
1337
1338 ChaCha20 is a 256-bit high-speed stream cipher designed by Daniel J.
1339 Bernstein and further specified in RFC7539 for use in IETF protocols.
1340 This is the x86_64 assembler implementation using SIMD instructions.
1341
1342 See also:
1343 <http://cr.yp.to/chacha/chacha-20080128.pdf>
1344
1345config CRYPTO_SEED
1346 tristate "SEED cipher algorithm"
1347 select CRYPTO_ALGAPI
1348 help
1349 SEED cipher algorithm (RFC4269).
1350
1351 SEED is a 128-bit symmetric key block cipher that has been
1352 developed by KISA (Korea Information Security Agency) as a
1353 national standard encryption algorithm of the Republic of Korea.
1354 It is a 16 round block cipher with the key size of 128 bit.
1355
1356 See also:
1357 <http://www.kisa.or.kr/kisa/seed/jsp/seed_eng.jsp>
1358
1359config CRYPTO_SERPENT
1360 tristate "Serpent cipher algorithm"
1361 select CRYPTO_ALGAPI
1362 help
1363 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1364
1365 Keys are allowed to be from 0 to 256 bits in length, in steps
1366 of 8 bits. Also includes the 'Tnepres' algorithm, a reversed
1367 variant of Serpent for compatibility with old kerneli.org code.
1368
1369 See also:
1370 <http://www.cl.cam.ac.uk/~rja14/serpent.html>
1371
1372config CRYPTO_SERPENT_SSE2_X86_64
1373 tristate "Serpent cipher algorithm (x86_64/SSE2)"
1374 depends on X86 && 64BIT
1375 select CRYPTO_ALGAPI
1376 select CRYPTO_CRYPTD
1377 select CRYPTO_ABLK_HELPER
1378 select CRYPTO_GLUE_HELPER_X86
1379 select CRYPTO_SERPENT
1380 select CRYPTO_LRW
1381 select CRYPTO_XTS
1382 help
1383 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1384
1385 Keys are allowed to be from 0 to 256 bits in length, in steps
1386 of 8 bits.
1387
1388 This module provides Serpent cipher algorithm that processes eight
1389 blocks parallel using SSE2 instruction set.
1390
1391 See also:
1392 <http://www.cl.cam.ac.uk/~rja14/serpent.html>
1393
1394config CRYPTO_SERPENT_SSE2_586
1395 tristate "Serpent cipher algorithm (i586/SSE2)"
1396 depends on X86 && !64BIT
1397 select CRYPTO_ALGAPI
1398 select CRYPTO_CRYPTD
1399 select CRYPTO_ABLK_HELPER
1400 select CRYPTO_GLUE_HELPER_X86
1401 select CRYPTO_SERPENT
1402 select CRYPTO_LRW
1403 select CRYPTO_XTS
1404 help
1405 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1406
1407 Keys are allowed to be from 0 to 256 bits in length, in steps
1408 of 8 bits.
1409
1410 This module provides Serpent cipher algorithm that processes four
1411 blocks parallel using SSE2 instruction set.
1412
1413 See also:
1414 <http://www.cl.cam.ac.uk/~rja14/serpent.html>
1415
1416config CRYPTO_SERPENT_AVX_X86_64
1417 tristate "Serpent cipher algorithm (x86_64/AVX)"
1418 depends on X86 && 64BIT
1419 select CRYPTO_ALGAPI
1420 select CRYPTO_CRYPTD
1421 select CRYPTO_ABLK_HELPER
1422 select CRYPTO_GLUE_HELPER_X86
1423 select CRYPTO_SERPENT
1424 select CRYPTO_LRW
1425 select CRYPTO_XTS
1426 help
1427 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1428
1429 Keys are allowed to be from 0 to 256 bits in length, in steps
1430 of 8 bits.
1431
1432 This module provides the Serpent cipher algorithm that processes
1433 eight blocks parallel using the AVX instruction set.
1434
1435 See also:
1436 <http://www.cl.cam.ac.uk/~rja14/serpent.html>
1437
1438config CRYPTO_SERPENT_AVX2_X86_64
1439 tristate "Serpent cipher algorithm (x86_64/AVX2)"
1440 depends on X86 && 64BIT
1441 select CRYPTO_ALGAPI
1442 select CRYPTO_CRYPTD
1443 select CRYPTO_ABLK_HELPER
1444 select CRYPTO_GLUE_HELPER_X86
1445 select CRYPTO_SERPENT
1446 select CRYPTO_SERPENT_AVX_X86_64
1447 select CRYPTO_LRW
1448 select CRYPTO_XTS
1449 help
1450 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1451
1452 Keys are allowed to be from 0 to 256 bits in length, in steps
1453 of 8 bits.
1454
1455 This module provides Serpent cipher algorithm that processes 16
1456 blocks parallel using AVX2 instruction set.
1457
1458 See also:
1459 <http://www.cl.cam.ac.uk/~rja14/serpent.html>
1460
1461config CRYPTO_TEA
1462 tristate "TEA, XTEA and XETA cipher algorithms"
1463 select CRYPTO_ALGAPI
1464 help
1465 TEA cipher algorithm.
1466
1467 Tiny Encryption Algorithm is a simple cipher that uses
1468 many rounds for security. It is very fast and uses
1469 little memory.
1470
1471 Xtendend Tiny Encryption Algorithm is a modification to
1472 the TEA algorithm to address a potential key weakness
1473 in the TEA algorithm.
1474
1475 Xtendend Encryption Tiny Algorithm is a mis-implementation
1476 of the XTEA algorithm for compatibility purposes.
1477
1478config CRYPTO_TWOFISH
1479 tristate "Twofish cipher algorithm"
1480 select CRYPTO_ALGAPI
1481 select CRYPTO_TWOFISH_COMMON
1482 help
1483 Twofish cipher algorithm.
1484
1485 Twofish was submitted as an AES (Advanced Encryption Standard)
1486 candidate cipher by researchers at CounterPane Systems. It is a
1487 16 round block cipher supporting key sizes of 128, 192, and 256
1488 bits.
1489
1490 See also:
1491 <http://www.schneier.com/twofish.html>
1492
1493config CRYPTO_TWOFISH_COMMON
1494 tristate
1495 help
1496 Common parts of the Twofish cipher algorithm shared by the
1497 generic c and the assembler implementations.
1498
1499config CRYPTO_TWOFISH_586
1500 tristate "Twofish cipher algorithms (i586)"
1501 depends on (X86 || UML_X86) && !64BIT
1502 select CRYPTO_ALGAPI
1503 select CRYPTO_TWOFISH_COMMON
1504 help
1505 Twofish cipher algorithm.
1506
1507 Twofish was submitted as an AES (Advanced Encryption Standard)
1508 candidate cipher by researchers at CounterPane Systems. It is a
1509 16 round block cipher supporting key sizes of 128, 192, and 256
1510 bits.
1511
1512 See also:
1513 <http://www.schneier.com/twofish.html>
1514
1515config CRYPTO_TWOFISH_X86_64
1516 tristate "Twofish cipher algorithm (x86_64)"
1517 depends on (X86 || UML_X86) && 64BIT
1518 select CRYPTO_ALGAPI
1519 select CRYPTO_TWOFISH_COMMON
1520 help
1521 Twofish cipher algorithm (x86_64).
1522
1523 Twofish was submitted as an AES (Advanced Encryption Standard)
1524 candidate cipher by researchers at CounterPane Systems. It is a
1525 16 round block cipher supporting key sizes of 128, 192, and 256
1526 bits.
1527
1528 See also:
1529 <http://www.schneier.com/twofish.html>
1530
1531config CRYPTO_TWOFISH_X86_64_3WAY
1532 tristate "Twofish cipher algorithm (x86_64, 3-way parallel)"
1533 depends on X86 && 64BIT
1534 select CRYPTO_ALGAPI
1535 select CRYPTO_TWOFISH_COMMON
1536 select CRYPTO_TWOFISH_X86_64
1537 select CRYPTO_GLUE_HELPER_X86
1538 select CRYPTO_LRW
1539 select CRYPTO_XTS
1540 help
1541 Twofish cipher algorithm (x86_64, 3-way parallel).
1542
1543 Twofish was submitted as an AES (Advanced Encryption Standard)
1544 candidate cipher by researchers at CounterPane Systems. It is a
1545 16 round block cipher supporting key sizes of 128, 192, and 256
1546 bits.
1547
1548 This module provides Twofish cipher algorithm that processes three
1549 blocks parallel, utilizing resources of out-of-order CPUs better.
1550
1551 See also:
1552 <http://www.schneier.com/twofish.html>
1553
1554config CRYPTO_TWOFISH_AVX_X86_64
1555 tristate "Twofish cipher algorithm (x86_64/AVX)"
1556 depends on X86 && 64BIT
1557 select CRYPTO_ALGAPI
1558 select CRYPTO_CRYPTD
1559 select CRYPTO_ABLK_HELPER
1560 select CRYPTO_GLUE_HELPER_X86
1561 select CRYPTO_TWOFISH_COMMON
1562 select CRYPTO_TWOFISH_X86_64
1563 select CRYPTO_TWOFISH_X86_64_3WAY
1564 select CRYPTO_LRW
1565 select CRYPTO_XTS
1566 help
1567 Twofish cipher algorithm (x86_64/AVX).
1568
1569 Twofish was submitted as an AES (Advanced Encryption Standard)
1570 candidate cipher by researchers at CounterPane Systems. It is a
1571 16 round block cipher supporting key sizes of 128, 192, and 256
1572 bits.
1573
1574 This module provides the Twofish cipher algorithm that processes
1575 eight blocks parallel using the AVX Instruction Set.
1576
1577 See also:
1578 <http://www.schneier.com/twofish.html>
1579
1580comment "Compression"
1581
1582config CRYPTO_DEFLATE
1583 tristate "Deflate compression algorithm"
1584 select CRYPTO_ALGAPI
1585 select CRYPTO_ACOMP2
1586 select ZLIB_INFLATE
1587 select ZLIB_DEFLATE
1588 help
1589 This is the Deflate algorithm (RFC1951), specified for use in
1590 IPSec with the IPCOMP protocol (RFC3173, RFC2394).
1591
1592 You will most probably want this if using IPSec.
1593
1594config CRYPTO_LZO
1595 tristate "LZO compression algorithm"
1596 select CRYPTO_ALGAPI
1597 select CRYPTO_ACOMP2
1598 select LZO_COMPRESS
1599 select LZO_DECOMPRESS
1600 help
1601 This is the LZO algorithm.
1602
1603config CRYPTO_842
1604 tristate "842 compression algorithm"
1605 select CRYPTO_ALGAPI
1606 select CRYPTO_ACOMP2
1607 select 842_COMPRESS
1608 select 842_DECOMPRESS
1609 help
1610 This is the 842 algorithm.
1611
1612config CRYPTO_LZ4
1613 tristate "LZ4 compression algorithm"
1614 select CRYPTO_ALGAPI
1615 select CRYPTO_ACOMP2
1616 select LZ4_COMPRESS
1617 select LZ4_DECOMPRESS
1618 help
1619 This is the LZ4 algorithm.
1620
1621config CRYPTO_LZ4HC
1622 tristate "LZ4HC compression algorithm"
1623 select CRYPTO_ALGAPI
1624 select CRYPTO_ACOMP2
1625 select LZ4HC_COMPRESS
1626 select LZ4_DECOMPRESS
1627 help
1628 This is the LZ4 high compression mode algorithm.
1629
1630comment "Random Number Generation"
1631
1632config CRYPTO_ANSI_CPRNG
1633 tristate "Pseudo Random Number Generation for Cryptographic modules"
1634 select CRYPTO_AES
1635 select CRYPTO_RNG
1636 help
1637 This option enables the generic pseudo random number generator
1638 for cryptographic modules. Uses the Algorithm specified in
1639 ANSI X9.31 A.2.4. Note that this option must be enabled if
1640 CRYPTO_FIPS is selected
1641
1642menuconfig CRYPTO_DRBG_MENU
1643 tristate "NIST SP800-90A DRBG"
1644 help
1645 NIST SP800-90A compliant DRBG. In the following submenu, one or
1646 more of the DRBG types must be selected.
1647
1648if CRYPTO_DRBG_MENU
1649
1650config CRYPTO_DRBG_HMAC
1651 bool
1652 default y
1653 select CRYPTO_HMAC
1654 select CRYPTO_SHA256
1655
1656config CRYPTO_DRBG_HASH
1657 bool "Enable Hash DRBG"
1658 select CRYPTO_SHA256
1659 help
1660 Enable the Hash DRBG variant as defined in NIST SP800-90A.
1661
1662config CRYPTO_DRBG_CTR
1663 bool "Enable CTR DRBG"
1664 select CRYPTO_AES
1665 depends on CRYPTO_CTR
1666 help
1667 Enable the CTR DRBG variant as defined in NIST SP800-90A.
1668
1669config CRYPTO_DRBG
1670 tristate
1671 default CRYPTO_DRBG_MENU
1672 select CRYPTO_RNG
1673 select CRYPTO_JITTERENTROPY
1674
1675endif # if CRYPTO_DRBG_MENU
1676
1677config CRYPTO_JITTERENTROPY
1678 tristate "Jitterentropy Non-Deterministic Random Number Generator"
1679 select CRYPTO_RNG
1680 help
1681 The Jitterentropy RNG is a noise that is intended
1682 to provide seed to another RNG. The RNG does not
1683 perform any cryptographic whitening of the generated
1684 random numbers. This Jitterentropy RNG registers with
1685 the kernel crypto API and can be used by any caller.
1686
1687config CRYPTO_USER_API
1688 tristate
1689
1690config CRYPTO_USER_API_HASH
1691 tristate "User-space interface for hash algorithms"
1692 depends on NET
1693 select CRYPTO_HASH
1694 select CRYPTO_USER_API
1695 help
1696 This option enables the user-spaces interface for hash
1697 algorithms.
1698
1699config CRYPTO_USER_API_SKCIPHER
1700 tristate "User-space interface for symmetric key cipher algorithms"
1701 depends on NET
1702 select CRYPTO_BLKCIPHER
1703 select CRYPTO_USER_API
1704 help
1705 This option enables the user-spaces interface for symmetric
1706 key cipher algorithms.
1707
1708config CRYPTO_USER_API_RNG
1709 tristate "User-space interface for random number generator algorithms"
1710 depends on NET
1711 select CRYPTO_RNG
1712 select CRYPTO_USER_API
1713 help
1714 This option enables the user-spaces interface for random
1715 number generator algorithms.
1716
1717config CRYPTO_USER_API_AEAD
1718 tristate "User-space interface for AEAD cipher algorithms"
1719 depends on NET
1720 select CRYPTO_AEAD
1721 select CRYPTO_USER_API
1722 help
1723 This option enables the user-spaces interface for AEAD
1724 cipher algorithms.
1725
1726config CRYPTO_HASH_INFO
1727 bool
1728
1729source "drivers/crypto/Kconfig"
1730source crypto/asymmetric_keys/Kconfig
1731source certs/Kconfig
1732
1733endif # if CRYPTO