1 # SPDX-License-Identifier: GPL-2.0
3 # Generic algorithms support
9 # async_tx api: hardware offloaded memory transfer/transform support
11 source "crypto/async_tx/Kconfig"
14 # Cryptographic API Configuration
17 tristate "Cryptographic API"
19 This option provides the core Cryptographic API.
23 comment "Crypto core or helper"
26 bool "FIPS 200 compliance"
27 depends on (CRYPTO_ANSI_CPRNG || CRYPTO_DRBG) && !CRYPTO_MANAGER_DISABLE_TESTS
28 depends on (MODULE_SIG || !MODULES)
30 This option enables the fips boot option which is
31 required if you want the system to operate in a FIPS 200
32 certification. You should say no unless you know what
39 This option provides the API for cryptographic algorithms.
55 config CRYPTO_SKCIPHER
57 select CRYPTO_SKCIPHER2
60 config CRYPTO_SKCIPHER2
83 config CRYPTO_RNG_DEFAULT
85 select CRYPTO_DRBG_MENU
87 config CRYPTO_AKCIPHER2
91 config CRYPTO_AKCIPHER
93 select CRYPTO_AKCIPHER2
107 select CRYPTO_ALGAPI2
115 config CRYPTO_MANAGER
116 tristate "Cryptographic algorithm manager"
117 select CRYPTO_MANAGER2
119 Create default cryptographic template instantiations such as
122 config CRYPTO_MANAGER2
123 def_tristate CRYPTO_MANAGER || (CRYPTO_MANAGER!=n && CRYPTO_ALGAPI=y)
126 select CRYPTO_SKCIPHER2
127 select CRYPTO_AKCIPHER2
132 tristate "Userspace cryptographic algorithm configuration"
134 select CRYPTO_MANAGER
136 Userspace configuration for cryptographic instantiations such as
139 config CRYPTO_MANAGER_DISABLE_TESTS
140 bool "Disable run-time self tests"
143 Disable run-time self tests that normally take place at
144 algorithm registration.
146 config CRYPTO_MANAGER_EXTRA_TESTS
147 bool "Enable extra run-time crypto self tests"
148 depends on DEBUG_KERNEL && !CRYPTO_MANAGER_DISABLE_TESTS && CRYPTO_MANAGER
150 Enable extra run-time self tests of registered crypto algorithms,
151 including randomized fuzz tests.
153 This is intended for developer use only, as these tests take much
154 longer to run than the normal self tests.
156 config CRYPTO_GF128MUL
160 tristate "Null algorithms"
163 These are 'Null' algorithms, used by IPsec, which do nothing.
167 select CRYPTO_ALGAPI2
168 select CRYPTO_SKCIPHER2
172 tristate "Parallel crypto engine"
175 select CRYPTO_MANAGER
178 This converts an arbitrary crypto algorithm into a parallel
179 algorithm that executes in kernel threads.
182 tristate "Software async crypto daemon"
183 select CRYPTO_SKCIPHER
185 select CRYPTO_MANAGER
187 This is a generic software asynchronous crypto daemon that
188 converts an arbitrary synchronous software crypto algorithm
189 into an asynchronous algorithm that executes in a kernel thread.
191 config CRYPTO_AUTHENC
192 tristate "Authenc support"
194 select CRYPTO_SKCIPHER
195 select CRYPTO_MANAGER
199 Authenc: Combined mode wrapper for IPsec.
200 This is required for IPSec.
203 tristate "Testing module"
204 depends on m || EXPERT
205 select CRYPTO_MANAGER
207 Quick & dirty crypto test module.
213 config CRYPTO_GLUE_HELPER_X86
216 select CRYPTO_SKCIPHER
221 comment "Public-key cryptography"
224 tristate "RSA algorithm"
225 select CRYPTO_AKCIPHER
226 select CRYPTO_MANAGER
230 Generic implementation of the RSA public key algorithm.
233 tristate "Diffie-Hellman algorithm"
237 Generic implementation of the Diffie-Hellman algorithm.
243 tristate "ECDH algorithm"
246 select CRYPTO_RNG_DEFAULT
248 Generic implementation of the ECDH algorithm
251 tristate "EC-RDSA (GOST 34.10) algorithm"
253 select CRYPTO_AKCIPHER
254 select CRYPTO_STREEBOG
258 Elliptic Curve Russian Digital Signature Algorithm (GOST R 34.10-2012,
259 RFC 7091, ISO/IEC 14888-3:2018) is one of the Russian cryptographic
260 standard algorithms (called GOST algorithms). Only signature verification
264 tristate "SM2 algorithm"
266 select CRYPTO_AKCIPHER
267 select CRYPTO_MANAGER
271 Generic implementation of the SM2 public key algorithm. It was
272 published by State Encryption Management Bureau, China.
273 as specified by OSCCA GM/T 0003.1-2012 -- 0003.5-2012.
276 https://tools.ietf.org/html/draft-shen-sm2-ecdsa-02
277 http://www.oscca.gov.cn/sca/xxgk/2010-12/17/content_1002386.shtml
278 http://www.gmbz.org.cn/main/bzlb.html
280 config CRYPTO_CURVE25519
281 tristate "Curve25519 algorithm"
283 select CRYPTO_LIB_CURVE25519_GENERIC
285 config CRYPTO_CURVE25519_X86
286 tristate "x86_64 accelerated Curve25519 scalar multiplication library"
287 depends on X86 && 64BIT
288 select CRYPTO_LIB_CURVE25519_GENERIC
289 select CRYPTO_ARCH_HAVE_LIB_CURVE25519
291 comment "Authenticated Encryption with Associated Data"
294 tristate "CCM support"
298 select CRYPTO_MANAGER
300 Support for Counter with CBC MAC. Required for IPsec.
303 tristate "GCM/GMAC support"
308 select CRYPTO_MANAGER
310 Support for Galois/Counter Mode (GCM) and Galois Message
311 Authentication Code (GMAC). Required for IPSec.
313 config CRYPTO_CHACHA20POLY1305
314 tristate "ChaCha20-Poly1305 AEAD support"
315 select CRYPTO_CHACHA20
316 select CRYPTO_POLY1305
318 select CRYPTO_MANAGER
320 ChaCha20-Poly1305 AEAD support, RFC7539.
322 Support for the AEAD wrapper using the ChaCha20 stream cipher combined
323 with the Poly1305 authenticator. It is defined in RFC7539 for use in
326 config CRYPTO_AEGIS128
327 tristate "AEGIS-128 AEAD algorithm"
329 select CRYPTO_AES # for AES S-box tables
331 Support for the AEGIS-128 dedicated AEAD algorithm.
333 config CRYPTO_AEGIS128_SIMD
334 bool "Support SIMD acceleration for AEGIS-128"
335 depends on CRYPTO_AEGIS128 && ((ARM || ARM64) && KERNEL_MODE_NEON)
338 config CRYPTO_AEGIS128_AESNI_SSE2
339 tristate "AEGIS-128 AEAD algorithm (x86_64 AESNI+SSE2 implementation)"
340 depends on X86 && 64BIT
344 AESNI+SSE2 implementation of the AEGIS-128 dedicated AEAD algorithm.
347 tristate "Sequence Number IV Generator"
349 select CRYPTO_SKCIPHER
351 select CRYPTO_RNG_DEFAULT
352 select CRYPTO_MANAGER
354 This IV generator generates an IV based on a sequence number by
355 xoring it with a salt. This algorithm is mainly useful for CTR
357 config CRYPTO_ECHAINIV
358 tristate "Encrypted Chain IV Generator"
361 select CRYPTO_RNG_DEFAULT
362 select CRYPTO_MANAGER
364 This IV generator generates an IV based on the encryption of
365 a sequence number xored with a salt. This is the default
368 comment "Block modes"
371 tristate "CBC support"
372 select CRYPTO_SKCIPHER
373 select CRYPTO_MANAGER
375 CBC: Cipher Block Chaining mode
376 This block cipher algorithm is required for IPSec.
379 tristate "CFB support"
380 select CRYPTO_SKCIPHER
381 select CRYPTO_MANAGER
383 CFB: Cipher FeedBack mode
384 This block cipher algorithm is required for TPM2 Cryptography.
387 tristate "CTR support"
388 select CRYPTO_SKCIPHER
389 select CRYPTO_MANAGER
392 This block cipher algorithm is required for IPSec.
395 tristate "CTS support"
396 select CRYPTO_SKCIPHER
397 select CRYPTO_MANAGER
399 CTS: Cipher Text Stealing
400 This is the Cipher Text Stealing mode as described by
401 Section 8 of rfc2040 and referenced by rfc3962
402 (rfc3962 includes errata information in its Appendix A) or
403 CBC-CS3 as defined by NIST in Sp800-38A addendum from Oct 2010.
404 This mode is required for Kerberos gss mechanism support
407 See: https://csrc.nist.gov/publications/detail/sp/800-38a/addendum/final
410 tristate "ECB support"
411 select CRYPTO_SKCIPHER
412 select CRYPTO_MANAGER
414 ECB: Electronic CodeBook mode
415 This is the simplest block cipher algorithm. It simply encrypts
416 the input block by block.
419 tristate "LRW support"
420 select CRYPTO_SKCIPHER
421 select CRYPTO_MANAGER
422 select CRYPTO_GF128MUL
424 LRW: Liskov Rivest Wagner, a tweakable, non malleable, non movable
425 narrow block cipher mode for dm-crypt. Use it with cipher
426 specification string aes-lrw-benbi, the key must be 256, 320 or 384.
427 The first 128, 192 or 256 bits in the key are used for AES and the
428 rest is used to tie each cipher block to its logical position.
431 tristate "OFB support"
432 select CRYPTO_SKCIPHER
433 select CRYPTO_MANAGER
435 OFB: the Output Feedback mode makes a block cipher into a synchronous
436 stream cipher. It generates keystream blocks, which are then XORed
437 with the plaintext blocks to get the ciphertext. Flipping a bit in the
438 ciphertext produces a flipped bit in the plaintext at the same
439 location. This property allows many error correcting codes to function
440 normally even when applied before encryption.
443 tristate "PCBC support"
444 select CRYPTO_SKCIPHER
445 select CRYPTO_MANAGER
447 PCBC: Propagating Cipher Block Chaining mode
448 This block cipher algorithm is required for RxRPC.
451 tristate "XTS support"
452 select CRYPTO_SKCIPHER
453 select CRYPTO_MANAGER
456 XTS: IEEE1619/D16 narrow block cipher use with aes-xts-plain,
457 key size 256, 384 or 512 bits. This implementation currently
458 can't handle a sectorsize which is not a multiple of 16 bytes.
460 config CRYPTO_KEYWRAP
461 tristate "Key wrapping support"
462 select CRYPTO_SKCIPHER
463 select CRYPTO_MANAGER
465 Support for key wrapping (NIST SP800-38F / RFC3394) without
468 config CRYPTO_NHPOLY1305
471 select CRYPTO_LIB_POLY1305_GENERIC
473 config CRYPTO_NHPOLY1305_SSE2
474 tristate "NHPoly1305 hash function (x86_64 SSE2 implementation)"
475 depends on X86 && 64BIT
476 select CRYPTO_NHPOLY1305
478 SSE2 optimized implementation of the hash function used by the
479 Adiantum encryption mode.
481 config CRYPTO_NHPOLY1305_AVX2
482 tristate "NHPoly1305 hash function (x86_64 AVX2 implementation)"
483 depends on X86 && 64BIT
484 select CRYPTO_NHPOLY1305
486 AVX2 optimized implementation of the hash function used by the
487 Adiantum encryption mode.
489 config CRYPTO_ADIANTUM
490 tristate "Adiantum support"
491 select CRYPTO_CHACHA20
492 select CRYPTO_LIB_POLY1305_GENERIC
493 select CRYPTO_NHPOLY1305
494 select CRYPTO_MANAGER
496 Adiantum is a tweakable, length-preserving encryption mode
497 designed for fast and secure disk encryption, especially on
498 CPUs without dedicated crypto instructions. It encrypts
499 each sector using the XChaCha12 stream cipher, two passes of
500 an ε-almost-∆-universal hash function, and an invocation of
501 the AES-256 block cipher on a single 16-byte block. On CPUs
502 without AES instructions, Adiantum is much faster than
505 Adiantum's security is provably reducible to that of its
506 underlying stream and block ciphers, subject to a security
507 bound. Unlike XTS, Adiantum is a true wide-block encryption
508 mode, so it actually provides an even stronger notion of
509 security than XTS, subject to the security bound.
514 tristate "ESSIV support for block encryption"
515 select CRYPTO_AUTHENC
517 Encrypted salt-sector initialization vector (ESSIV) is an IV
518 generation method that is used in some cases by fscrypt and/or
519 dm-crypt. It uses the hash of the block encryption key as the
520 symmetric key for a block encryption pass applied to the input
521 IV, making low entropy IV sources more suitable for block
524 This driver implements a crypto API template that can be
525 instantiated either as an skcipher or as an AEAD (depending on the
526 type of the first template argument), and which defers encryption
527 and decryption requests to the encapsulated cipher after applying
528 ESSIV to the input IV. Note that in the AEAD case, it is assumed
529 that the keys are presented in the same format used by the authenc
530 template, and that the IV appears at the end of the authenticated
531 associated data (AAD) region (which is how dm-crypt uses it.)
533 Note that the use of ESSIV is not recommended for new deployments,
534 and so this only needs to be enabled when interoperability with
535 existing encrypted volumes of filesystems is required, or when
536 building for a particular system that requires it (e.g., when
537 the SoC in question has accelerated CBC but not XTS, making CBC
538 combined with ESSIV the only feasible mode for h/w accelerated
544 tristate "CMAC support"
546 select CRYPTO_MANAGER
548 Cipher-based Message Authentication Code (CMAC) specified by
549 The National Institute of Standards and Technology (NIST).
551 https://tools.ietf.org/html/rfc4493
552 http://csrc.nist.gov/publications/nistpubs/800-38B/SP_800-38B.pdf
555 tristate "HMAC support"
557 select CRYPTO_MANAGER
559 HMAC: Keyed-Hashing for Message Authentication (RFC2104).
560 This is required for IPSec.
563 tristate "XCBC support"
565 select CRYPTO_MANAGER
567 XCBC: Keyed-Hashing with encryption algorithm
568 https://www.ietf.org/rfc/rfc3566.txt
569 http://csrc.nist.gov/encryption/modes/proposedmodes/
570 xcbc-mac/xcbc-mac-spec.pdf
573 tristate "VMAC support"
575 select CRYPTO_MANAGER
577 VMAC is a message authentication algorithm designed for
578 very high speed on 64-bit architectures.
581 <https://fastcrypto.org/vmac>
586 tristate "CRC32c CRC algorithm"
590 Castagnoli, et al Cyclic Redundancy-Check Algorithm. Used
591 by iSCSI for header and data digests and by others.
592 See Castagnoli93. Module will be crc32c.
594 config CRYPTO_CRC32C_INTEL
595 tristate "CRC32c INTEL hardware acceleration"
599 In Intel processor with SSE4.2 supported, the processor will
600 support CRC32C implementation using hardware accelerated CRC32
601 instruction. This option will create 'crc32c-intel' module,
602 which will enable any routine to use the CRC32 instruction to
603 gain performance compared with software implementation.
604 Module will be crc32c-intel.
606 config CRYPTO_CRC32C_VPMSUM
607 tristate "CRC32c CRC algorithm (powerpc64)"
608 depends on PPC64 && ALTIVEC
612 CRC32c algorithm implemented using vector polynomial multiply-sum
613 (vpmsum) instructions, introduced in POWER8. Enable on POWER8
614 and newer processors for improved performance.
617 config CRYPTO_CRC32C_SPARC64
618 tristate "CRC32c CRC algorithm (SPARC64)"
623 CRC32c CRC algorithm implemented using sparc64 crypto instructions,
627 tristate "CRC32 CRC algorithm"
631 CRC-32-IEEE 802.3 cyclic redundancy-check algorithm.
632 Shash crypto api wrappers to crc32_le function.
634 config CRYPTO_CRC32_PCLMUL
635 tristate "CRC32 PCLMULQDQ hardware acceleration"
640 From Intel Westmere and AMD Bulldozer processor with SSE4.2
641 and PCLMULQDQ supported, the processor will support
642 CRC32 PCLMULQDQ implementation using hardware accelerated PCLMULQDQ
643 instruction. This option will create 'crc32-pclmul' module,
644 which will enable any routine to use the CRC-32-IEEE 802.3 checksum
645 and gain better performance as compared with the table implementation.
647 config CRYPTO_CRC32_MIPS
648 tristate "CRC32c and CRC32 CRC algorithm (MIPS)"
649 depends on MIPS_CRC_SUPPORT
652 CRC32c and CRC32 CRC algorithms implemented using mips crypto
653 instructions, when available.
657 tristate "xxHash hash algorithm"
661 xxHash non-cryptographic hash algorithm. Extremely fast, working at
662 speeds close to RAM limits.
664 config CRYPTO_BLAKE2B
665 tristate "BLAKE2b digest algorithm"
668 Implementation of cryptographic hash function BLAKE2b (or just BLAKE2),
669 optimized for 64bit platforms and can produce digests of any size
670 between 1 to 64. The keyed hash is also implemented.
672 This module provides the following algorithms:
679 See https://blake2.net for further information.
681 config CRYPTO_BLAKE2S
682 tristate "BLAKE2s digest algorithm"
683 select CRYPTO_LIB_BLAKE2S_GENERIC
686 Implementation of cryptographic hash function BLAKE2s
687 optimized for 8-32bit platforms and can produce digests of any size
688 between 1 to 32. The keyed hash is also implemented.
690 This module provides the following algorithms:
697 See https://blake2.net for further information.
699 config CRYPTO_BLAKE2S_X86
700 tristate "BLAKE2s digest algorithm (x86 accelerated version)"
701 depends on X86 && 64BIT
702 select CRYPTO_LIB_BLAKE2S_GENERIC
703 select CRYPTO_ARCH_HAVE_LIB_BLAKE2S
705 config CRYPTO_CRCT10DIF
706 tristate "CRCT10DIF algorithm"
709 CRC T10 Data Integrity Field computation is being cast as
710 a crypto transform. This allows for faster crc t10 diff
711 transforms to be used if they are available.
713 config CRYPTO_CRCT10DIF_PCLMUL
714 tristate "CRCT10DIF PCLMULQDQ hardware acceleration"
715 depends on X86 && 64BIT && CRC_T10DIF
718 For x86_64 processors with SSE4.2 and PCLMULQDQ supported,
719 CRC T10 DIF PCLMULQDQ computation can be hardware
720 accelerated PCLMULQDQ instruction. This option will create
721 'crct10dif-pclmul' module, which is faster when computing the
722 crct10dif checksum as compared with the generic table implementation.
724 config CRYPTO_CRCT10DIF_VPMSUM
725 tristate "CRC32T10DIF powerpc64 hardware acceleration"
726 depends on PPC64 && ALTIVEC && CRC_T10DIF
729 CRC10T10DIF algorithm implemented using vector polynomial
730 multiply-sum (vpmsum) instructions, introduced in POWER8. Enable on
731 POWER8 and newer processors for improved performance.
733 config CRYPTO_VPMSUM_TESTER
734 tristate "Powerpc64 vpmsum hardware acceleration tester"
735 depends on CRYPTO_CRCT10DIF_VPMSUM && CRYPTO_CRC32C_VPMSUM
737 Stress test for CRC32c and CRC-T10DIF algorithms implemented with
738 POWER8 vpmsum instructions.
739 Unless you are testing these algorithms, you don't need this.
742 tristate "GHASH hash function"
743 select CRYPTO_GF128MUL
746 GHASH is the hash function used in GCM (Galois/Counter Mode).
747 It is not a general-purpose cryptographic hash function.
749 config CRYPTO_POLY1305
750 tristate "Poly1305 authenticator algorithm"
752 select CRYPTO_LIB_POLY1305_GENERIC
754 Poly1305 authenticator algorithm, RFC7539.
756 Poly1305 is an authenticator algorithm designed by Daniel J. Bernstein.
757 It is used for the ChaCha20-Poly1305 AEAD, specified in RFC7539 for use
758 in IETF protocols. This is the portable C implementation of Poly1305.
760 config CRYPTO_POLY1305_X86_64
761 tristate "Poly1305 authenticator algorithm (x86_64/SSE2/AVX2)"
762 depends on X86 && 64BIT
763 select CRYPTO_LIB_POLY1305_GENERIC
764 select CRYPTO_ARCH_HAVE_LIB_POLY1305
766 Poly1305 authenticator algorithm, RFC7539.
768 Poly1305 is an authenticator algorithm designed by Daniel J. Bernstein.
769 It is used for the ChaCha20-Poly1305 AEAD, specified in RFC7539 for use
770 in IETF protocols. This is the x86_64 assembler implementation using SIMD
773 config CRYPTO_POLY1305_MIPS
774 tristate "Poly1305 authenticator algorithm (MIPS optimized)"
775 depends on CPU_MIPS32 || (CPU_MIPS64 && 64BIT)
776 select CRYPTO_ARCH_HAVE_LIB_POLY1305
779 tristate "MD4 digest algorithm"
782 MD4 message digest algorithm (RFC1320).
785 tristate "MD5 digest algorithm"
788 MD5 message digest algorithm (RFC1321).
790 config CRYPTO_MD5_OCTEON
791 tristate "MD5 digest algorithm (OCTEON)"
792 depends on CPU_CAVIUM_OCTEON
796 MD5 message digest algorithm (RFC1321) implemented
797 using OCTEON crypto instructions, when available.
799 config CRYPTO_MD5_PPC
800 tristate "MD5 digest algorithm (PPC)"
804 MD5 message digest algorithm (RFC1321) implemented
807 config CRYPTO_MD5_SPARC64
808 tristate "MD5 digest algorithm (SPARC64)"
813 MD5 message digest algorithm (RFC1321) implemented
814 using sparc64 crypto instructions, when available.
816 config CRYPTO_MICHAEL_MIC
817 tristate "Michael MIC keyed digest algorithm"
820 Michael MIC is used for message integrity protection in TKIP
821 (IEEE 802.11i). This algorithm is required for TKIP, but it
822 should not be used for other purposes because of the weakness
826 tristate "RIPEMD-128 digest algorithm"
829 RIPEMD-128 (ISO/IEC 10118-3:2004).
831 RIPEMD-128 is a 128-bit cryptographic hash function. It should only
832 be used as a secure replacement for RIPEMD. For other use cases,
833 RIPEMD-160 should be used.
835 Developed by Hans Dobbertin, Antoon Bosselaers and Bart Preneel.
836 See <https://homes.esat.kuleuven.be/~bosselae/ripemd160.html>
839 tristate "RIPEMD-160 digest algorithm"
842 RIPEMD-160 (ISO/IEC 10118-3:2004).
844 RIPEMD-160 is a 160-bit cryptographic hash function. It is intended
845 to be used as a secure replacement for the 128-bit hash functions
846 MD4, MD5 and it's predecessor RIPEMD
847 (not to be confused with RIPEMD-128).
849 It's speed is comparable to SHA1 and there are no known attacks
852 Developed by Hans Dobbertin, Antoon Bosselaers and Bart Preneel.
853 See <https://homes.esat.kuleuven.be/~bosselae/ripemd160.html>
856 tristate "RIPEMD-256 digest algorithm"
859 RIPEMD-256 is an optional extension of RIPEMD-128 with a
860 256 bit hash. It is intended for applications that require
861 longer hash-results, without needing a larger security level
864 Developed by Hans Dobbertin, Antoon Bosselaers and Bart Preneel.
865 See <https://homes.esat.kuleuven.be/~bosselae/ripemd160.html>
868 tristate "RIPEMD-320 digest algorithm"
871 RIPEMD-320 is an optional extension of RIPEMD-160 with a
872 320 bit hash. It is intended for applications that require
873 longer hash-results, without needing a larger security level
876 Developed by Hans Dobbertin, Antoon Bosselaers and Bart Preneel.
877 See <https://homes.esat.kuleuven.be/~bosselae/ripemd160.html>
880 tristate "SHA1 digest algorithm"
883 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2).
885 config CRYPTO_SHA1_SSSE3
886 tristate "SHA1 digest algorithm (SSSE3/AVX/AVX2/SHA-NI)"
887 depends on X86 && 64BIT
891 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2) implemented
892 using Supplemental SSE3 (SSSE3) instructions or Advanced Vector
893 Extensions (AVX/AVX2) or SHA-NI(SHA Extensions New Instructions),
896 config CRYPTO_SHA256_SSSE3
897 tristate "SHA256 digest algorithm (SSSE3/AVX/AVX2/SHA-NI)"
898 depends on X86 && 64BIT
902 SHA-256 secure hash standard (DFIPS 180-2) implemented
903 using Supplemental SSE3 (SSSE3) instructions, or Advanced Vector
904 Extensions version 1 (AVX1), or Advanced Vector Extensions
905 version 2 (AVX2) instructions, or SHA-NI (SHA Extensions New
906 Instructions) when available.
908 config CRYPTO_SHA512_SSSE3
909 tristate "SHA512 digest algorithm (SSSE3/AVX/AVX2)"
910 depends on X86 && 64BIT
914 SHA-512 secure hash standard (DFIPS 180-2) implemented
915 using Supplemental SSE3 (SSSE3) instructions, or Advanced Vector
916 Extensions version 1 (AVX1), or Advanced Vector Extensions
917 version 2 (AVX2) instructions, when available.
919 config CRYPTO_SHA1_OCTEON
920 tristate "SHA1 digest algorithm (OCTEON)"
921 depends on CPU_CAVIUM_OCTEON
925 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2) implemented
926 using OCTEON crypto instructions, when available.
928 config CRYPTO_SHA1_SPARC64
929 tristate "SHA1 digest algorithm (SPARC64)"
934 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2) implemented
935 using sparc64 crypto instructions, when available.
937 config CRYPTO_SHA1_PPC
938 tristate "SHA1 digest algorithm (powerpc)"
941 This is the powerpc hardware accelerated implementation of the
942 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2).
944 config CRYPTO_SHA1_PPC_SPE
945 tristate "SHA1 digest algorithm (PPC SPE)"
946 depends on PPC && SPE
948 SHA-1 secure hash standard (DFIPS 180-4) implemented
949 using powerpc SPE SIMD instruction set.
952 tristate "SHA224 and SHA256 digest algorithm"
954 select CRYPTO_LIB_SHA256
956 SHA256 secure hash standard (DFIPS 180-2).
958 This version of SHA implements a 256 bit hash with 128 bits of
959 security against collision attacks.
961 This code also includes SHA-224, a 224 bit hash with 112 bits
962 of security against collision attacks.
964 config CRYPTO_SHA256_PPC_SPE
965 tristate "SHA224 and SHA256 digest algorithm (PPC SPE)"
966 depends on PPC && SPE
970 SHA224 and SHA256 secure hash standard (DFIPS 180-2)
971 implemented using powerpc SPE SIMD instruction set.
973 config CRYPTO_SHA256_OCTEON
974 tristate "SHA224 and SHA256 digest algorithm (OCTEON)"
975 depends on CPU_CAVIUM_OCTEON
979 SHA-256 secure hash standard (DFIPS 180-2) implemented
980 using OCTEON crypto instructions, when available.
982 config CRYPTO_SHA256_SPARC64
983 tristate "SHA224 and SHA256 digest algorithm (SPARC64)"
988 SHA-256 secure hash standard (DFIPS 180-2) implemented
989 using sparc64 crypto instructions, when available.
992 tristate "SHA384 and SHA512 digest algorithms"
995 SHA512 secure hash standard (DFIPS 180-2).
997 This version of SHA implements a 512 bit hash with 256 bits of
998 security against collision attacks.
1000 This code also includes SHA-384, a 384 bit hash with 192 bits
1001 of security against collision attacks.
1003 config CRYPTO_SHA512_OCTEON
1004 tristate "SHA384 and SHA512 digest algorithms (OCTEON)"
1005 depends on CPU_CAVIUM_OCTEON
1006 select CRYPTO_SHA512
1009 SHA-512 secure hash standard (DFIPS 180-2) implemented
1010 using OCTEON crypto instructions, when available.
1012 config CRYPTO_SHA512_SPARC64
1013 tristate "SHA384 and SHA512 digest algorithm (SPARC64)"
1015 select CRYPTO_SHA512
1018 SHA-512 secure hash standard (DFIPS 180-2) implemented
1019 using sparc64 crypto instructions, when available.
1022 tristate "SHA3 digest algorithm"
1025 SHA-3 secure hash standard (DFIPS 202). It's based on
1026 cryptographic sponge function family called Keccak.
1029 http://keccak.noekeon.org/
1032 tristate "SM3 digest algorithm"
1035 SM3 secure hash function as defined by OSCCA GM/T 0004-2012 SM3).
1036 It is part of the Chinese Commercial Cryptography suite.
1039 http://www.oscca.gov.cn/UpFile/20101222141857786.pdf
1040 https://datatracker.ietf.org/doc/html/draft-shen-sm3-hash
1042 config CRYPTO_STREEBOG
1043 tristate "Streebog Hash Function"
1046 Streebog Hash Function (GOST R 34.11-2012, RFC 6986) is one of the Russian
1047 cryptographic standard algorithms (called GOST algorithms).
1048 This setting enables two hash algorithms with 256 and 512 bits output.
1051 https://tc26.ru/upload/iblock/fed/feddbb4d26b685903faa2ba11aea43f6.pdf
1052 https://tools.ietf.org/html/rfc6986
1054 config CRYPTO_TGR192
1055 tristate "Tiger digest algorithms"
1058 Tiger hash algorithm 192, 160 and 128-bit hashes
1060 Tiger is a hash function optimized for 64-bit processors while
1061 still having decent performance on 32-bit processors.
1062 Tiger was developed by Ross Anderson and Eli Biham.
1065 <https://www.cs.technion.ac.il/~biham/Reports/Tiger/>.
1068 tristate "Whirlpool digest algorithms"
1071 Whirlpool hash algorithm 512, 384 and 256-bit hashes
1073 Whirlpool-512 is part of the NESSIE cryptographic primitives.
1074 Whirlpool will be part of the ISO/IEC 10118-3:2003(E) standard
1077 <http://www.larc.usp.br/~pbarreto/WhirlpoolPage.html>
1079 config CRYPTO_GHASH_CLMUL_NI_INTEL
1080 tristate "GHASH hash function (CLMUL-NI accelerated)"
1081 depends on X86 && 64BIT
1082 select CRYPTO_CRYPTD
1084 This is the x86_64 CLMUL-NI accelerated implementation of
1085 GHASH, the hash function used in GCM (Galois/Counter mode).
1090 tristate "AES cipher algorithms"
1091 select CRYPTO_ALGAPI
1092 select CRYPTO_LIB_AES
1094 AES cipher algorithms (FIPS-197). AES uses the Rijndael
1097 Rijndael appears to be consistently a very good performer in
1098 both hardware and software across a wide range of computing
1099 environments regardless of its use in feedback or non-feedback
1100 modes. Its key setup time is excellent, and its key agility is
1101 good. Rijndael's very low memory requirements make it very well
1102 suited for restricted-space environments, in which it also
1103 demonstrates excellent performance. Rijndael's operations are
1104 among the easiest to defend against power and timing attacks.
1106 The AES specifies three key sizes: 128, 192 and 256 bits
1108 See <http://csrc.nist.gov/CryptoToolkit/aes/> for more information.
1110 config CRYPTO_AES_TI
1111 tristate "Fixed time AES cipher"
1112 select CRYPTO_ALGAPI
1113 select CRYPTO_LIB_AES
1115 This is a generic implementation of AES that attempts to eliminate
1116 data dependent latencies as much as possible without affecting
1117 performance too much. It is intended for use by the generic CCM
1118 and GCM drivers, and other CTR or CMAC/XCBC based modes that rely
1119 solely on encryption (although decryption is supported as well, but
1120 with a more dramatic performance hit)
1122 Instead of using 16 lookup tables of 1 KB each, (8 for encryption and
1123 8 for decryption), this implementation only uses just two S-boxes of
1124 256 bytes each, and attempts to eliminate data dependent latencies by
1125 prefetching the entire table into the cache at the start of each
1126 block. Interrupts are also disabled to avoid races where cachelines
1127 are evicted when the CPU is interrupted to do something else.
1129 config CRYPTO_AES_NI_INTEL
1130 tristate "AES cipher algorithms (AES-NI)"
1133 select CRYPTO_LIB_AES
1134 select CRYPTO_ALGAPI
1135 select CRYPTO_SKCIPHER
1138 Use Intel AES-NI instructions for AES algorithm.
1140 AES cipher algorithms (FIPS-197). AES uses the Rijndael
1143 Rijndael appears to be consistently a very good performer in
1144 both hardware and software across a wide range of computing
1145 environments regardless of its use in feedback or non-feedback
1146 modes. Its key setup time is excellent, and its key agility is
1147 good. Rijndael's very low memory requirements make it very well
1148 suited for restricted-space environments, in which it also
1149 demonstrates excellent performance. Rijndael's operations are
1150 among the easiest to defend against power and timing attacks.
1152 The AES specifies three key sizes: 128, 192 and 256 bits
1154 See <http://csrc.nist.gov/encryption/aes/> for more information.
1156 In addition to AES cipher algorithm support, the acceleration
1157 for some popular block cipher mode is supported too, including
1158 ECB, CBC, LRW, XTS. The 64 bit version has additional
1159 acceleration for CTR.
1161 config CRYPTO_AES_SPARC64
1162 tristate "AES cipher algorithms (SPARC64)"
1164 select CRYPTO_SKCIPHER
1166 Use SPARC64 crypto opcodes for AES algorithm.
1168 AES cipher algorithms (FIPS-197). AES uses the Rijndael
1171 Rijndael appears to be consistently a very good performer in
1172 both hardware and software across a wide range of computing
1173 environments regardless of its use in feedback or non-feedback
1174 modes. Its key setup time is excellent, and its key agility is
1175 good. Rijndael's very low memory requirements make it very well
1176 suited for restricted-space environments, in which it also
1177 demonstrates excellent performance. Rijndael's operations are
1178 among the easiest to defend against power and timing attacks.
1180 The AES specifies three key sizes: 128, 192 and 256 bits
1182 See <http://csrc.nist.gov/encryption/aes/> for more information.
1184 In addition to AES cipher algorithm support, the acceleration
1185 for some popular block cipher mode is supported too, including
1188 config CRYPTO_AES_PPC_SPE
1189 tristate "AES cipher algorithms (PPC SPE)"
1190 depends on PPC && SPE
1191 select CRYPTO_SKCIPHER
1193 AES cipher algorithms (FIPS-197). Additionally the acceleration
1194 for popular block cipher modes ECB, CBC, CTR and XTS is supported.
1195 This module should only be used for low power (router) devices
1196 without hardware AES acceleration (e.g. caam crypto). It reduces the
1197 size of the AES tables from 16KB to 8KB + 256 bytes and mitigates
1198 timining attacks. Nevertheless it might be not as secure as other
1199 architecture specific assembler implementations that work on 1KB
1200 tables or 256 bytes S-boxes.
1202 config CRYPTO_ANUBIS
1203 tristate "Anubis cipher algorithm"
1204 depends on CRYPTO_USER_API_ENABLE_OBSOLETE
1205 select CRYPTO_ALGAPI
1207 Anubis cipher algorithm.
1209 Anubis is a variable key length cipher which can use keys from
1210 128 bits to 320 bits in length. It was evaluated as a entrant
1211 in the NESSIE competition.
1214 <https://www.cosic.esat.kuleuven.be/nessie/reports/>
1215 <http://www.larc.usp.br/~pbarreto/AnubisPage.html>
1218 tristate "ARC4 cipher algorithm"
1219 depends on CRYPTO_USER_API_ENABLE_OBSOLETE
1220 select CRYPTO_SKCIPHER
1221 select CRYPTO_LIB_ARC4
1223 ARC4 cipher algorithm.
1225 ARC4 is a stream cipher using keys ranging from 8 bits to 2048
1226 bits in length. This algorithm is required for driver-based
1227 WEP, but it should not be for other purposes because of the
1228 weakness of the algorithm.
1230 config CRYPTO_BLOWFISH
1231 tristate "Blowfish cipher algorithm"
1232 select CRYPTO_ALGAPI
1233 select CRYPTO_BLOWFISH_COMMON
1235 Blowfish cipher algorithm, by Bruce Schneier.
1237 This is a variable key length cipher which can use keys from 32
1238 bits to 448 bits in length. It's fast, simple and specifically
1239 designed for use on "large microprocessors".
1242 <https://www.schneier.com/blowfish.html>
1244 config CRYPTO_BLOWFISH_COMMON
1247 Common parts of the Blowfish cipher algorithm shared by the
1248 generic c and the assembler implementations.
1251 <https://www.schneier.com/blowfish.html>
1253 config CRYPTO_BLOWFISH_X86_64
1254 tristate "Blowfish cipher algorithm (x86_64)"
1255 depends on X86 && 64BIT
1256 select CRYPTO_SKCIPHER
1257 select CRYPTO_BLOWFISH_COMMON
1259 Blowfish cipher algorithm (x86_64), by Bruce Schneier.
1261 This is a variable key length cipher which can use keys from 32
1262 bits to 448 bits in length. It's fast, simple and specifically
1263 designed for use on "large microprocessors".
1266 <https://www.schneier.com/blowfish.html>
1268 config CRYPTO_CAMELLIA
1269 tristate "Camellia cipher algorithms"
1271 select CRYPTO_ALGAPI
1273 Camellia cipher algorithms module.
1275 Camellia is a symmetric key block cipher developed jointly
1276 at NTT and Mitsubishi Electric Corporation.
1278 The Camellia specifies three key sizes: 128, 192 and 256 bits.
1281 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
1283 config CRYPTO_CAMELLIA_X86_64
1284 tristate "Camellia cipher algorithm (x86_64)"
1285 depends on X86 && 64BIT
1287 select CRYPTO_SKCIPHER
1288 select CRYPTO_GLUE_HELPER_X86
1290 Camellia cipher algorithm module (x86_64).
1292 Camellia is a symmetric key block cipher developed jointly
1293 at NTT and Mitsubishi Electric Corporation.
1295 The Camellia specifies three key sizes: 128, 192 and 256 bits.
1298 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
1300 config CRYPTO_CAMELLIA_AESNI_AVX_X86_64
1301 tristate "Camellia cipher algorithm (x86_64/AES-NI/AVX)"
1302 depends on X86 && 64BIT
1304 select CRYPTO_SKCIPHER
1305 select CRYPTO_CAMELLIA_X86_64
1306 select CRYPTO_GLUE_HELPER_X86
1310 Camellia cipher algorithm module (x86_64/AES-NI/AVX).
1312 Camellia is a symmetric key block cipher developed jointly
1313 at NTT and Mitsubishi Electric Corporation.
1315 The Camellia specifies three key sizes: 128, 192 and 256 bits.
1318 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
1320 config CRYPTO_CAMELLIA_AESNI_AVX2_X86_64
1321 tristate "Camellia cipher algorithm (x86_64/AES-NI/AVX2)"
1322 depends on X86 && 64BIT
1324 select CRYPTO_CAMELLIA_AESNI_AVX_X86_64
1326 Camellia cipher algorithm module (x86_64/AES-NI/AVX2).
1328 Camellia is a symmetric key block cipher developed jointly
1329 at NTT and Mitsubishi Electric Corporation.
1331 The Camellia specifies three key sizes: 128, 192 and 256 bits.
1334 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
1336 config CRYPTO_CAMELLIA_SPARC64
1337 tristate "Camellia cipher algorithm (SPARC64)"
1340 select CRYPTO_ALGAPI
1341 select CRYPTO_SKCIPHER
1343 Camellia cipher algorithm module (SPARC64).
1345 Camellia is a symmetric key block cipher developed jointly
1346 at NTT and Mitsubishi Electric Corporation.
1348 The Camellia specifies three key sizes: 128, 192 and 256 bits.
1351 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
1353 config CRYPTO_CAST_COMMON
1356 Common parts of the CAST cipher algorithms shared by the
1357 generic c and the assembler implementations.
1360 tristate "CAST5 (CAST-128) cipher algorithm"
1361 select CRYPTO_ALGAPI
1362 select CRYPTO_CAST_COMMON
1364 The CAST5 encryption algorithm (synonymous with CAST-128) is
1365 described in RFC2144.
1367 config CRYPTO_CAST5_AVX_X86_64
1368 tristate "CAST5 (CAST-128) cipher algorithm (x86_64/AVX)"
1369 depends on X86 && 64BIT
1370 select CRYPTO_SKCIPHER
1372 select CRYPTO_CAST_COMMON
1375 The CAST5 encryption algorithm (synonymous with CAST-128) is
1376 described in RFC2144.
1378 This module provides the Cast5 cipher algorithm that processes
1379 sixteen blocks parallel using the AVX instruction set.
1382 tristate "CAST6 (CAST-256) cipher algorithm"
1383 select CRYPTO_ALGAPI
1384 select CRYPTO_CAST_COMMON
1386 The CAST6 encryption algorithm (synonymous with CAST-256) is
1387 described in RFC2612.
1389 config CRYPTO_CAST6_AVX_X86_64
1390 tristate "CAST6 (CAST-256) cipher algorithm (x86_64/AVX)"
1391 depends on X86 && 64BIT
1392 select CRYPTO_SKCIPHER
1394 select CRYPTO_CAST_COMMON
1395 select CRYPTO_GLUE_HELPER_X86
1399 The CAST6 encryption algorithm (synonymous with CAST-256) is
1400 described in RFC2612.
1402 This module provides the Cast6 cipher algorithm that processes
1403 eight blocks parallel using the AVX instruction set.
1406 tristate "DES and Triple DES EDE cipher algorithms"
1407 select CRYPTO_ALGAPI
1408 select CRYPTO_LIB_DES
1410 DES cipher algorithm (FIPS 46-2), and Triple DES EDE (FIPS 46-3).
1412 config CRYPTO_DES_SPARC64
1413 tristate "DES and Triple DES EDE cipher algorithms (SPARC64)"
1415 select CRYPTO_ALGAPI
1416 select CRYPTO_LIB_DES
1417 select CRYPTO_SKCIPHER
1419 DES cipher algorithm (FIPS 46-2), and Triple DES EDE (FIPS 46-3),
1420 optimized using SPARC64 crypto opcodes.
1422 config CRYPTO_DES3_EDE_X86_64
1423 tristate "Triple DES EDE cipher algorithm (x86-64)"
1424 depends on X86 && 64BIT
1425 select CRYPTO_SKCIPHER
1426 select CRYPTO_LIB_DES
1428 Triple DES EDE (FIPS 46-3) algorithm.
1430 This module provides implementation of the Triple DES EDE cipher
1431 algorithm that is optimized for x86-64 processors. Two versions of
1432 algorithm are provided; regular processing one input block and
1433 one that processes three blocks parallel.
1435 config CRYPTO_FCRYPT
1436 tristate "FCrypt cipher algorithm"
1437 select CRYPTO_ALGAPI
1438 select CRYPTO_SKCIPHER
1440 FCrypt algorithm used by RxRPC.
1442 config CRYPTO_KHAZAD
1443 tristate "Khazad cipher algorithm"
1444 depends on CRYPTO_USER_API_ENABLE_OBSOLETE
1445 select CRYPTO_ALGAPI
1447 Khazad cipher algorithm.
1449 Khazad was a finalist in the initial NESSIE competition. It is
1450 an algorithm optimized for 64-bit processors with good performance
1451 on 32-bit processors. Khazad uses an 128 bit key size.
1454 <http://www.larc.usp.br/~pbarreto/KhazadPage.html>
1456 config CRYPTO_SALSA20
1457 tristate "Salsa20 stream cipher algorithm"
1458 select CRYPTO_SKCIPHER
1460 Salsa20 stream cipher algorithm.
1462 Salsa20 is a stream cipher submitted to eSTREAM, the ECRYPT
1463 Stream Cipher Project. See <https://www.ecrypt.eu.org/stream/>
1465 The Salsa20 stream cipher algorithm is designed by Daniel J.
1466 Bernstein <djb@cr.yp.to>. See <https://cr.yp.to/snuffle.html>
1468 config CRYPTO_CHACHA20
1469 tristate "ChaCha stream cipher algorithms"
1470 select CRYPTO_LIB_CHACHA_GENERIC
1471 select CRYPTO_SKCIPHER
1473 The ChaCha20, XChaCha20, and XChaCha12 stream cipher algorithms.
1475 ChaCha20 is a 256-bit high-speed stream cipher designed by Daniel J.
1476 Bernstein and further specified in RFC7539 for use in IETF protocols.
1477 This is the portable C implementation of ChaCha20. See also:
1478 <https://cr.yp.to/chacha/chacha-20080128.pdf>
1480 XChaCha20 is the application of the XSalsa20 construction to ChaCha20
1481 rather than to Salsa20. XChaCha20 extends ChaCha20's nonce length
1482 from 64 bits (or 96 bits using the RFC7539 convention) to 192 bits,
1483 while provably retaining ChaCha20's security. See also:
1484 <https://cr.yp.to/snuffle/xsalsa-20081128.pdf>
1486 XChaCha12 is XChaCha20 reduced to 12 rounds, with correspondingly
1487 reduced security margin but increased performance. It can be needed
1488 in some performance-sensitive scenarios.
1490 config CRYPTO_CHACHA20_X86_64
1491 tristate "ChaCha stream cipher algorithms (x86_64/SSSE3/AVX2/AVX-512VL)"
1492 depends on X86 && 64BIT
1493 select CRYPTO_SKCIPHER
1494 select CRYPTO_LIB_CHACHA_GENERIC
1495 select CRYPTO_ARCH_HAVE_LIB_CHACHA
1497 SSSE3, AVX2, and AVX-512VL optimized implementations of the ChaCha20,
1498 XChaCha20, and XChaCha12 stream ciphers.
1500 config CRYPTO_CHACHA_MIPS
1501 tristate "ChaCha stream cipher algorithms (MIPS 32r2 optimized)"
1502 depends on CPU_MIPS32_R2
1503 select CRYPTO_SKCIPHER
1504 select CRYPTO_ARCH_HAVE_LIB_CHACHA
1507 tristate "SEED cipher algorithm"
1508 depends on CRYPTO_USER_API_ENABLE_OBSOLETE
1509 select CRYPTO_ALGAPI
1511 SEED cipher algorithm (RFC4269).
1513 SEED is a 128-bit symmetric key block cipher that has been
1514 developed by KISA (Korea Information Security Agency) as a
1515 national standard encryption algorithm of the Republic of Korea.
1516 It is a 16 round block cipher with the key size of 128 bit.
1519 <http://www.kisa.or.kr/kisa/seed/jsp/seed_eng.jsp>
1521 config CRYPTO_SERPENT
1522 tristate "Serpent cipher algorithm"
1523 select CRYPTO_ALGAPI
1525 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1527 Keys are allowed to be from 0 to 256 bits in length, in steps
1528 of 8 bits. Also includes the 'Tnepres' algorithm, a reversed
1529 variant of Serpent for compatibility with old kerneli.org code.
1532 <https://www.cl.cam.ac.uk/~rja14/serpent.html>
1534 config CRYPTO_SERPENT_SSE2_X86_64
1535 tristate "Serpent cipher algorithm (x86_64/SSE2)"
1536 depends on X86 && 64BIT
1537 select CRYPTO_SKCIPHER
1538 select CRYPTO_GLUE_HELPER_X86
1539 select CRYPTO_SERPENT
1542 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1544 Keys are allowed to be from 0 to 256 bits in length, in steps
1547 This module provides Serpent cipher algorithm that processes eight
1548 blocks parallel using SSE2 instruction set.
1551 <https://www.cl.cam.ac.uk/~rja14/serpent.html>
1553 config CRYPTO_SERPENT_SSE2_586
1554 tristate "Serpent cipher algorithm (i586/SSE2)"
1555 depends on X86 && !64BIT
1556 select CRYPTO_SKCIPHER
1557 select CRYPTO_GLUE_HELPER_X86
1558 select CRYPTO_SERPENT
1561 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1563 Keys are allowed to be from 0 to 256 bits in length, in steps
1566 This module provides Serpent cipher algorithm that processes four
1567 blocks parallel using SSE2 instruction set.
1570 <https://www.cl.cam.ac.uk/~rja14/serpent.html>
1572 config CRYPTO_SERPENT_AVX_X86_64
1573 tristate "Serpent cipher algorithm (x86_64/AVX)"
1574 depends on X86 && 64BIT
1575 select CRYPTO_SKCIPHER
1576 select CRYPTO_GLUE_HELPER_X86
1577 select CRYPTO_SERPENT
1581 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1583 Keys are allowed to be from 0 to 256 bits in length, in steps
1586 This module provides the Serpent cipher algorithm that processes
1587 eight blocks parallel using the AVX instruction set.
1590 <https://www.cl.cam.ac.uk/~rja14/serpent.html>
1592 config CRYPTO_SERPENT_AVX2_X86_64
1593 tristate "Serpent cipher algorithm (x86_64/AVX2)"
1594 depends on X86 && 64BIT
1595 select CRYPTO_SERPENT_AVX_X86_64
1597 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1599 Keys are allowed to be from 0 to 256 bits in length, in steps
1602 This module provides Serpent cipher algorithm that processes 16
1603 blocks parallel using AVX2 instruction set.
1606 <https://www.cl.cam.ac.uk/~rja14/serpent.html>
1609 tristate "SM4 cipher algorithm"
1610 select CRYPTO_ALGAPI
1612 SM4 cipher algorithms (OSCCA GB/T 32907-2016).
1614 SM4 (GBT.32907-2016) is a cryptographic standard issued by the
1615 Organization of State Commercial Administration of China (OSCCA)
1616 as an authorized cryptographic algorithms for the use within China.
1618 SMS4 was originally created for use in protecting wireless
1619 networks, and is mandated in the Chinese National Standard for
1620 Wireless LAN WAPI (Wired Authentication and Privacy Infrastructure)
1623 The latest SM4 standard (GBT.32907-2016) was proposed by OSCCA and
1624 standardized through TC 260 of the Standardization Administration
1625 of the People's Republic of China (SAC).
1627 The input, output, and key of SMS4 are each 128 bits.
1629 See also: <https://eprint.iacr.org/2008/329.pdf>
1634 tristate "TEA, XTEA and XETA cipher algorithms"
1635 depends on CRYPTO_USER_API_ENABLE_OBSOLETE
1636 select CRYPTO_ALGAPI
1638 TEA cipher algorithm.
1640 Tiny Encryption Algorithm is a simple cipher that uses
1641 many rounds for security. It is very fast and uses
1644 Xtendend Tiny Encryption Algorithm is a modification to
1645 the TEA algorithm to address a potential key weakness
1646 in the TEA algorithm.
1648 Xtendend Encryption Tiny Algorithm is a mis-implementation
1649 of the XTEA algorithm for compatibility purposes.
1651 config CRYPTO_TWOFISH
1652 tristate "Twofish cipher algorithm"
1653 select CRYPTO_ALGAPI
1654 select CRYPTO_TWOFISH_COMMON
1656 Twofish cipher algorithm.
1658 Twofish was submitted as an AES (Advanced Encryption Standard)
1659 candidate cipher by researchers at CounterPane Systems. It is a
1660 16 round block cipher supporting key sizes of 128, 192, and 256
1664 <https://www.schneier.com/twofish.html>
1666 config CRYPTO_TWOFISH_COMMON
1669 Common parts of the Twofish cipher algorithm shared by the
1670 generic c and the assembler implementations.
1672 config CRYPTO_TWOFISH_586
1673 tristate "Twofish cipher algorithms (i586)"
1674 depends on (X86 || UML_X86) && !64BIT
1675 select CRYPTO_ALGAPI
1676 select CRYPTO_TWOFISH_COMMON
1678 Twofish cipher algorithm.
1680 Twofish was submitted as an AES (Advanced Encryption Standard)
1681 candidate cipher by researchers at CounterPane Systems. It is a
1682 16 round block cipher supporting key sizes of 128, 192, and 256
1686 <https://www.schneier.com/twofish.html>
1688 config CRYPTO_TWOFISH_X86_64
1689 tristate "Twofish cipher algorithm (x86_64)"
1690 depends on (X86 || UML_X86) && 64BIT
1691 select CRYPTO_ALGAPI
1692 select CRYPTO_TWOFISH_COMMON
1694 Twofish cipher algorithm (x86_64).
1696 Twofish was submitted as an AES (Advanced Encryption Standard)
1697 candidate cipher by researchers at CounterPane Systems. It is a
1698 16 round block cipher supporting key sizes of 128, 192, and 256
1702 <https://www.schneier.com/twofish.html>
1704 config CRYPTO_TWOFISH_X86_64_3WAY
1705 tristate "Twofish cipher algorithm (x86_64, 3-way parallel)"
1706 depends on X86 && 64BIT
1707 select CRYPTO_SKCIPHER
1708 select CRYPTO_TWOFISH_COMMON
1709 select CRYPTO_TWOFISH_X86_64
1710 select CRYPTO_GLUE_HELPER_X86
1712 Twofish cipher algorithm (x86_64, 3-way parallel).
1714 Twofish was submitted as an AES (Advanced Encryption Standard)
1715 candidate cipher by researchers at CounterPane Systems. It is a
1716 16 round block cipher supporting key sizes of 128, 192, and 256
1719 This module provides Twofish cipher algorithm that processes three
1720 blocks parallel, utilizing resources of out-of-order CPUs better.
1723 <https://www.schneier.com/twofish.html>
1725 config CRYPTO_TWOFISH_AVX_X86_64
1726 tristate "Twofish cipher algorithm (x86_64/AVX)"
1727 depends on X86 && 64BIT
1728 select CRYPTO_SKCIPHER
1729 select CRYPTO_GLUE_HELPER_X86
1731 select CRYPTO_TWOFISH_COMMON
1732 select CRYPTO_TWOFISH_X86_64
1733 select CRYPTO_TWOFISH_X86_64_3WAY
1735 Twofish cipher algorithm (x86_64/AVX).
1737 Twofish was submitted as an AES (Advanced Encryption Standard)
1738 candidate cipher by researchers at CounterPane Systems. It is a
1739 16 round block cipher supporting key sizes of 128, 192, and 256
1742 This module provides the Twofish cipher algorithm that processes
1743 eight blocks parallel using the AVX Instruction Set.
1746 <https://www.schneier.com/twofish.html>
1748 comment "Compression"
1750 config CRYPTO_DEFLATE
1751 tristate "Deflate compression algorithm"
1752 select CRYPTO_ALGAPI
1753 select CRYPTO_ACOMP2
1757 This is the Deflate algorithm (RFC1951), specified for use in
1758 IPSec with the IPCOMP protocol (RFC3173, RFC2394).
1760 You will most probably want this if using IPSec.
1763 tristate "LZO compression algorithm"
1764 select CRYPTO_ALGAPI
1765 select CRYPTO_ACOMP2
1767 select LZO_DECOMPRESS
1769 This is the LZO algorithm.
1772 tristate "842 compression algorithm"
1773 select CRYPTO_ALGAPI
1774 select CRYPTO_ACOMP2
1776 select 842_DECOMPRESS
1778 This is the 842 algorithm.
1781 tristate "LZ4 compression algorithm"
1782 select CRYPTO_ALGAPI
1783 select CRYPTO_ACOMP2
1785 select LZ4_DECOMPRESS
1787 This is the LZ4 algorithm.
1790 tristate "LZ4HC compression algorithm"
1791 select CRYPTO_ALGAPI
1792 select CRYPTO_ACOMP2
1793 select LZ4HC_COMPRESS
1794 select LZ4_DECOMPRESS
1796 This is the LZ4 high compression mode algorithm.
1799 tristate "Zstd compression algorithm"
1800 select CRYPTO_ALGAPI
1801 select CRYPTO_ACOMP2
1802 select ZSTD_COMPRESS
1803 select ZSTD_DECOMPRESS
1805 This is the zstd algorithm.
1807 comment "Random Number Generation"
1809 config CRYPTO_ANSI_CPRNG
1810 tristate "Pseudo Random Number Generation for Cryptographic modules"
1814 This option enables the generic pseudo random number generator
1815 for cryptographic modules. Uses the Algorithm specified in
1816 ANSI X9.31 A.2.4. Note that this option must be enabled if
1817 CRYPTO_FIPS is selected
1819 menuconfig CRYPTO_DRBG_MENU
1820 tristate "NIST SP800-90A DRBG"
1822 NIST SP800-90A compliant DRBG. In the following submenu, one or
1823 more of the DRBG types must be selected.
1827 config CRYPTO_DRBG_HMAC
1831 select CRYPTO_SHA256
1833 config CRYPTO_DRBG_HASH
1834 bool "Enable Hash DRBG"
1835 select CRYPTO_SHA256
1837 Enable the Hash DRBG variant as defined in NIST SP800-90A.
1839 config CRYPTO_DRBG_CTR
1840 bool "Enable CTR DRBG"
1844 Enable the CTR DRBG variant as defined in NIST SP800-90A.
1848 default CRYPTO_DRBG_MENU
1850 select CRYPTO_JITTERENTROPY
1852 endif # if CRYPTO_DRBG_MENU
1854 config CRYPTO_JITTERENTROPY
1855 tristate "Jitterentropy Non-Deterministic Random Number Generator"
1858 The Jitterentropy RNG is a noise that is intended
1859 to provide seed to another RNG. The RNG does not
1860 perform any cryptographic whitening of the generated
1861 random numbers. This Jitterentropy RNG registers with
1862 the kernel crypto API and can be used by any caller.
1864 config CRYPTO_USER_API
1867 config CRYPTO_USER_API_HASH
1868 tristate "User-space interface for hash algorithms"
1871 select CRYPTO_USER_API
1873 This option enables the user-spaces interface for hash
1876 config CRYPTO_USER_API_SKCIPHER
1877 tristate "User-space interface for symmetric key cipher algorithms"
1879 select CRYPTO_SKCIPHER
1880 select CRYPTO_USER_API
1882 This option enables the user-spaces interface for symmetric
1883 key cipher algorithms.
1885 config CRYPTO_USER_API_RNG
1886 tristate "User-space interface for random number generator algorithms"
1889 select CRYPTO_USER_API
1891 This option enables the user-spaces interface for random
1892 number generator algorithms.
1894 config CRYPTO_USER_API_RNG_CAVP
1895 bool "Enable CAVP testing of DRBG"
1896 depends on CRYPTO_USER_API_RNG && CRYPTO_DRBG
1898 This option enables extra API for CAVP testing via the user-space
1899 interface: resetting of DRBG entropy, and providing Additional Data.
1900 This should only be enabled for CAVP testing. You should say
1901 no unless you know what this is.
1903 config CRYPTO_USER_API_AEAD
1904 tristate "User-space interface for AEAD cipher algorithms"
1907 select CRYPTO_SKCIPHER
1909 select CRYPTO_USER_API
1911 This option enables the user-spaces interface for AEAD
1914 config CRYPTO_USER_API_ENABLE_OBSOLETE
1915 bool "Enable obsolete cryptographic algorithms for userspace"
1916 depends on CRYPTO_USER_API
1919 Allow obsolete cryptographic algorithms to be selected that have
1920 already been phased out from internal use by the kernel, and are
1921 only useful for userspace clients that still rely on them.
1924 bool "Crypto usage statistics for User-space"
1925 depends on CRYPTO_USER
1927 This option enables the gathering of crypto stats.
1929 - encrypt/decrypt size and numbers of symmeric operations
1930 - compress/decompress size and numbers of compress operations
1931 - size and numbers of hash operations
1932 - encrypt/decrypt/sign/verify numbers for asymmetric operations
1933 - generate/seed numbers for rng operations
1935 config CRYPTO_HASH_INFO
1938 source "lib/crypto/Kconfig"
1939 source "drivers/crypto/Kconfig"
1940 source "crypto/asymmetric_keys/Kconfig"
1941 source "certs/Kconfig"