1 # SPDX-License-Identifier: GPL-2.0
3 # Generic algorithms support
9 # async_tx api: hardware offloaded memory transfer/transform support
11 source "crypto/async_tx/Kconfig"
14 # Cryptographic API Configuration
17 tristate "Cryptographic API"
19 This option provides the core Cryptographic API.
23 comment "Crypto core or helper"
26 bool "FIPS 200 compliance"
27 depends on (CRYPTO_ANSI_CPRNG || CRYPTO_DRBG) && !CRYPTO_MANAGER_DISABLE_TESTS
28 depends on (MODULE_SIG || !MODULES)
30 This option enables the fips boot option which is
31 required if you want the system to operate in a FIPS 200
32 certification. You should say no unless you know what
39 This option provides the API for cryptographic algorithms.
55 config CRYPTO_SKCIPHER
57 select CRYPTO_SKCIPHER2
60 config CRYPTO_SKCIPHER2
83 config CRYPTO_RNG_DEFAULT
85 select CRYPTO_DRBG_MENU
87 config CRYPTO_AKCIPHER2
91 config CRYPTO_AKCIPHER
93 select CRYPTO_AKCIPHER2
107 select CRYPTO_ALGAPI2
115 config CRYPTO_MANAGER
116 tristate "Cryptographic algorithm manager"
117 select CRYPTO_MANAGER2
119 Create default cryptographic template instantiations such as
122 config CRYPTO_MANAGER2
123 def_tristate CRYPTO_MANAGER || (CRYPTO_MANAGER!=n && CRYPTO_ALGAPI=y)
126 select CRYPTO_SKCIPHER2
127 select CRYPTO_AKCIPHER2
132 tristate "Userspace cryptographic algorithm configuration"
134 select CRYPTO_MANAGER
136 Userspace configuration for cryptographic instantiations such as
139 config CRYPTO_MANAGER_DISABLE_TESTS
140 bool "Disable run-time self tests"
143 Disable run-time self tests that normally take place at
144 algorithm registration.
146 config CRYPTO_MANAGER_EXTRA_TESTS
147 bool "Enable extra run-time crypto self tests"
148 depends on DEBUG_KERNEL && !CRYPTO_MANAGER_DISABLE_TESTS
150 Enable extra run-time self tests of registered crypto algorithms,
151 including randomized fuzz tests.
153 This is intended for developer use only, as these tests take much
154 longer to run than the normal self tests.
156 config CRYPTO_GF128MUL
160 tristate "Null algorithms"
163 These are 'Null' algorithms, used by IPsec, which do nothing.
167 select CRYPTO_ALGAPI2
168 select CRYPTO_SKCIPHER2
172 tristate "Parallel crypto engine"
175 select CRYPTO_MANAGER
178 This converts an arbitrary crypto algorithm into a parallel
179 algorithm that executes in kernel threads.
182 tristate "Software async crypto daemon"
183 select CRYPTO_SKCIPHER
185 select CRYPTO_MANAGER
187 This is a generic software asynchronous crypto daemon that
188 converts an arbitrary synchronous software crypto algorithm
189 into an asynchronous algorithm that executes in a kernel thread.
191 config CRYPTO_AUTHENC
192 tristate "Authenc support"
194 select CRYPTO_SKCIPHER
195 select CRYPTO_MANAGER
199 Authenc: Combined mode wrapper for IPsec.
200 This is required for IPSec.
203 tristate "Testing module"
205 select CRYPTO_MANAGER
207 Quick & dirty crypto test module.
213 config CRYPTO_GLUE_HELPER_X86
216 select CRYPTO_SKCIPHER
221 comment "Public-key cryptography"
224 tristate "RSA algorithm"
225 select CRYPTO_AKCIPHER
226 select CRYPTO_MANAGER
230 Generic implementation of the RSA public key algorithm.
233 tristate "Diffie-Hellman algorithm"
237 Generic implementation of the Diffie-Hellman algorithm.
243 tristate "ECDH algorithm"
246 select CRYPTO_RNG_DEFAULT
248 Generic implementation of the ECDH algorithm
251 tristate "EC-RDSA (GOST 34.10) algorithm"
253 select CRYPTO_AKCIPHER
254 select CRYPTO_STREEBOG
258 Elliptic Curve Russian Digital Signature Algorithm (GOST R 34.10-2012,
259 RFC 7091, ISO/IEC 14888-3:2018) is one of the Russian cryptographic
260 standard algorithms (called GOST algorithms). Only signature verification
263 config CRYPTO_CURVE25519
264 tristate "Curve25519 algorithm"
266 select CRYPTO_LIB_CURVE25519_GENERIC
268 config CRYPTO_CURVE25519_X86
269 tristate "x86_64 accelerated Curve25519 scalar multiplication library"
270 depends on X86 && 64BIT
271 select CRYPTO_LIB_CURVE25519_GENERIC
272 select CRYPTO_ARCH_HAVE_LIB_CURVE25519
274 comment "Authenticated Encryption with Associated Data"
277 tristate "CCM support"
281 select CRYPTO_MANAGER
283 Support for Counter with CBC MAC. Required for IPsec.
286 tristate "GCM/GMAC support"
291 select CRYPTO_MANAGER
293 Support for Galois/Counter Mode (GCM) and Galois Message
294 Authentication Code (GMAC). Required for IPSec.
296 config CRYPTO_CHACHA20POLY1305
297 tristate "ChaCha20-Poly1305 AEAD support"
298 select CRYPTO_CHACHA20
299 select CRYPTO_POLY1305
301 select CRYPTO_MANAGER
303 ChaCha20-Poly1305 AEAD support, RFC7539.
305 Support for the AEAD wrapper using the ChaCha20 stream cipher combined
306 with the Poly1305 authenticator. It is defined in RFC7539 for use in
309 config CRYPTO_AEGIS128
310 tristate "AEGIS-128 AEAD algorithm"
312 select CRYPTO_AES # for AES S-box tables
314 Support for the AEGIS-128 dedicated AEAD algorithm.
316 config CRYPTO_AEGIS128_SIMD
317 bool "Support SIMD acceleration for AEGIS-128"
318 depends on CRYPTO_AEGIS128 && ((ARM || ARM64) && KERNEL_MODE_NEON)
321 config CRYPTO_AEGIS128_AESNI_SSE2
322 tristate "AEGIS-128 AEAD algorithm (x86_64 AESNI+SSE2 implementation)"
323 depends on X86 && 64BIT
327 AESNI+SSE2 implementation of the AEGIS-128 dedicated AEAD algorithm.
330 tristate "Sequence Number IV Generator"
332 select CRYPTO_SKCIPHER
334 select CRYPTO_RNG_DEFAULT
335 select CRYPTO_MANAGER
337 This IV generator generates an IV based on a sequence number by
338 xoring it with a salt. This algorithm is mainly useful for CTR
340 config CRYPTO_ECHAINIV
341 tristate "Encrypted Chain IV Generator"
344 select CRYPTO_RNG_DEFAULT
345 select CRYPTO_MANAGER
347 This IV generator generates an IV based on the encryption of
348 a sequence number xored with a salt. This is the default
351 comment "Block modes"
354 tristate "CBC support"
355 select CRYPTO_SKCIPHER
356 select CRYPTO_MANAGER
358 CBC: Cipher Block Chaining mode
359 This block cipher algorithm is required for IPSec.
362 tristate "CFB support"
363 select CRYPTO_SKCIPHER
364 select CRYPTO_MANAGER
366 CFB: Cipher FeedBack mode
367 This block cipher algorithm is required for TPM2 Cryptography.
370 tristate "CTR support"
371 select CRYPTO_SKCIPHER
372 select CRYPTO_MANAGER
375 This block cipher algorithm is required for IPSec.
378 tristate "CTS support"
379 select CRYPTO_SKCIPHER
380 select CRYPTO_MANAGER
382 CTS: Cipher Text Stealing
383 This is the Cipher Text Stealing mode as described by
384 Section 8 of rfc2040 and referenced by rfc3962
385 (rfc3962 includes errata information in its Appendix A) or
386 CBC-CS3 as defined by NIST in Sp800-38A addendum from Oct 2010.
387 This mode is required for Kerberos gss mechanism support
390 See: https://csrc.nist.gov/publications/detail/sp/800-38a/addendum/final
393 tristate "ECB support"
394 select CRYPTO_SKCIPHER
395 select CRYPTO_MANAGER
397 ECB: Electronic CodeBook mode
398 This is the simplest block cipher algorithm. It simply encrypts
399 the input block by block.
402 tristate "LRW support"
403 select CRYPTO_SKCIPHER
404 select CRYPTO_MANAGER
405 select CRYPTO_GF128MUL
407 LRW: Liskov Rivest Wagner, a tweakable, non malleable, non movable
408 narrow block cipher mode for dm-crypt. Use it with cipher
409 specification string aes-lrw-benbi, the key must be 256, 320 or 384.
410 The first 128, 192 or 256 bits in the key are used for AES and the
411 rest is used to tie each cipher block to its logical position.
414 tristate "OFB support"
415 select CRYPTO_SKCIPHER
416 select CRYPTO_MANAGER
418 OFB: the Output Feedback mode makes a block cipher into a synchronous
419 stream cipher. It generates keystream blocks, which are then XORed
420 with the plaintext blocks to get the ciphertext. Flipping a bit in the
421 ciphertext produces a flipped bit in the plaintext at the same
422 location. This property allows many error correcting codes to function
423 normally even when applied before encryption.
426 tristate "PCBC support"
427 select CRYPTO_SKCIPHER
428 select CRYPTO_MANAGER
430 PCBC: Propagating Cipher Block Chaining mode
431 This block cipher algorithm is required for RxRPC.
434 tristate "XTS support"
435 select CRYPTO_SKCIPHER
436 select CRYPTO_MANAGER
439 XTS: IEEE1619/D16 narrow block cipher use with aes-xts-plain,
440 key size 256, 384 or 512 bits. This implementation currently
441 can't handle a sectorsize which is not a multiple of 16 bytes.
443 config CRYPTO_KEYWRAP
444 tristate "Key wrapping support"
445 select CRYPTO_SKCIPHER
446 select CRYPTO_MANAGER
448 Support for key wrapping (NIST SP800-38F / RFC3394) without
451 config CRYPTO_NHPOLY1305
454 select CRYPTO_LIB_POLY1305_GENERIC
456 config CRYPTO_NHPOLY1305_SSE2
457 tristate "NHPoly1305 hash function (x86_64 SSE2 implementation)"
458 depends on X86 && 64BIT
459 select CRYPTO_NHPOLY1305
461 SSE2 optimized implementation of the hash function used by the
462 Adiantum encryption mode.
464 config CRYPTO_NHPOLY1305_AVX2
465 tristate "NHPoly1305 hash function (x86_64 AVX2 implementation)"
466 depends on X86 && 64BIT
467 select CRYPTO_NHPOLY1305
469 AVX2 optimized implementation of the hash function used by the
470 Adiantum encryption mode.
472 config CRYPTO_ADIANTUM
473 tristate "Adiantum support"
474 select CRYPTO_CHACHA20
475 select CRYPTO_LIB_POLY1305_GENERIC
476 select CRYPTO_NHPOLY1305
477 select CRYPTO_MANAGER
479 Adiantum is a tweakable, length-preserving encryption mode
480 designed for fast and secure disk encryption, especially on
481 CPUs without dedicated crypto instructions. It encrypts
482 each sector using the XChaCha12 stream cipher, two passes of
483 an ε-almost-∆-universal hash function, and an invocation of
484 the AES-256 block cipher on a single 16-byte block. On CPUs
485 without AES instructions, Adiantum is much faster than
488 Adiantum's security is provably reducible to that of its
489 underlying stream and block ciphers, subject to a security
490 bound. Unlike XTS, Adiantum is a true wide-block encryption
491 mode, so it actually provides an even stronger notion of
492 security than XTS, subject to the security bound.
497 tristate "ESSIV support for block encryption"
498 select CRYPTO_AUTHENC
500 Encrypted salt-sector initialization vector (ESSIV) is an IV
501 generation method that is used in some cases by fscrypt and/or
502 dm-crypt. It uses the hash of the block encryption key as the
503 symmetric key for a block encryption pass applied to the input
504 IV, making low entropy IV sources more suitable for block
507 This driver implements a crypto API template that can be
508 instantiated either as an skcipher or as an AEAD (depending on the
509 type of the first template argument), and which defers encryption
510 and decryption requests to the encapsulated cipher after applying
511 ESSIV to the input IV. Note that in the AEAD case, it is assumed
512 that the keys are presented in the same format used by the authenc
513 template, and that the IV appears at the end of the authenticated
514 associated data (AAD) region (which is how dm-crypt uses it.)
516 Note that the use of ESSIV is not recommended for new deployments,
517 and so this only needs to be enabled when interoperability with
518 existing encrypted volumes of filesystems is required, or when
519 building for a particular system that requires it (e.g., when
520 the SoC in question has accelerated CBC but not XTS, making CBC
521 combined with ESSIV the only feasible mode for h/w accelerated
527 tristate "CMAC support"
529 select CRYPTO_MANAGER
531 Cipher-based Message Authentication Code (CMAC) specified by
532 The National Institute of Standards and Technology (NIST).
534 https://tools.ietf.org/html/rfc4493
535 http://csrc.nist.gov/publications/nistpubs/800-38B/SP_800-38B.pdf
538 tristate "HMAC support"
540 select CRYPTO_MANAGER
542 HMAC: Keyed-Hashing for Message Authentication (RFC2104).
543 This is required for IPSec.
546 tristate "XCBC support"
548 select CRYPTO_MANAGER
550 XCBC: Keyed-Hashing with encryption algorithm
551 http://www.ietf.org/rfc/rfc3566.txt
552 http://csrc.nist.gov/encryption/modes/proposedmodes/
553 xcbc-mac/xcbc-mac-spec.pdf
556 tristate "VMAC support"
558 select CRYPTO_MANAGER
560 VMAC is a message authentication algorithm designed for
561 very high speed on 64-bit architectures.
564 <http://fastcrypto.org/vmac>
569 tristate "CRC32c CRC algorithm"
573 Castagnoli, et al Cyclic Redundancy-Check Algorithm. Used
574 by iSCSI for header and data digests and by others.
575 See Castagnoli93. Module will be crc32c.
577 config CRYPTO_CRC32C_INTEL
578 tristate "CRC32c INTEL hardware acceleration"
582 In Intel processor with SSE4.2 supported, the processor will
583 support CRC32C implementation using hardware accelerated CRC32
584 instruction. This option will create 'crc32c-intel' module,
585 which will enable any routine to use the CRC32 instruction to
586 gain performance compared with software implementation.
587 Module will be crc32c-intel.
589 config CRYPTO_CRC32C_VPMSUM
590 tristate "CRC32c CRC algorithm (powerpc64)"
591 depends on PPC64 && ALTIVEC
595 CRC32c algorithm implemented using vector polynomial multiply-sum
596 (vpmsum) instructions, introduced in POWER8. Enable on POWER8
597 and newer processors for improved performance.
600 config CRYPTO_CRC32C_SPARC64
601 tristate "CRC32c CRC algorithm (SPARC64)"
606 CRC32c CRC algorithm implemented using sparc64 crypto instructions,
610 tristate "CRC32 CRC algorithm"
614 CRC-32-IEEE 802.3 cyclic redundancy-check algorithm.
615 Shash crypto api wrappers to crc32_le function.
617 config CRYPTO_CRC32_PCLMUL
618 tristate "CRC32 PCLMULQDQ hardware acceleration"
623 From Intel Westmere and AMD Bulldozer processor with SSE4.2
624 and PCLMULQDQ supported, the processor will support
625 CRC32 PCLMULQDQ implementation using hardware accelerated PCLMULQDQ
626 instruction. This option will create 'crc32-pclmul' module,
627 which will enable any routine to use the CRC-32-IEEE 802.3 checksum
628 and gain better performance as compared with the table implementation.
630 config CRYPTO_CRC32_MIPS
631 tristate "CRC32c and CRC32 CRC algorithm (MIPS)"
632 depends on MIPS_CRC_SUPPORT
635 CRC32c and CRC32 CRC algorithms implemented using mips crypto
636 instructions, when available.
640 tristate "xxHash hash algorithm"
644 xxHash non-cryptographic hash algorithm. Extremely fast, working at
645 speeds close to RAM limits.
647 config CRYPTO_BLAKE2B
648 tristate "BLAKE2b digest algorithm"
651 Implementation of cryptographic hash function BLAKE2b (or just BLAKE2),
652 optimized for 64bit platforms and can produce digests of any size
653 between 1 to 64. The keyed hash is also implemented.
655 This module provides the following algorithms:
662 See https://blake2.net for further information.
664 config CRYPTO_BLAKE2S
665 tristate "BLAKE2s digest algorithm"
666 select CRYPTO_LIB_BLAKE2S_GENERIC
669 Implementation of cryptographic hash function BLAKE2s
670 optimized for 8-32bit platforms and can produce digests of any size
671 between 1 to 32. The keyed hash is also implemented.
673 This module provides the following algorithms:
680 See https://blake2.net for further information.
682 config CRYPTO_BLAKE2S_X86
683 tristate "BLAKE2s digest algorithm (x86 accelerated version)"
684 depends on X86 && 64BIT
685 select CRYPTO_LIB_BLAKE2S_GENERIC
686 select CRYPTO_ARCH_HAVE_LIB_BLAKE2S
688 config CRYPTO_CRCT10DIF
689 tristate "CRCT10DIF algorithm"
692 CRC T10 Data Integrity Field computation is being cast as
693 a crypto transform. This allows for faster crc t10 diff
694 transforms to be used if they are available.
696 config CRYPTO_CRCT10DIF_PCLMUL
697 tristate "CRCT10DIF PCLMULQDQ hardware acceleration"
698 depends on X86 && 64BIT && CRC_T10DIF
701 For x86_64 processors with SSE4.2 and PCLMULQDQ supported,
702 CRC T10 DIF PCLMULQDQ computation can be hardware
703 accelerated PCLMULQDQ instruction. This option will create
704 'crct10dif-pclmul' module, which is faster when computing the
705 crct10dif checksum as compared with the generic table implementation.
707 config CRYPTO_CRCT10DIF_VPMSUM
708 tristate "CRC32T10DIF powerpc64 hardware acceleration"
709 depends on PPC64 && ALTIVEC && CRC_T10DIF
712 CRC10T10DIF algorithm implemented using vector polynomial
713 multiply-sum (vpmsum) instructions, introduced in POWER8. Enable on
714 POWER8 and newer processors for improved performance.
716 config CRYPTO_VPMSUM_TESTER
717 tristate "Powerpc64 vpmsum hardware acceleration tester"
718 depends on CRYPTO_CRCT10DIF_VPMSUM && CRYPTO_CRC32C_VPMSUM
720 Stress test for CRC32c and CRC-T10DIF algorithms implemented with
721 POWER8 vpmsum instructions.
722 Unless you are testing these algorithms, you don't need this.
725 tristate "GHASH hash function"
726 select CRYPTO_GF128MUL
729 GHASH is the hash function used in GCM (Galois/Counter Mode).
730 It is not a general-purpose cryptographic hash function.
732 config CRYPTO_POLY1305
733 tristate "Poly1305 authenticator algorithm"
735 select CRYPTO_LIB_POLY1305_GENERIC
737 Poly1305 authenticator algorithm, RFC7539.
739 Poly1305 is an authenticator algorithm designed by Daniel J. Bernstein.
740 It is used for the ChaCha20-Poly1305 AEAD, specified in RFC7539 for use
741 in IETF protocols. This is the portable C implementation of Poly1305.
743 config CRYPTO_POLY1305_X86_64
744 tristate "Poly1305 authenticator algorithm (x86_64/SSE2/AVX2)"
745 depends on X86 && 64BIT
746 select CRYPTO_LIB_POLY1305_GENERIC
747 select CRYPTO_ARCH_HAVE_LIB_POLY1305
749 Poly1305 authenticator algorithm, RFC7539.
751 Poly1305 is an authenticator algorithm designed by Daniel J. Bernstein.
752 It is used for the ChaCha20-Poly1305 AEAD, specified in RFC7539 for use
753 in IETF protocols. This is the x86_64 assembler implementation using SIMD
756 config CRYPTO_POLY1305_MIPS
757 tristate "Poly1305 authenticator algorithm (MIPS optimized)"
758 depends on CPU_MIPS32 || (CPU_MIPS64 && 64BIT)
759 select CRYPTO_ARCH_HAVE_LIB_POLY1305
762 tristate "MD4 digest algorithm"
765 MD4 message digest algorithm (RFC1320).
768 tristate "MD5 digest algorithm"
771 MD5 message digest algorithm (RFC1321).
773 config CRYPTO_MD5_OCTEON
774 tristate "MD5 digest algorithm (OCTEON)"
775 depends on CPU_CAVIUM_OCTEON
779 MD5 message digest algorithm (RFC1321) implemented
780 using OCTEON crypto instructions, when available.
782 config CRYPTO_MD5_PPC
783 tristate "MD5 digest algorithm (PPC)"
787 MD5 message digest algorithm (RFC1321) implemented
790 config CRYPTO_MD5_SPARC64
791 tristate "MD5 digest algorithm (SPARC64)"
796 MD5 message digest algorithm (RFC1321) implemented
797 using sparc64 crypto instructions, when available.
799 config CRYPTO_MICHAEL_MIC
800 tristate "Michael MIC keyed digest algorithm"
803 Michael MIC is used for message integrity protection in TKIP
804 (IEEE 802.11i). This algorithm is required for TKIP, but it
805 should not be used for other purposes because of the weakness
809 tristate "RIPEMD-128 digest algorithm"
812 RIPEMD-128 (ISO/IEC 10118-3:2004).
814 RIPEMD-128 is a 128-bit cryptographic hash function. It should only
815 be used as a secure replacement for RIPEMD. For other use cases,
816 RIPEMD-160 should be used.
818 Developed by Hans Dobbertin, Antoon Bosselaers and Bart Preneel.
819 See <http://homes.esat.kuleuven.be/~bosselae/ripemd160.html>
822 tristate "RIPEMD-160 digest algorithm"
825 RIPEMD-160 (ISO/IEC 10118-3:2004).
827 RIPEMD-160 is a 160-bit cryptographic hash function. It is intended
828 to be used as a secure replacement for the 128-bit hash functions
829 MD4, MD5 and it's predecessor RIPEMD
830 (not to be confused with RIPEMD-128).
832 It's speed is comparable to SHA1 and there are no known attacks
835 Developed by Hans Dobbertin, Antoon Bosselaers and Bart Preneel.
836 See <http://homes.esat.kuleuven.be/~bosselae/ripemd160.html>
839 tristate "RIPEMD-256 digest algorithm"
842 RIPEMD-256 is an optional extension of RIPEMD-128 with a
843 256 bit hash. It is intended for applications that require
844 longer hash-results, without needing a larger security level
847 Developed by Hans Dobbertin, Antoon Bosselaers and Bart Preneel.
848 See <http://homes.esat.kuleuven.be/~bosselae/ripemd160.html>
851 tristate "RIPEMD-320 digest algorithm"
854 RIPEMD-320 is an optional extension of RIPEMD-160 with a
855 320 bit hash. It is intended for applications that require
856 longer hash-results, without needing a larger security level
859 Developed by Hans Dobbertin, Antoon Bosselaers and Bart Preneel.
860 See <http://homes.esat.kuleuven.be/~bosselae/ripemd160.html>
863 tristate "SHA1 digest algorithm"
866 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2).
868 config CRYPTO_SHA1_SSSE3
869 tristate "SHA1 digest algorithm (SSSE3/AVX/AVX2/SHA-NI)"
870 depends on X86 && 64BIT
874 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2) implemented
875 using Supplemental SSE3 (SSSE3) instructions or Advanced Vector
876 Extensions (AVX/AVX2) or SHA-NI(SHA Extensions New Instructions),
879 config CRYPTO_SHA256_SSSE3
880 tristate "SHA256 digest algorithm (SSSE3/AVX/AVX2/SHA-NI)"
881 depends on X86 && 64BIT
885 SHA-256 secure hash standard (DFIPS 180-2) implemented
886 using Supplemental SSE3 (SSSE3) instructions, or Advanced Vector
887 Extensions version 1 (AVX1), or Advanced Vector Extensions
888 version 2 (AVX2) instructions, or SHA-NI (SHA Extensions New
889 Instructions) when available.
891 config CRYPTO_SHA512_SSSE3
892 tristate "SHA512 digest algorithm (SSSE3/AVX/AVX2)"
893 depends on X86 && 64BIT
897 SHA-512 secure hash standard (DFIPS 180-2) implemented
898 using Supplemental SSE3 (SSSE3) instructions, or Advanced Vector
899 Extensions version 1 (AVX1), or Advanced Vector Extensions
900 version 2 (AVX2) instructions, when available.
902 config CRYPTO_SHA1_OCTEON
903 tristate "SHA1 digest algorithm (OCTEON)"
904 depends on CPU_CAVIUM_OCTEON
908 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2) implemented
909 using OCTEON crypto instructions, when available.
911 config CRYPTO_SHA1_SPARC64
912 tristate "SHA1 digest algorithm (SPARC64)"
917 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2) implemented
918 using sparc64 crypto instructions, when available.
920 config CRYPTO_SHA1_PPC
921 tristate "SHA1 digest algorithm (powerpc)"
924 This is the powerpc hardware accelerated implementation of the
925 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2).
927 config CRYPTO_SHA1_PPC_SPE
928 tristate "SHA1 digest algorithm (PPC SPE)"
929 depends on PPC && SPE
931 SHA-1 secure hash standard (DFIPS 180-4) implemented
932 using powerpc SPE SIMD instruction set.
935 tristate "SHA224 and SHA256 digest algorithm"
937 select CRYPTO_LIB_SHA256
939 SHA256 secure hash standard (DFIPS 180-2).
941 This version of SHA implements a 256 bit hash with 128 bits of
942 security against collision attacks.
944 This code also includes SHA-224, a 224 bit hash with 112 bits
945 of security against collision attacks.
947 config CRYPTO_SHA256_PPC_SPE
948 tristate "SHA224 and SHA256 digest algorithm (PPC SPE)"
949 depends on PPC && SPE
953 SHA224 and SHA256 secure hash standard (DFIPS 180-2)
954 implemented using powerpc SPE SIMD instruction set.
956 config CRYPTO_SHA256_OCTEON
957 tristate "SHA224 and SHA256 digest algorithm (OCTEON)"
958 depends on CPU_CAVIUM_OCTEON
962 SHA-256 secure hash standard (DFIPS 180-2) implemented
963 using OCTEON crypto instructions, when available.
965 config CRYPTO_SHA256_SPARC64
966 tristate "SHA224 and SHA256 digest algorithm (SPARC64)"
971 SHA-256 secure hash standard (DFIPS 180-2) implemented
972 using sparc64 crypto instructions, when available.
975 tristate "SHA384 and SHA512 digest algorithms"
978 SHA512 secure hash standard (DFIPS 180-2).
980 This version of SHA implements a 512 bit hash with 256 bits of
981 security against collision attacks.
983 This code also includes SHA-384, a 384 bit hash with 192 bits
984 of security against collision attacks.
986 config CRYPTO_SHA512_OCTEON
987 tristate "SHA384 and SHA512 digest algorithms (OCTEON)"
988 depends on CPU_CAVIUM_OCTEON
992 SHA-512 secure hash standard (DFIPS 180-2) implemented
993 using OCTEON crypto instructions, when available.
995 config CRYPTO_SHA512_SPARC64
996 tristate "SHA384 and SHA512 digest algorithm (SPARC64)"
1001 SHA-512 secure hash standard (DFIPS 180-2) implemented
1002 using sparc64 crypto instructions, when available.
1005 tristate "SHA3 digest algorithm"
1008 SHA-3 secure hash standard (DFIPS 202). It's based on
1009 cryptographic sponge function family called Keccak.
1012 http://keccak.noekeon.org/
1015 tristate "SM3 digest algorithm"
1018 SM3 secure hash function as defined by OSCCA GM/T 0004-2012 SM3).
1019 It is part of the Chinese Commercial Cryptography suite.
1022 http://www.oscca.gov.cn/UpFile/20101222141857786.pdf
1023 https://datatracker.ietf.org/doc/html/draft-shen-sm3-hash
1025 config CRYPTO_STREEBOG
1026 tristate "Streebog Hash Function"
1029 Streebog Hash Function (GOST R 34.11-2012, RFC 6986) is one of the Russian
1030 cryptographic standard algorithms (called GOST algorithms).
1031 This setting enables two hash algorithms with 256 and 512 bits output.
1034 https://tc26.ru/upload/iblock/fed/feddbb4d26b685903faa2ba11aea43f6.pdf
1035 https://tools.ietf.org/html/rfc6986
1037 config CRYPTO_TGR192
1038 tristate "Tiger digest algorithms"
1041 Tiger hash algorithm 192, 160 and 128-bit hashes
1043 Tiger is a hash function optimized for 64-bit processors while
1044 still having decent performance on 32-bit processors.
1045 Tiger was developed by Ross Anderson and Eli Biham.
1048 <http://www.cs.technion.ac.il/~biham/Reports/Tiger/>.
1051 tristate "Whirlpool digest algorithms"
1054 Whirlpool hash algorithm 512, 384 and 256-bit hashes
1056 Whirlpool-512 is part of the NESSIE cryptographic primitives.
1057 Whirlpool will be part of the ISO/IEC 10118-3:2003(E) standard
1060 <http://www.larc.usp.br/~pbarreto/WhirlpoolPage.html>
1062 config CRYPTO_GHASH_CLMUL_NI_INTEL
1063 tristate "GHASH hash function (CLMUL-NI accelerated)"
1064 depends on X86 && 64BIT
1065 select CRYPTO_CRYPTD
1067 This is the x86_64 CLMUL-NI accelerated implementation of
1068 GHASH, the hash function used in GCM (Galois/Counter mode).
1073 tristate "AES cipher algorithms"
1074 select CRYPTO_ALGAPI
1075 select CRYPTO_LIB_AES
1077 AES cipher algorithms (FIPS-197). AES uses the Rijndael
1080 Rijndael appears to be consistently a very good performer in
1081 both hardware and software across a wide range of computing
1082 environments regardless of its use in feedback or non-feedback
1083 modes. Its key setup time is excellent, and its key agility is
1084 good. Rijndael's very low memory requirements make it very well
1085 suited for restricted-space environments, in which it also
1086 demonstrates excellent performance. Rijndael's operations are
1087 among the easiest to defend against power and timing attacks.
1089 The AES specifies three key sizes: 128, 192 and 256 bits
1091 See <http://csrc.nist.gov/CryptoToolkit/aes/> for more information.
1093 config CRYPTO_AES_TI
1094 tristate "Fixed time AES cipher"
1095 select CRYPTO_ALGAPI
1096 select CRYPTO_LIB_AES
1098 This is a generic implementation of AES that attempts to eliminate
1099 data dependent latencies as much as possible without affecting
1100 performance too much. It is intended for use by the generic CCM
1101 and GCM drivers, and other CTR or CMAC/XCBC based modes that rely
1102 solely on encryption (although decryption is supported as well, but
1103 with a more dramatic performance hit)
1105 Instead of using 16 lookup tables of 1 KB each, (8 for encryption and
1106 8 for decryption), this implementation only uses just two S-boxes of
1107 256 bytes each, and attempts to eliminate data dependent latencies by
1108 prefetching the entire table into the cache at the start of each
1109 block. Interrupts are also disabled to avoid races where cachelines
1110 are evicted when the CPU is interrupted to do something else.
1112 config CRYPTO_AES_NI_INTEL
1113 tristate "AES cipher algorithms (AES-NI)"
1116 select CRYPTO_LIB_AES
1117 select CRYPTO_ALGAPI
1118 select CRYPTO_SKCIPHER
1119 select CRYPTO_GLUE_HELPER_X86 if 64BIT
1122 Use Intel AES-NI instructions for AES algorithm.
1124 AES cipher algorithms (FIPS-197). AES uses the Rijndael
1127 Rijndael appears to be consistently a very good performer in
1128 both hardware and software across a wide range of computing
1129 environments regardless of its use in feedback or non-feedback
1130 modes. Its key setup time is excellent, and its key agility is
1131 good. Rijndael's very low memory requirements make it very well
1132 suited for restricted-space environments, in which it also
1133 demonstrates excellent performance. Rijndael's operations are
1134 among the easiest to defend against power and timing attacks.
1136 The AES specifies three key sizes: 128, 192 and 256 bits
1138 See <http://csrc.nist.gov/encryption/aes/> for more information.
1140 In addition to AES cipher algorithm support, the acceleration
1141 for some popular block cipher mode is supported too, including
1142 ECB, CBC, LRW, XTS. The 64 bit version has additional
1143 acceleration for CTR.
1145 config CRYPTO_AES_SPARC64
1146 tristate "AES cipher algorithms (SPARC64)"
1148 select CRYPTO_SKCIPHER
1150 Use SPARC64 crypto opcodes for AES algorithm.
1152 AES cipher algorithms (FIPS-197). AES uses the Rijndael
1155 Rijndael appears to be consistently a very good performer in
1156 both hardware and software across a wide range of computing
1157 environments regardless of its use in feedback or non-feedback
1158 modes. Its key setup time is excellent, and its key agility is
1159 good. Rijndael's very low memory requirements make it very well
1160 suited for restricted-space environments, in which it also
1161 demonstrates excellent performance. Rijndael's operations are
1162 among the easiest to defend against power and timing attacks.
1164 The AES specifies three key sizes: 128, 192 and 256 bits
1166 See <http://csrc.nist.gov/encryption/aes/> for more information.
1168 In addition to AES cipher algorithm support, the acceleration
1169 for some popular block cipher mode is supported too, including
1172 config CRYPTO_AES_PPC_SPE
1173 tristate "AES cipher algorithms (PPC SPE)"
1174 depends on PPC && SPE
1175 select CRYPTO_SKCIPHER
1177 AES cipher algorithms (FIPS-197). Additionally the acceleration
1178 for popular block cipher modes ECB, CBC, CTR and XTS is supported.
1179 This module should only be used for low power (router) devices
1180 without hardware AES acceleration (e.g. caam crypto). It reduces the
1181 size of the AES tables from 16KB to 8KB + 256 bytes and mitigates
1182 timining attacks. Nevertheless it might be not as secure as other
1183 architecture specific assembler implementations that work on 1KB
1184 tables or 256 bytes S-boxes.
1186 config CRYPTO_ANUBIS
1187 tristate "Anubis cipher algorithm"
1188 select CRYPTO_ALGAPI
1190 Anubis cipher algorithm.
1192 Anubis is a variable key length cipher which can use keys from
1193 128 bits to 320 bits in length. It was evaluated as a entrant
1194 in the NESSIE competition.
1197 <https://www.cosic.esat.kuleuven.be/nessie/reports/>
1198 <http://www.larc.usp.br/~pbarreto/AnubisPage.html>
1201 tristate "ARC4 cipher algorithm"
1202 select CRYPTO_SKCIPHER
1203 select CRYPTO_LIB_ARC4
1205 ARC4 cipher algorithm.
1207 ARC4 is a stream cipher using keys ranging from 8 bits to 2048
1208 bits in length. This algorithm is required for driver-based
1209 WEP, but it should not be for other purposes because of the
1210 weakness of the algorithm.
1212 config CRYPTO_BLOWFISH
1213 tristate "Blowfish cipher algorithm"
1214 select CRYPTO_ALGAPI
1215 select CRYPTO_BLOWFISH_COMMON
1217 Blowfish cipher algorithm, by Bruce Schneier.
1219 This is a variable key length cipher which can use keys from 32
1220 bits to 448 bits in length. It's fast, simple and specifically
1221 designed for use on "large microprocessors".
1224 <http://www.schneier.com/blowfish.html>
1226 config CRYPTO_BLOWFISH_COMMON
1229 Common parts of the Blowfish cipher algorithm shared by the
1230 generic c and the assembler implementations.
1233 <http://www.schneier.com/blowfish.html>
1235 config CRYPTO_BLOWFISH_X86_64
1236 tristate "Blowfish cipher algorithm (x86_64)"
1237 depends on X86 && 64BIT
1238 select CRYPTO_SKCIPHER
1239 select CRYPTO_BLOWFISH_COMMON
1241 Blowfish cipher algorithm (x86_64), by Bruce Schneier.
1243 This is a variable key length cipher which can use keys from 32
1244 bits to 448 bits in length. It's fast, simple and specifically
1245 designed for use on "large microprocessors".
1248 <http://www.schneier.com/blowfish.html>
1250 config CRYPTO_CAMELLIA
1251 tristate "Camellia cipher algorithms"
1253 select CRYPTO_ALGAPI
1255 Camellia cipher algorithms module.
1257 Camellia is a symmetric key block cipher developed jointly
1258 at NTT and Mitsubishi Electric Corporation.
1260 The Camellia specifies three key sizes: 128, 192 and 256 bits.
1263 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
1265 config CRYPTO_CAMELLIA_X86_64
1266 tristate "Camellia cipher algorithm (x86_64)"
1267 depends on X86 && 64BIT
1269 select CRYPTO_SKCIPHER
1270 select CRYPTO_GLUE_HELPER_X86
1272 Camellia cipher algorithm module (x86_64).
1274 Camellia is a symmetric key block cipher developed jointly
1275 at NTT and Mitsubishi Electric Corporation.
1277 The Camellia specifies three key sizes: 128, 192 and 256 bits.
1280 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
1282 config CRYPTO_CAMELLIA_AESNI_AVX_X86_64
1283 tristate "Camellia cipher algorithm (x86_64/AES-NI/AVX)"
1284 depends on X86 && 64BIT
1286 select CRYPTO_SKCIPHER
1287 select CRYPTO_CAMELLIA_X86_64
1288 select CRYPTO_GLUE_HELPER_X86
1292 Camellia cipher algorithm module (x86_64/AES-NI/AVX).
1294 Camellia is a symmetric key block cipher developed jointly
1295 at NTT and Mitsubishi Electric Corporation.
1297 The Camellia specifies three key sizes: 128, 192 and 256 bits.
1300 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
1302 config CRYPTO_CAMELLIA_AESNI_AVX2_X86_64
1303 tristate "Camellia cipher algorithm (x86_64/AES-NI/AVX2)"
1304 depends on X86 && 64BIT
1306 select CRYPTO_CAMELLIA_AESNI_AVX_X86_64
1308 Camellia cipher algorithm module (x86_64/AES-NI/AVX2).
1310 Camellia is a symmetric key block cipher developed jointly
1311 at NTT and Mitsubishi Electric Corporation.
1313 The Camellia specifies three key sizes: 128, 192 and 256 bits.
1316 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
1318 config CRYPTO_CAMELLIA_SPARC64
1319 tristate "Camellia cipher algorithm (SPARC64)"
1322 select CRYPTO_ALGAPI
1323 select CRYPTO_SKCIPHER
1325 Camellia cipher algorithm module (SPARC64).
1327 Camellia is a symmetric key block cipher developed jointly
1328 at NTT and Mitsubishi Electric Corporation.
1330 The Camellia specifies three key sizes: 128, 192 and 256 bits.
1333 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
1335 config CRYPTO_CAST_COMMON
1338 Common parts of the CAST cipher algorithms shared by the
1339 generic c and the assembler implementations.
1342 tristate "CAST5 (CAST-128) cipher algorithm"
1343 select CRYPTO_ALGAPI
1344 select CRYPTO_CAST_COMMON
1346 The CAST5 encryption algorithm (synonymous with CAST-128) is
1347 described in RFC2144.
1349 config CRYPTO_CAST5_AVX_X86_64
1350 tristate "CAST5 (CAST-128) cipher algorithm (x86_64/AVX)"
1351 depends on X86 && 64BIT
1352 select CRYPTO_SKCIPHER
1354 select CRYPTO_CAST_COMMON
1357 The CAST5 encryption algorithm (synonymous with CAST-128) is
1358 described in RFC2144.
1360 This module provides the Cast5 cipher algorithm that processes
1361 sixteen blocks parallel using the AVX instruction set.
1364 tristate "CAST6 (CAST-256) cipher algorithm"
1365 select CRYPTO_ALGAPI
1366 select CRYPTO_CAST_COMMON
1368 The CAST6 encryption algorithm (synonymous with CAST-256) is
1369 described in RFC2612.
1371 config CRYPTO_CAST6_AVX_X86_64
1372 tristate "CAST6 (CAST-256) cipher algorithm (x86_64/AVX)"
1373 depends on X86 && 64BIT
1374 select CRYPTO_SKCIPHER
1376 select CRYPTO_CAST_COMMON
1377 select CRYPTO_GLUE_HELPER_X86
1381 The CAST6 encryption algorithm (synonymous with CAST-256) is
1382 described in RFC2612.
1384 This module provides the Cast6 cipher algorithm that processes
1385 eight blocks parallel using the AVX instruction set.
1388 tristate "DES and Triple DES EDE cipher algorithms"
1389 select CRYPTO_ALGAPI
1390 select CRYPTO_LIB_DES
1392 DES cipher algorithm (FIPS 46-2), and Triple DES EDE (FIPS 46-3).
1394 config CRYPTO_DES_SPARC64
1395 tristate "DES and Triple DES EDE cipher algorithms (SPARC64)"
1397 select CRYPTO_ALGAPI
1398 select CRYPTO_LIB_DES
1399 select CRYPTO_SKCIPHER
1401 DES cipher algorithm (FIPS 46-2), and Triple DES EDE (FIPS 46-3),
1402 optimized using SPARC64 crypto opcodes.
1404 config CRYPTO_DES3_EDE_X86_64
1405 tristate "Triple DES EDE cipher algorithm (x86-64)"
1406 depends on X86 && 64BIT
1407 select CRYPTO_SKCIPHER
1408 select CRYPTO_LIB_DES
1410 Triple DES EDE (FIPS 46-3) algorithm.
1412 This module provides implementation of the Triple DES EDE cipher
1413 algorithm that is optimized for x86-64 processors. Two versions of
1414 algorithm are provided; regular processing one input block and
1415 one that processes three blocks parallel.
1417 config CRYPTO_FCRYPT
1418 tristate "FCrypt cipher algorithm"
1419 select CRYPTO_ALGAPI
1420 select CRYPTO_SKCIPHER
1422 FCrypt algorithm used by RxRPC.
1424 config CRYPTO_KHAZAD
1425 tristate "Khazad cipher algorithm"
1426 select CRYPTO_ALGAPI
1428 Khazad cipher algorithm.
1430 Khazad was a finalist in the initial NESSIE competition. It is
1431 an algorithm optimized for 64-bit processors with good performance
1432 on 32-bit processors. Khazad uses an 128 bit key size.
1435 <http://www.larc.usp.br/~pbarreto/KhazadPage.html>
1437 config CRYPTO_SALSA20
1438 tristate "Salsa20 stream cipher algorithm"
1439 select CRYPTO_SKCIPHER
1441 Salsa20 stream cipher algorithm.
1443 Salsa20 is a stream cipher submitted to eSTREAM, the ECRYPT
1444 Stream Cipher Project. See <http://www.ecrypt.eu.org/stream/>
1446 The Salsa20 stream cipher algorithm is designed by Daniel J.
1447 Bernstein <djb@cr.yp.to>. See <http://cr.yp.to/snuffle.html>
1449 config CRYPTO_CHACHA20
1450 tristate "ChaCha stream cipher algorithms"
1451 select CRYPTO_LIB_CHACHA_GENERIC
1452 select CRYPTO_SKCIPHER
1454 The ChaCha20, XChaCha20, and XChaCha12 stream cipher algorithms.
1456 ChaCha20 is a 256-bit high-speed stream cipher designed by Daniel J.
1457 Bernstein and further specified in RFC7539 for use in IETF protocols.
1458 This is the portable C implementation of ChaCha20. See also:
1459 <http://cr.yp.to/chacha/chacha-20080128.pdf>
1461 XChaCha20 is the application of the XSalsa20 construction to ChaCha20
1462 rather than to Salsa20. XChaCha20 extends ChaCha20's nonce length
1463 from 64 bits (or 96 bits using the RFC7539 convention) to 192 bits,
1464 while provably retaining ChaCha20's security. See also:
1465 <https://cr.yp.to/snuffle/xsalsa-20081128.pdf>
1467 XChaCha12 is XChaCha20 reduced to 12 rounds, with correspondingly
1468 reduced security margin but increased performance. It can be needed
1469 in some performance-sensitive scenarios.
1471 config CRYPTO_CHACHA20_X86_64
1472 tristate "ChaCha stream cipher algorithms (x86_64/SSSE3/AVX2/AVX-512VL)"
1473 depends on X86 && 64BIT
1474 select CRYPTO_SKCIPHER
1475 select CRYPTO_LIB_CHACHA_GENERIC
1476 select CRYPTO_ARCH_HAVE_LIB_CHACHA
1478 SSSE3, AVX2, and AVX-512VL optimized implementations of the ChaCha20,
1479 XChaCha20, and XChaCha12 stream ciphers.
1481 config CRYPTO_CHACHA_MIPS
1482 tristate "ChaCha stream cipher algorithms (MIPS 32r2 optimized)"
1483 depends on CPU_MIPS32_R2
1484 select CRYPTO_SKCIPHER
1485 select CRYPTO_ARCH_HAVE_LIB_CHACHA
1488 tristate "SEED cipher algorithm"
1489 select CRYPTO_ALGAPI
1491 SEED cipher algorithm (RFC4269).
1493 SEED is a 128-bit symmetric key block cipher that has been
1494 developed by KISA (Korea Information Security Agency) as a
1495 national standard encryption algorithm of the Republic of Korea.
1496 It is a 16 round block cipher with the key size of 128 bit.
1499 <http://www.kisa.or.kr/kisa/seed/jsp/seed_eng.jsp>
1501 config CRYPTO_SERPENT
1502 tristate "Serpent cipher algorithm"
1503 select CRYPTO_ALGAPI
1505 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1507 Keys are allowed to be from 0 to 256 bits in length, in steps
1508 of 8 bits. Also includes the 'Tnepres' algorithm, a reversed
1509 variant of Serpent for compatibility with old kerneli.org code.
1512 <http://www.cl.cam.ac.uk/~rja14/serpent.html>
1514 config CRYPTO_SERPENT_SSE2_X86_64
1515 tristate "Serpent cipher algorithm (x86_64/SSE2)"
1516 depends on X86 && 64BIT
1517 select CRYPTO_SKCIPHER
1518 select CRYPTO_GLUE_HELPER_X86
1519 select CRYPTO_SERPENT
1522 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1524 Keys are allowed to be from 0 to 256 bits in length, in steps
1527 This module provides Serpent cipher algorithm that processes eight
1528 blocks parallel using SSE2 instruction set.
1531 <http://www.cl.cam.ac.uk/~rja14/serpent.html>
1533 config CRYPTO_SERPENT_SSE2_586
1534 tristate "Serpent cipher algorithm (i586/SSE2)"
1535 depends on X86 && !64BIT
1536 select CRYPTO_SKCIPHER
1537 select CRYPTO_GLUE_HELPER_X86
1538 select CRYPTO_SERPENT
1541 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1543 Keys are allowed to be from 0 to 256 bits in length, in steps
1546 This module provides Serpent cipher algorithm that processes four
1547 blocks parallel using SSE2 instruction set.
1550 <http://www.cl.cam.ac.uk/~rja14/serpent.html>
1552 config CRYPTO_SERPENT_AVX_X86_64
1553 tristate "Serpent cipher algorithm (x86_64/AVX)"
1554 depends on X86 && 64BIT
1555 select CRYPTO_SKCIPHER
1556 select CRYPTO_GLUE_HELPER_X86
1557 select CRYPTO_SERPENT
1561 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1563 Keys are allowed to be from 0 to 256 bits in length, in steps
1566 This module provides the Serpent cipher algorithm that processes
1567 eight blocks parallel using the AVX instruction set.
1570 <http://www.cl.cam.ac.uk/~rja14/serpent.html>
1572 config CRYPTO_SERPENT_AVX2_X86_64
1573 tristate "Serpent cipher algorithm (x86_64/AVX2)"
1574 depends on X86 && 64BIT
1575 select CRYPTO_SERPENT_AVX_X86_64
1577 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1579 Keys are allowed to be from 0 to 256 bits in length, in steps
1582 This module provides Serpent cipher algorithm that processes 16
1583 blocks parallel using AVX2 instruction set.
1586 <http://www.cl.cam.ac.uk/~rja14/serpent.html>
1589 tristate "SM4 cipher algorithm"
1590 select CRYPTO_ALGAPI
1592 SM4 cipher algorithms (OSCCA GB/T 32907-2016).
1594 SM4 (GBT.32907-2016) is a cryptographic standard issued by the
1595 Organization of State Commercial Administration of China (OSCCA)
1596 as an authorized cryptographic algorithms for the use within China.
1598 SMS4 was originally created for use in protecting wireless
1599 networks, and is mandated in the Chinese National Standard for
1600 Wireless LAN WAPI (Wired Authentication and Privacy Infrastructure)
1603 The latest SM4 standard (GBT.32907-2016) was proposed by OSCCA and
1604 standardized through TC 260 of the Standardization Administration
1605 of the People's Republic of China (SAC).
1607 The input, output, and key of SMS4 are each 128 bits.
1609 See also: <https://eprint.iacr.org/2008/329.pdf>
1614 tristate "TEA, XTEA and XETA cipher algorithms"
1615 select CRYPTO_ALGAPI
1617 TEA cipher algorithm.
1619 Tiny Encryption Algorithm is a simple cipher that uses
1620 many rounds for security. It is very fast and uses
1623 Xtendend Tiny Encryption Algorithm is a modification to
1624 the TEA algorithm to address a potential key weakness
1625 in the TEA algorithm.
1627 Xtendend Encryption Tiny Algorithm is a mis-implementation
1628 of the XTEA algorithm for compatibility purposes.
1630 config CRYPTO_TWOFISH
1631 tristate "Twofish cipher algorithm"
1632 select CRYPTO_ALGAPI
1633 select CRYPTO_TWOFISH_COMMON
1635 Twofish cipher algorithm.
1637 Twofish was submitted as an AES (Advanced Encryption Standard)
1638 candidate cipher by researchers at CounterPane Systems. It is a
1639 16 round block cipher supporting key sizes of 128, 192, and 256
1643 <http://www.schneier.com/twofish.html>
1645 config CRYPTO_TWOFISH_COMMON
1648 Common parts of the Twofish cipher algorithm shared by the
1649 generic c and the assembler implementations.
1651 config CRYPTO_TWOFISH_586
1652 tristate "Twofish cipher algorithms (i586)"
1653 depends on (X86 || UML_X86) && !64BIT
1654 select CRYPTO_ALGAPI
1655 select CRYPTO_TWOFISH_COMMON
1657 Twofish cipher algorithm.
1659 Twofish was submitted as an AES (Advanced Encryption Standard)
1660 candidate cipher by researchers at CounterPane Systems. It is a
1661 16 round block cipher supporting key sizes of 128, 192, and 256
1665 <http://www.schneier.com/twofish.html>
1667 config CRYPTO_TWOFISH_X86_64
1668 tristate "Twofish cipher algorithm (x86_64)"
1669 depends on (X86 || UML_X86) && 64BIT
1670 select CRYPTO_ALGAPI
1671 select CRYPTO_TWOFISH_COMMON
1673 Twofish cipher algorithm (x86_64).
1675 Twofish was submitted as an AES (Advanced Encryption Standard)
1676 candidate cipher by researchers at CounterPane Systems. It is a
1677 16 round block cipher supporting key sizes of 128, 192, and 256
1681 <http://www.schneier.com/twofish.html>
1683 config CRYPTO_TWOFISH_X86_64_3WAY
1684 tristate "Twofish cipher algorithm (x86_64, 3-way parallel)"
1685 depends on X86 && 64BIT
1686 select CRYPTO_SKCIPHER
1687 select CRYPTO_TWOFISH_COMMON
1688 select CRYPTO_TWOFISH_X86_64
1689 select CRYPTO_GLUE_HELPER_X86
1691 Twofish cipher algorithm (x86_64, 3-way parallel).
1693 Twofish was submitted as an AES (Advanced Encryption Standard)
1694 candidate cipher by researchers at CounterPane Systems. It is a
1695 16 round block cipher supporting key sizes of 128, 192, and 256
1698 This module provides Twofish cipher algorithm that processes three
1699 blocks parallel, utilizing resources of out-of-order CPUs better.
1702 <http://www.schneier.com/twofish.html>
1704 config CRYPTO_TWOFISH_AVX_X86_64
1705 tristate "Twofish cipher algorithm (x86_64/AVX)"
1706 depends on X86 && 64BIT
1707 select CRYPTO_SKCIPHER
1708 select CRYPTO_GLUE_HELPER_X86
1710 select CRYPTO_TWOFISH_COMMON
1711 select CRYPTO_TWOFISH_X86_64
1712 select CRYPTO_TWOFISH_X86_64_3WAY
1714 Twofish cipher algorithm (x86_64/AVX).
1716 Twofish was submitted as an AES (Advanced Encryption Standard)
1717 candidate cipher by researchers at CounterPane Systems. It is a
1718 16 round block cipher supporting key sizes of 128, 192, and 256
1721 This module provides the Twofish cipher algorithm that processes
1722 eight blocks parallel using the AVX Instruction Set.
1725 <http://www.schneier.com/twofish.html>
1727 comment "Compression"
1729 config CRYPTO_DEFLATE
1730 tristate "Deflate compression algorithm"
1731 select CRYPTO_ALGAPI
1732 select CRYPTO_ACOMP2
1736 This is the Deflate algorithm (RFC1951), specified for use in
1737 IPSec with the IPCOMP protocol (RFC3173, RFC2394).
1739 You will most probably want this if using IPSec.
1742 tristate "LZO compression algorithm"
1743 select CRYPTO_ALGAPI
1744 select CRYPTO_ACOMP2
1746 select LZO_DECOMPRESS
1748 This is the LZO algorithm.
1751 tristate "842 compression algorithm"
1752 select CRYPTO_ALGAPI
1753 select CRYPTO_ACOMP2
1755 select 842_DECOMPRESS
1757 This is the 842 algorithm.
1760 tristate "LZ4 compression algorithm"
1761 select CRYPTO_ALGAPI
1762 select CRYPTO_ACOMP2
1764 select LZ4_DECOMPRESS
1766 This is the LZ4 algorithm.
1769 tristate "LZ4HC compression algorithm"
1770 select CRYPTO_ALGAPI
1771 select CRYPTO_ACOMP2
1772 select LZ4HC_COMPRESS
1773 select LZ4_DECOMPRESS
1775 This is the LZ4 high compression mode algorithm.
1778 tristate "Zstd compression algorithm"
1779 select CRYPTO_ALGAPI
1780 select CRYPTO_ACOMP2
1781 select ZSTD_COMPRESS
1782 select ZSTD_DECOMPRESS
1784 This is the zstd algorithm.
1786 comment "Random Number Generation"
1788 config CRYPTO_ANSI_CPRNG
1789 tristate "Pseudo Random Number Generation for Cryptographic modules"
1793 This option enables the generic pseudo random number generator
1794 for cryptographic modules. Uses the Algorithm specified in
1795 ANSI X9.31 A.2.4. Note that this option must be enabled if
1796 CRYPTO_FIPS is selected
1798 menuconfig CRYPTO_DRBG_MENU
1799 tristate "NIST SP800-90A DRBG"
1801 NIST SP800-90A compliant DRBG. In the following submenu, one or
1802 more of the DRBG types must be selected.
1806 config CRYPTO_DRBG_HMAC
1810 select CRYPTO_SHA256
1812 config CRYPTO_DRBG_HASH
1813 bool "Enable Hash DRBG"
1814 select CRYPTO_SHA256
1816 Enable the Hash DRBG variant as defined in NIST SP800-90A.
1818 config CRYPTO_DRBG_CTR
1819 bool "Enable CTR DRBG"
1823 Enable the CTR DRBG variant as defined in NIST SP800-90A.
1827 default CRYPTO_DRBG_MENU
1829 select CRYPTO_JITTERENTROPY
1831 endif # if CRYPTO_DRBG_MENU
1833 config CRYPTO_JITTERENTROPY
1834 tristate "Jitterentropy Non-Deterministic Random Number Generator"
1837 The Jitterentropy RNG is a noise that is intended
1838 to provide seed to another RNG. The RNG does not
1839 perform any cryptographic whitening of the generated
1840 random numbers. This Jitterentropy RNG registers with
1841 the kernel crypto API and can be used by any caller.
1843 config CRYPTO_USER_API
1846 config CRYPTO_USER_API_HASH
1847 tristate "User-space interface for hash algorithms"
1850 select CRYPTO_USER_API
1852 This option enables the user-spaces interface for hash
1855 config CRYPTO_USER_API_SKCIPHER
1856 tristate "User-space interface for symmetric key cipher algorithms"
1858 select CRYPTO_SKCIPHER
1859 select CRYPTO_USER_API
1861 This option enables the user-spaces interface for symmetric
1862 key cipher algorithms.
1864 config CRYPTO_USER_API_RNG
1865 tristate "User-space interface for random number generator algorithms"
1868 select CRYPTO_USER_API
1870 This option enables the user-spaces interface for random
1871 number generator algorithms.
1873 config CRYPTO_USER_API_AEAD
1874 tristate "User-space interface for AEAD cipher algorithms"
1877 select CRYPTO_SKCIPHER
1879 select CRYPTO_USER_API
1881 This option enables the user-spaces interface for AEAD
1885 bool "Crypto usage statistics for User-space"
1886 depends on CRYPTO_USER
1888 This option enables the gathering of crypto stats.
1890 - encrypt/decrypt size and numbers of symmeric operations
1891 - compress/decompress size and numbers of compress operations
1892 - size and numbers of hash operations
1893 - encrypt/decrypt/sign/verify numbers for asymmetric operations
1894 - generate/seed numbers for rng operations
1896 config CRYPTO_HASH_INFO
1899 source "lib/crypto/Kconfig"
1900 source "drivers/crypto/Kconfig"
1901 source "crypto/asymmetric_keys/Kconfig"
1902 source "certs/Kconfig"