1 # SPDX-License-Identifier: GPL-2.0
3 # Generic algorithms support
9 # async_tx api: hardware offloaded memory transfer/transform support
11 source "crypto/async_tx/Kconfig"
14 # Cryptographic API Configuration
17 tristate "Cryptographic API"
19 This option provides the core Cryptographic API.
23 comment "Crypto core or helper"
26 bool "FIPS 200 compliance"
27 depends on (CRYPTO_ANSI_CPRNG || CRYPTO_DRBG) && !CRYPTO_MANAGER_DISABLE_TESTS
28 depends on (MODULE_SIG || !MODULES)
30 This option enables the fips boot option which is
31 required if you want the system to operate in a FIPS 200
32 certification. You should say no unless you know what
39 This option provides the API for cryptographic algorithms.
55 config CRYPTO_SKCIPHER
57 select CRYPTO_SKCIPHER2
60 config CRYPTO_SKCIPHER2
83 config CRYPTO_RNG_DEFAULT
85 select CRYPTO_DRBG_MENU
87 config CRYPTO_AKCIPHER2
91 config CRYPTO_AKCIPHER
93 select CRYPTO_AKCIPHER2
107 select CRYPTO_ALGAPI2
115 config CRYPTO_MANAGER
116 tristate "Cryptographic algorithm manager"
117 select CRYPTO_MANAGER2
119 Create default cryptographic template instantiations such as
122 config CRYPTO_MANAGER2
123 def_tristate CRYPTO_MANAGER || (CRYPTO_MANAGER!=n && CRYPTO_ALGAPI=y)
126 select CRYPTO_SKCIPHER2
127 select CRYPTO_AKCIPHER2
132 tristate "Userspace cryptographic algorithm configuration"
134 select CRYPTO_MANAGER
136 Userspace configuration for cryptographic instantiations such as
139 config CRYPTO_MANAGER_DISABLE_TESTS
140 bool "Disable run-time self tests"
143 Disable run-time self tests that normally take place at
144 algorithm registration.
146 config CRYPTO_MANAGER_EXTRA_TESTS
147 bool "Enable extra run-time crypto self tests"
148 depends on DEBUG_KERNEL && !CRYPTO_MANAGER_DISABLE_TESTS && CRYPTO_MANAGER
150 Enable extra run-time self tests of registered crypto algorithms,
151 including randomized fuzz tests.
153 This is intended for developer use only, as these tests take much
154 longer to run than the normal self tests.
156 config CRYPTO_GF128MUL
160 tristate "Null algorithms"
163 These are 'Null' algorithms, used by IPsec, which do nothing.
167 select CRYPTO_ALGAPI2
168 select CRYPTO_SKCIPHER2
172 tristate "Parallel crypto engine"
175 select CRYPTO_MANAGER
178 This converts an arbitrary crypto algorithm into a parallel
179 algorithm that executes in kernel threads.
182 tristate "Software async crypto daemon"
183 select CRYPTO_SKCIPHER
185 select CRYPTO_MANAGER
187 This is a generic software asynchronous crypto daemon that
188 converts an arbitrary synchronous software crypto algorithm
189 into an asynchronous algorithm that executes in a kernel thread.
191 config CRYPTO_AUTHENC
192 tristate "Authenc support"
194 select CRYPTO_SKCIPHER
195 select CRYPTO_MANAGER
199 Authenc: Combined mode wrapper for IPsec.
200 This is required for IPSec.
203 tristate "Testing module"
204 depends on m || EXPERT
205 select CRYPTO_MANAGER
207 Quick & dirty crypto test module.
216 comment "Public-key cryptography"
219 tristate "RSA algorithm"
220 select CRYPTO_AKCIPHER
221 select CRYPTO_MANAGER
225 Generic implementation of the RSA public key algorithm.
228 tristate "Diffie-Hellman algorithm"
232 Generic implementation of the Diffie-Hellman algorithm.
238 tristate "ECDH algorithm"
241 select CRYPTO_RNG_DEFAULT
243 Generic implementation of the ECDH algorithm
246 tristate "EC-RDSA (GOST 34.10) algorithm"
248 select CRYPTO_AKCIPHER
249 select CRYPTO_STREEBOG
253 Elliptic Curve Russian Digital Signature Algorithm (GOST R 34.10-2012,
254 RFC 7091, ISO/IEC 14888-3:2018) is one of the Russian cryptographic
255 standard algorithms (called GOST algorithms). Only signature verification
259 tristate "SM2 algorithm"
261 select CRYPTO_AKCIPHER
262 select CRYPTO_MANAGER
266 Generic implementation of the SM2 public key algorithm. It was
267 published by State Encryption Management Bureau, China.
268 as specified by OSCCA GM/T 0003.1-2012 -- 0003.5-2012.
271 https://tools.ietf.org/html/draft-shen-sm2-ecdsa-02
272 http://www.oscca.gov.cn/sca/xxgk/2010-12/17/content_1002386.shtml
273 http://www.gmbz.org.cn/main/bzlb.html
275 config CRYPTO_CURVE25519
276 tristate "Curve25519 algorithm"
278 select CRYPTO_LIB_CURVE25519_GENERIC
280 config CRYPTO_CURVE25519_X86
281 tristate "x86_64 accelerated Curve25519 scalar multiplication library"
282 depends on X86 && 64BIT
283 select CRYPTO_LIB_CURVE25519_GENERIC
284 select CRYPTO_ARCH_HAVE_LIB_CURVE25519
286 comment "Authenticated Encryption with Associated Data"
289 tristate "CCM support"
293 select CRYPTO_MANAGER
295 Support for Counter with CBC MAC. Required for IPsec.
298 tristate "GCM/GMAC support"
303 select CRYPTO_MANAGER
305 Support for Galois/Counter Mode (GCM) and Galois Message
306 Authentication Code (GMAC). Required for IPSec.
308 config CRYPTO_CHACHA20POLY1305
309 tristate "ChaCha20-Poly1305 AEAD support"
310 select CRYPTO_CHACHA20
311 select CRYPTO_POLY1305
313 select CRYPTO_MANAGER
315 ChaCha20-Poly1305 AEAD support, RFC7539.
317 Support for the AEAD wrapper using the ChaCha20 stream cipher combined
318 with the Poly1305 authenticator. It is defined in RFC7539 for use in
321 config CRYPTO_AEGIS128
322 tristate "AEGIS-128 AEAD algorithm"
324 select CRYPTO_AES # for AES S-box tables
326 Support for the AEGIS-128 dedicated AEAD algorithm.
328 config CRYPTO_AEGIS128_SIMD
329 bool "Support SIMD acceleration for AEGIS-128"
330 depends on CRYPTO_AEGIS128 && ((ARM || ARM64) && KERNEL_MODE_NEON)
333 config CRYPTO_AEGIS128_AESNI_SSE2
334 tristate "AEGIS-128 AEAD algorithm (x86_64 AESNI+SSE2 implementation)"
335 depends on X86 && 64BIT
339 AESNI+SSE2 implementation of the AEGIS-128 dedicated AEAD algorithm.
342 tristate "Sequence Number IV Generator"
344 select CRYPTO_SKCIPHER
346 select CRYPTO_RNG_DEFAULT
347 select CRYPTO_MANAGER
349 This IV generator generates an IV based on a sequence number by
350 xoring it with a salt. This algorithm is mainly useful for CTR
352 config CRYPTO_ECHAINIV
353 tristate "Encrypted Chain IV Generator"
356 select CRYPTO_RNG_DEFAULT
357 select CRYPTO_MANAGER
359 This IV generator generates an IV based on the encryption of
360 a sequence number xored with a salt. This is the default
363 comment "Block modes"
366 tristate "CBC support"
367 select CRYPTO_SKCIPHER
368 select CRYPTO_MANAGER
370 CBC: Cipher Block Chaining mode
371 This block cipher algorithm is required for IPSec.
374 tristate "CFB support"
375 select CRYPTO_SKCIPHER
376 select CRYPTO_MANAGER
378 CFB: Cipher FeedBack mode
379 This block cipher algorithm is required for TPM2 Cryptography.
382 tristate "CTR support"
383 select CRYPTO_SKCIPHER
384 select CRYPTO_MANAGER
387 This block cipher algorithm is required for IPSec.
390 tristate "CTS support"
391 select CRYPTO_SKCIPHER
392 select CRYPTO_MANAGER
394 CTS: Cipher Text Stealing
395 This is the Cipher Text Stealing mode as described by
396 Section 8 of rfc2040 and referenced by rfc3962
397 (rfc3962 includes errata information in its Appendix A) or
398 CBC-CS3 as defined by NIST in Sp800-38A addendum from Oct 2010.
399 This mode is required for Kerberos gss mechanism support
402 See: https://csrc.nist.gov/publications/detail/sp/800-38a/addendum/final
405 tristate "ECB support"
406 select CRYPTO_SKCIPHER
407 select CRYPTO_MANAGER
409 ECB: Electronic CodeBook mode
410 This is the simplest block cipher algorithm. It simply encrypts
411 the input block by block.
414 tristate "LRW support"
415 select CRYPTO_SKCIPHER
416 select CRYPTO_MANAGER
417 select CRYPTO_GF128MUL
419 LRW: Liskov Rivest Wagner, a tweakable, non malleable, non movable
420 narrow block cipher mode for dm-crypt. Use it with cipher
421 specification string aes-lrw-benbi, the key must be 256, 320 or 384.
422 The first 128, 192 or 256 bits in the key are used for AES and the
423 rest is used to tie each cipher block to its logical position.
426 tristate "OFB support"
427 select CRYPTO_SKCIPHER
428 select CRYPTO_MANAGER
430 OFB: the Output Feedback mode makes a block cipher into a synchronous
431 stream cipher. It generates keystream blocks, which are then XORed
432 with the plaintext blocks to get the ciphertext. Flipping a bit in the
433 ciphertext produces a flipped bit in the plaintext at the same
434 location. This property allows many error correcting codes to function
435 normally even when applied before encryption.
438 tristate "PCBC support"
439 select CRYPTO_SKCIPHER
440 select CRYPTO_MANAGER
442 PCBC: Propagating Cipher Block Chaining mode
443 This block cipher algorithm is required for RxRPC.
446 tristate "XTS support"
447 select CRYPTO_SKCIPHER
448 select CRYPTO_MANAGER
451 XTS: IEEE1619/D16 narrow block cipher use with aes-xts-plain,
452 key size 256, 384 or 512 bits. This implementation currently
453 can't handle a sectorsize which is not a multiple of 16 bytes.
455 config CRYPTO_KEYWRAP
456 tristate "Key wrapping support"
457 select CRYPTO_SKCIPHER
458 select CRYPTO_MANAGER
460 Support for key wrapping (NIST SP800-38F / RFC3394) without
463 config CRYPTO_NHPOLY1305
466 select CRYPTO_LIB_POLY1305_GENERIC
468 config CRYPTO_NHPOLY1305_SSE2
469 tristate "NHPoly1305 hash function (x86_64 SSE2 implementation)"
470 depends on X86 && 64BIT
471 select CRYPTO_NHPOLY1305
473 SSE2 optimized implementation of the hash function used by the
474 Adiantum encryption mode.
476 config CRYPTO_NHPOLY1305_AVX2
477 tristate "NHPoly1305 hash function (x86_64 AVX2 implementation)"
478 depends on X86 && 64BIT
479 select CRYPTO_NHPOLY1305
481 AVX2 optimized implementation of the hash function used by the
482 Adiantum encryption mode.
484 config CRYPTO_ADIANTUM
485 tristate "Adiantum support"
486 select CRYPTO_CHACHA20
487 select CRYPTO_LIB_POLY1305_GENERIC
488 select CRYPTO_NHPOLY1305
489 select CRYPTO_MANAGER
491 Adiantum is a tweakable, length-preserving encryption mode
492 designed for fast and secure disk encryption, especially on
493 CPUs without dedicated crypto instructions. It encrypts
494 each sector using the XChaCha12 stream cipher, two passes of
495 an ε-almost-∆-universal hash function, and an invocation of
496 the AES-256 block cipher on a single 16-byte block. On CPUs
497 without AES instructions, Adiantum is much faster than
500 Adiantum's security is provably reducible to that of its
501 underlying stream and block ciphers, subject to a security
502 bound. Unlike XTS, Adiantum is a true wide-block encryption
503 mode, so it actually provides an even stronger notion of
504 security than XTS, subject to the security bound.
509 tristate "ESSIV support for block encryption"
510 select CRYPTO_AUTHENC
512 Encrypted salt-sector initialization vector (ESSIV) is an IV
513 generation method that is used in some cases by fscrypt and/or
514 dm-crypt. It uses the hash of the block encryption key as the
515 symmetric key for a block encryption pass applied to the input
516 IV, making low entropy IV sources more suitable for block
519 This driver implements a crypto API template that can be
520 instantiated either as an skcipher or as an AEAD (depending on the
521 type of the first template argument), and which defers encryption
522 and decryption requests to the encapsulated cipher after applying
523 ESSIV to the input IV. Note that in the AEAD case, it is assumed
524 that the keys are presented in the same format used by the authenc
525 template, and that the IV appears at the end of the authenticated
526 associated data (AAD) region (which is how dm-crypt uses it.)
528 Note that the use of ESSIV is not recommended for new deployments,
529 and so this only needs to be enabled when interoperability with
530 existing encrypted volumes of filesystems is required, or when
531 building for a particular system that requires it (e.g., when
532 the SoC in question has accelerated CBC but not XTS, making CBC
533 combined with ESSIV the only feasible mode for h/w accelerated
539 tristate "CMAC support"
541 select CRYPTO_MANAGER
543 Cipher-based Message Authentication Code (CMAC) specified by
544 The National Institute of Standards and Technology (NIST).
546 https://tools.ietf.org/html/rfc4493
547 http://csrc.nist.gov/publications/nistpubs/800-38B/SP_800-38B.pdf
550 tristate "HMAC support"
552 select CRYPTO_MANAGER
554 HMAC: Keyed-Hashing for Message Authentication (RFC2104).
555 This is required for IPSec.
558 tristate "XCBC support"
560 select CRYPTO_MANAGER
562 XCBC: Keyed-Hashing with encryption algorithm
563 https://www.ietf.org/rfc/rfc3566.txt
564 http://csrc.nist.gov/encryption/modes/proposedmodes/
565 xcbc-mac/xcbc-mac-spec.pdf
568 tristate "VMAC support"
570 select CRYPTO_MANAGER
572 VMAC is a message authentication algorithm designed for
573 very high speed on 64-bit architectures.
576 <https://fastcrypto.org/vmac>
581 tristate "CRC32c CRC algorithm"
585 Castagnoli, et al Cyclic Redundancy-Check Algorithm. Used
586 by iSCSI for header and data digests and by others.
587 See Castagnoli93. Module will be crc32c.
589 config CRYPTO_CRC32C_INTEL
590 tristate "CRC32c INTEL hardware acceleration"
594 In Intel processor with SSE4.2 supported, the processor will
595 support CRC32C implementation using hardware accelerated CRC32
596 instruction. This option will create 'crc32c-intel' module,
597 which will enable any routine to use the CRC32 instruction to
598 gain performance compared with software implementation.
599 Module will be crc32c-intel.
601 config CRYPTO_CRC32C_VPMSUM
602 tristate "CRC32c CRC algorithm (powerpc64)"
603 depends on PPC64 && ALTIVEC
607 CRC32c algorithm implemented using vector polynomial multiply-sum
608 (vpmsum) instructions, introduced in POWER8. Enable on POWER8
609 and newer processors for improved performance.
612 config CRYPTO_CRC32C_SPARC64
613 tristate "CRC32c CRC algorithm (SPARC64)"
618 CRC32c CRC algorithm implemented using sparc64 crypto instructions,
622 tristate "CRC32 CRC algorithm"
626 CRC-32-IEEE 802.3 cyclic redundancy-check algorithm.
627 Shash crypto api wrappers to crc32_le function.
629 config CRYPTO_CRC32_PCLMUL
630 tristate "CRC32 PCLMULQDQ hardware acceleration"
635 From Intel Westmere and AMD Bulldozer processor with SSE4.2
636 and PCLMULQDQ supported, the processor will support
637 CRC32 PCLMULQDQ implementation using hardware accelerated PCLMULQDQ
638 instruction. This option will create 'crc32-pclmul' module,
639 which will enable any routine to use the CRC-32-IEEE 802.3 checksum
640 and gain better performance as compared with the table implementation.
642 config CRYPTO_CRC32_MIPS
643 tristate "CRC32c and CRC32 CRC algorithm (MIPS)"
644 depends on MIPS_CRC_SUPPORT
647 CRC32c and CRC32 CRC algorithms implemented using mips crypto
648 instructions, when available.
652 tristate "xxHash hash algorithm"
656 xxHash non-cryptographic hash algorithm. Extremely fast, working at
657 speeds close to RAM limits.
659 config CRYPTO_BLAKE2B
660 tristate "BLAKE2b digest algorithm"
663 Implementation of cryptographic hash function BLAKE2b (or just BLAKE2),
664 optimized for 64bit platforms and can produce digests of any size
665 between 1 to 64. The keyed hash is also implemented.
667 This module provides the following algorithms:
674 See https://blake2.net for further information.
676 config CRYPTO_BLAKE2S
677 tristate "BLAKE2s digest algorithm"
678 select CRYPTO_LIB_BLAKE2S_GENERIC
681 Implementation of cryptographic hash function BLAKE2s
682 optimized for 8-32bit platforms and can produce digests of any size
683 between 1 to 32. The keyed hash is also implemented.
685 This module provides the following algorithms:
692 See https://blake2.net for further information.
694 config CRYPTO_BLAKE2S_X86
695 tristate "BLAKE2s digest algorithm (x86 accelerated version)"
696 depends on X86 && 64BIT
697 select CRYPTO_LIB_BLAKE2S_GENERIC
698 select CRYPTO_ARCH_HAVE_LIB_BLAKE2S
700 config CRYPTO_CRCT10DIF
701 tristate "CRCT10DIF algorithm"
704 CRC T10 Data Integrity Field computation is being cast as
705 a crypto transform. This allows for faster crc t10 diff
706 transforms to be used if they are available.
708 config CRYPTO_CRCT10DIF_PCLMUL
709 tristate "CRCT10DIF PCLMULQDQ hardware acceleration"
710 depends on X86 && 64BIT && CRC_T10DIF
713 For x86_64 processors with SSE4.2 and PCLMULQDQ supported,
714 CRC T10 DIF PCLMULQDQ computation can be hardware
715 accelerated PCLMULQDQ instruction. This option will create
716 'crct10dif-pclmul' module, which is faster when computing the
717 crct10dif checksum as compared with the generic table implementation.
719 config CRYPTO_CRCT10DIF_VPMSUM
720 tristate "CRC32T10DIF powerpc64 hardware acceleration"
721 depends on PPC64 && ALTIVEC && CRC_T10DIF
724 CRC10T10DIF algorithm implemented using vector polynomial
725 multiply-sum (vpmsum) instructions, introduced in POWER8. Enable on
726 POWER8 and newer processors for improved performance.
728 config CRYPTO_VPMSUM_TESTER
729 tristate "Powerpc64 vpmsum hardware acceleration tester"
730 depends on CRYPTO_CRCT10DIF_VPMSUM && CRYPTO_CRC32C_VPMSUM
732 Stress test for CRC32c and CRC-T10DIF algorithms implemented with
733 POWER8 vpmsum instructions.
734 Unless you are testing these algorithms, you don't need this.
737 tristate "GHASH hash function"
738 select CRYPTO_GF128MUL
741 GHASH is the hash function used in GCM (Galois/Counter Mode).
742 It is not a general-purpose cryptographic hash function.
744 config CRYPTO_POLY1305
745 tristate "Poly1305 authenticator algorithm"
747 select CRYPTO_LIB_POLY1305_GENERIC
749 Poly1305 authenticator algorithm, RFC7539.
751 Poly1305 is an authenticator algorithm designed by Daniel J. Bernstein.
752 It is used for the ChaCha20-Poly1305 AEAD, specified in RFC7539 for use
753 in IETF protocols. This is the portable C implementation of Poly1305.
755 config CRYPTO_POLY1305_X86_64
756 tristate "Poly1305 authenticator algorithm (x86_64/SSE2/AVX2)"
757 depends on X86 && 64BIT
758 select CRYPTO_LIB_POLY1305_GENERIC
759 select CRYPTO_ARCH_HAVE_LIB_POLY1305
761 Poly1305 authenticator algorithm, RFC7539.
763 Poly1305 is an authenticator algorithm designed by Daniel J. Bernstein.
764 It is used for the ChaCha20-Poly1305 AEAD, specified in RFC7539 for use
765 in IETF protocols. This is the x86_64 assembler implementation using SIMD
768 config CRYPTO_POLY1305_MIPS
769 tristate "Poly1305 authenticator algorithm (MIPS optimized)"
770 depends on CPU_MIPS32 || (CPU_MIPS64 && 64BIT)
771 select CRYPTO_ARCH_HAVE_LIB_POLY1305
774 tristate "MD4 digest algorithm"
777 MD4 message digest algorithm (RFC1320).
780 tristate "MD5 digest algorithm"
783 MD5 message digest algorithm (RFC1321).
785 config CRYPTO_MD5_OCTEON
786 tristate "MD5 digest algorithm (OCTEON)"
787 depends on CPU_CAVIUM_OCTEON
791 MD5 message digest algorithm (RFC1321) implemented
792 using OCTEON crypto instructions, when available.
794 config CRYPTO_MD5_PPC
795 tristate "MD5 digest algorithm (PPC)"
799 MD5 message digest algorithm (RFC1321) implemented
802 config CRYPTO_MD5_SPARC64
803 tristate "MD5 digest algorithm (SPARC64)"
808 MD5 message digest algorithm (RFC1321) implemented
809 using sparc64 crypto instructions, when available.
811 config CRYPTO_MICHAEL_MIC
812 tristate "Michael MIC keyed digest algorithm"
815 Michael MIC is used for message integrity protection in TKIP
816 (IEEE 802.11i). This algorithm is required for TKIP, but it
817 should not be used for other purposes because of the weakness
821 tristate "RIPEMD-160 digest algorithm"
824 RIPEMD-160 (ISO/IEC 10118-3:2004).
826 RIPEMD-160 is a 160-bit cryptographic hash function. It is intended
827 to be used as a secure replacement for the 128-bit hash functions
828 MD4, MD5 and it's predecessor RIPEMD
829 (not to be confused with RIPEMD-128).
831 It's speed is comparable to SHA1 and there are no known attacks
834 Developed by Hans Dobbertin, Antoon Bosselaers and Bart Preneel.
835 See <https://homes.esat.kuleuven.be/~bosselae/ripemd160.html>
838 tristate "SHA1 digest algorithm"
841 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2).
843 config CRYPTO_SHA1_SSSE3
844 tristate "SHA1 digest algorithm (SSSE3/AVX/AVX2/SHA-NI)"
845 depends on X86 && 64BIT
849 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2) implemented
850 using Supplemental SSE3 (SSSE3) instructions or Advanced Vector
851 Extensions (AVX/AVX2) or SHA-NI(SHA Extensions New Instructions),
854 config CRYPTO_SHA256_SSSE3
855 tristate "SHA256 digest algorithm (SSSE3/AVX/AVX2/SHA-NI)"
856 depends on X86 && 64BIT
860 SHA-256 secure hash standard (DFIPS 180-2) implemented
861 using Supplemental SSE3 (SSSE3) instructions, or Advanced Vector
862 Extensions version 1 (AVX1), or Advanced Vector Extensions
863 version 2 (AVX2) instructions, or SHA-NI (SHA Extensions New
864 Instructions) when available.
866 config CRYPTO_SHA512_SSSE3
867 tristate "SHA512 digest algorithm (SSSE3/AVX/AVX2)"
868 depends on X86 && 64BIT
872 SHA-512 secure hash standard (DFIPS 180-2) implemented
873 using Supplemental SSE3 (SSSE3) instructions, or Advanced Vector
874 Extensions version 1 (AVX1), or Advanced Vector Extensions
875 version 2 (AVX2) instructions, when available.
877 config CRYPTO_SHA1_OCTEON
878 tristate "SHA1 digest algorithm (OCTEON)"
879 depends on CPU_CAVIUM_OCTEON
883 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2) implemented
884 using OCTEON crypto instructions, when available.
886 config CRYPTO_SHA1_SPARC64
887 tristate "SHA1 digest algorithm (SPARC64)"
892 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2) implemented
893 using sparc64 crypto instructions, when available.
895 config CRYPTO_SHA1_PPC
896 tristate "SHA1 digest algorithm (powerpc)"
899 This is the powerpc hardware accelerated implementation of the
900 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2).
902 config CRYPTO_SHA1_PPC_SPE
903 tristate "SHA1 digest algorithm (PPC SPE)"
904 depends on PPC && SPE
906 SHA-1 secure hash standard (DFIPS 180-4) implemented
907 using powerpc SPE SIMD instruction set.
910 tristate "SHA224 and SHA256 digest algorithm"
912 select CRYPTO_LIB_SHA256
914 SHA256 secure hash standard (DFIPS 180-2).
916 This version of SHA implements a 256 bit hash with 128 bits of
917 security against collision attacks.
919 This code also includes SHA-224, a 224 bit hash with 112 bits
920 of security against collision attacks.
922 config CRYPTO_SHA256_PPC_SPE
923 tristate "SHA224 and SHA256 digest algorithm (PPC SPE)"
924 depends on PPC && SPE
928 SHA224 and SHA256 secure hash standard (DFIPS 180-2)
929 implemented using powerpc SPE SIMD instruction set.
931 config CRYPTO_SHA256_OCTEON
932 tristate "SHA224 and SHA256 digest algorithm (OCTEON)"
933 depends on CPU_CAVIUM_OCTEON
937 SHA-256 secure hash standard (DFIPS 180-2) implemented
938 using OCTEON crypto instructions, when available.
940 config CRYPTO_SHA256_SPARC64
941 tristate "SHA224 and SHA256 digest algorithm (SPARC64)"
946 SHA-256 secure hash standard (DFIPS 180-2) implemented
947 using sparc64 crypto instructions, when available.
950 tristate "SHA384 and SHA512 digest algorithms"
953 SHA512 secure hash standard (DFIPS 180-2).
955 This version of SHA implements a 512 bit hash with 256 bits of
956 security against collision attacks.
958 This code also includes SHA-384, a 384 bit hash with 192 bits
959 of security against collision attacks.
961 config CRYPTO_SHA512_OCTEON
962 tristate "SHA384 and SHA512 digest algorithms (OCTEON)"
963 depends on CPU_CAVIUM_OCTEON
967 SHA-512 secure hash standard (DFIPS 180-2) implemented
968 using OCTEON crypto instructions, when available.
970 config CRYPTO_SHA512_SPARC64
971 tristate "SHA384 and SHA512 digest algorithm (SPARC64)"
976 SHA-512 secure hash standard (DFIPS 180-2) implemented
977 using sparc64 crypto instructions, when available.
980 tristate "SHA3 digest algorithm"
983 SHA-3 secure hash standard (DFIPS 202). It's based on
984 cryptographic sponge function family called Keccak.
987 http://keccak.noekeon.org/
990 tristate "SM3 digest algorithm"
993 SM3 secure hash function as defined by OSCCA GM/T 0004-2012 SM3).
994 It is part of the Chinese Commercial Cryptography suite.
997 http://www.oscca.gov.cn/UpFile/20101222141857786.pdf
998 https://datatracker.ietf.org/doc/html/draft-shen-sm3-hash
1000 config CRYPTO_STREEBOG
1001 tristate "Streebog Hash Function"
1004 Streebog Hash Function (GOST R 34.11-2012, RFC 6986) is one of the Russian
1005 cryptographic standard algorithms (called GOST algorithms).
1006 This setting enables two hash algorithms with 256 and 512 bits output.
1009 https://tc26.ru/upload/iblock/fed/feddbb4d26b685903faa2ba11aea43f6.pdf
1010 https://tools.ietf.org/html/rfc6986
1013 tristate "Whirlpool digest algorithms"
1016 Whirlpool hash algorithm 512, 384 and 256-bit hashes
1018 Whirlpool-512 is part of the NESSIE cryptographic primitives.
1019 Whirlpool will be part of the ISO/IEC 10118-3:2003(E) standard
1022 <http://www.larc.usp.br/~pbarreto/WhirlpoolPage.html>
1024 config CRYPTO_GHASH_CLMUL_NI_INTEL
1025 tristate "GHASH hash function (CLMUL-NI accelerated)"
1026 depends on X86 && 64BIT
1027 select CRYPTO_CRYPTD
1029 This is the x86_64 CLMUL-NI accelerated implementation of
1030 GHASH, the hash function used in GCM (Galois/Counter mode).
1035 tristate "AES cipher algorithms"
1036 select CRYPTO_ALGAPI
1037 select CRYPTO_LIB_AES
1039 AES cipher algorithms (FIPS-197). AES uses the Rijndael
1042 Rijndael appears to be consistently a very good performer in
1043 both hardware and software across a wide range of computing
1044 environments regardless of its use in feedback or non-feedback
1045 modes. Its key setup time is excellent, and its key agility is
1046 good. Rijndael's very low memory requirements make it very well
1047 suited for restricted-space environments, in which it also
1048 demonstrates excellent performance. Rijndael's operations are
1049 among the easiest to defend against power and timing attacks.
1051 The AES specifies three key sizes: 128, 192 and 256 bits
1053 See <http://csrc.nist.gov/CryptoToolkit/aes/> for more information.
1055 config CRYPTO_AES_TI
1056 tristate "Fixed time AES cipher"
1057 select CRYPTO_ALGAPI
1058 select CRYPTO_LIB_AES
1060 This is a generic implementation of AES that attempts to eliminate
1061 data dependent latencies as much as possible without affecting
1062 performance too much. It is intended for use by the generic CCM
1063 and GCM drivers, and other CTR or CMAC/XCBC based modes that rely
1064 solely on encryption (although decryption is supported as well, but
1065 with a more dramatic performance hit)
1067 Instead of using 16 lookup tables of 1 KB each, (8 for encryption and
1068 8 for decryption), this implementation only uses just two S-boxes of
1069 256 bytes each, and attempts to eliminate data dependent latencies by
1070 prefetching the entire table into the cache at the start of each
1071 block. Interrupts are also disabled to avoid races where cachelines
1072 are evicted when the CPU is interrupted to do something else.
1074 config CRYPTO_AES_NI_INTEL
1075 tristate "AES cipher algorithms (AES-NI)"
1078 select CRYPTO_LIB_AES
1079 select CRYPTO_ALGAPI
1080 select CRYPTO_SKCIPHER
1083 Use Intel AES-NI instructions for AES algorithm.
1085 AES cipher algorithms (FIPS-197). AES uses the Rijndael
1088 Rijndael appears to be consistently a very good performer in
1089 both hardware and software across a wide range of computing
1090 environments regardless of its use in feedback or non-feedback
1091 modes. Its key setup time is excellent, and its key agility is
1092 good. Rijndael's very low memory requirements make it very well
1093 suited for restricted-space environments, in which it also
1094 demonstrates excellent performance. Rijndael's operations are
1095 among the easiest to defend against power and timing attacks.
1097 The AES specifies three key sizes: 128, 192 and 256 bits
1099 See <http://csrc.nist.gov/encryption/aes/> for more information.
1101 In addition to AES cipher algorithm support, the acceleration
1102 for some popular block cipher mode is supported too, including
1103 ECB, CBC, LRW, XTS. The 64 bit version has additional
1104 acceleration for CTR.
1106 config CRYPTO_AES_SPARC64
1107 tristate "AES cipher algorithms (SPARC64)"
1109 select CRYPTO_SKCIPHER
1111 Use SPARC64 crypto opcodes for AES algorithm.
1113 AES cipher algorithms (FIPS-197). AES uses the Rijndael
1116 Rijndael appears to be consistently a very good performer in
1117 both hardware and software across a wide range of computing
1118 environments regardless of its use in feedback or non-feedback
1119 modes. Its key setup time is excellent, and its key agility is
1120 good. Rijndael's very low memory requirements make it very well
1121 suited for restricted-space environments, in which it also
1122 demonstrates excellent performance. Rijndael's operations are
1123 among the easiest to defend against power and timing attacks.
1125 The AES specifies three key sizes: 128, 192 and 256 bits
1127 See <http://csrc.nist.gov/encryption/aes/> for more information.
1129 In addition to AES cipher algorithm support, the acceleration
1130 for some popular block cipher mode is supported too, including
1133 config CRYPTO_AES_PPC_SPE
1134 tristate "AES cipher algorithms (PPC SPE)"
1135 depends on PPC && SPE
1136 select CRYPTO_SKCIPHER
1138 AES cipher algorithms (FIPS-197). Additionally the acceleration
1139 for popular block cipher modes ECB, CBC, CTR and XTS is supported.
1140 This module should only be used for low power (router) devices
1141 without hardware AES acceleration (e.g. caam crypto). It reduces the
1142 size of the AES tables from 16KB to 8KB + 256 bytes and mitigates
1143 timining attacks. Nevertheless it might be not as secure as other
1144 architecture specific assembler implementations that work on 1KB
1145 tables or 256 bytes S-boxes.
1147 config CRYPTO_ANUBIS
1148 tristate "Anubis cipher algorithm"
1149 depends on CRYPTO_USER_API_ENABLE_OBSOLETE
1150 select CRYPTO_ALGAPI
1152 Anubis cipher algorithm.
1154 Anubis is a variable key length cipher which can use keys from
1155 128 bits to 320 bits in length. It was evaluated as a entrant
1156 in the NESSIE competition.
1159 <https://www.cosic.esat.kuleuven.be/nessie/reports/>
1160 <http://www.larc.usp.br/~pbarreto/AnubisPage.html>
1163 tristate "ARC4 cipher algorithm"
1164 depends on CRYPTO_USER_API_ENABLE_OBSOLETE
1165 select CRYPTO_SKCIPHER
1166 select CRYPTO_LIB_ARC4
1168 ARC4 cipher algorithm.
1170 ARC4 is a stream cipher using keys ranging from 8 bits to 2048
1171 bits in length. This algorithm is required for driver-based
1172 WEP, but it should not be for other purposes because of the
1173 weakness of the algorithm.
1175 config CRYPTO_BLOWFISH
1176 tristate "Blowfish cipher algorithm"
1177 select CRYPTO_ALGAPI
1178 select CRYPTO_BLOWFISH_COMMON
1180 Blowfish cipher algorithm, by Bruce Schneier.
1182 This is a variable key length cipher which can use keys from 32
1183 bits to 448 bits in length. It's fast, simple and specifically
1184 designed for use on "large microprocessors".
1187 <https://www.schneier.com/blowfish.html>
1189 config CRYPTO_BLOWFISH_COMMON
1192 Common parts of the Blowfish cipher algorithm shared by the
1193 generic c and the assembler implementations.
1196 <https://www.schneier.com/blowfish.html>
1198 config CRYPTO_BLOWFISH_X86_64
1199 tristate "Blowfish cipher algorithm (x86_64)"
1200 depends on X86 && 64BIT
1201 select CRYPTO_SKCIPHER
1202 select CRYPTO_BLOWFISH_COMMON
1205 Blowfish cipher algorithm (x86_64), by Bruce Schneier.
1207 This is a variable key length cipher which can use keys from 32
1208 bits to 448 bits in length. It's fast, simple and specifically
1209 designed for use on "large microprocessors".
1212 <https://www.schneier.com/blowfish.html>
1214 config CRYPTO_CAMELLIA
1215 tristate "Camellia cipher algorithms"
1217 select CRYPTO_ALGAPI
1219 Camellia cipher algorithms module.
1221 Camellia is a symmetric key block cipher developed jointly
1222 at NTT and Mitsubishi Electric Corporation.
1224 The Camellia specifies three key sizes: 128, 192 and 256 bits.
1227 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
1229 config CRYPTO_CAMELLIA_X86_64
1230 tristate "Camellia cipher algorithm (x86_64)"
1231 depends on X86 && 64BIT
1233 select CRYPTO_SKCIPHER
1236 Camellia cipher algorithm module (x86_64).
1238 Camellia is a symmetric key block cipher developed jointly
1239 at NTT and Mitsubishi Electric Corporation.
1241 The Camellia specifies three key sizes: 128, 192 and 256 bits.
1244 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
1246 config CRYPTO_CAMELLIA_AESNI_AVX_X86_64
1247 tristate "Camellia cipher algorithm (x86_64/AES-NI/AVX)"
1248 depends on X86 && 64BIT
1250 select CRYPTO_SKCIPHER
1251 select CRYPTO_CAMELLIA_X86_64
1255 Camellia cipher algorithm module (x86_64/AES-NI/AVX).
1257 Camellia is a symmetric key block cipher developed jointly
1258 at NTT and Mitsubishi Electric Corporation.
1260 The Camellia specifies three key sizes: 128, 192 and 256 bits.
1263 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
1265 config CRYPTO_CAMELLIA_AESNI_AVX2_X86_64
1266 tristate "Camellia cipher algorithm (x86_64/AES-NI/AVX2)"
1267 depends on X86 && 64BIT
1269 select CRYPTO_CAMELLIA_AESNI_AVX_X86_64
1271 Camellia cipher algorithm module (x86_64/AES-NI/AVX2).
1273 Camellia is a symmetric key block cipher developed jointly
1274 at NTT and Mitsubishi Electric Corporation.
1276 The Camellia specifies three key sizes: 128, 192 and 256 bits.
1279 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
1281 config CRYPTO_CAMELLIA_SPARC64
1282 tristate "Camellia cipher algorithm (SPARC64)"
1285 select CRYPTO_ALGAPI
1286 select CRYPTO_SKCIPHER
1288 Camellia cipher algorithm module (SPARC64).
1290 Camellia is a symmetric key block cipher developed jointly
1291 at NTT and Mitsubishi Electric Corporation.
1293 The Camellia specifies three key sizes: 128, 192 and 256 bits.
1296 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
1298 config CRYPTO_CAST_COMMON
1301 Common parts of the CAST cipher algorithms shared by the
1302 generic c and the assembler implementations.
1305 tristate "CAST5 (CAST-128) cipher algorithm"
1306 select CRYPTO_ALGAPI
1307 select CRYPTO_CAST_COMMON
1309 The CAST5 encryption algorithm (synonymous with CAST-128) is
1310 described in RFC2144.
1312 config CRYPTO_CAST5_AVX_X86_64
1313 tristate "CAST5 (CAST-128) cipher algorithm (x86_64/AVX)"
1314 depends on X86 && 64BIT
1315 select CRYPTO_SKCIPHER
1317 select CRYPTO_CAST_COMMON
1321 The CAST5 encryption algorithm (synonymous with CAST-128) is
1322 described in RFC2144.
1324 This module provides the Cast5 cipher algorithm that processes
1325 sixteen blocks parallel using the AVX instruction set.
1328 tristate "CAST6 (CAST-256) cipher algorithm"
1329 select CRYPTO_ALGAPI
1330 select CRYPTO_CAST_COMMON
1332 The CAST6 encryption algorithm (synonymous with CAST-256) is
1333 described in RFC2612.
1335 config CRYPTO_CAST6_AVX_X86_64
1336 tristate "CAST6 (CAST-256) cipher algorithm (x86_64/AVX)"
1337 depends on X86 && 64BIT
1338 select CRYPTO_SKCIPHER
1340 select CRYPTO_CAST_COMMON
1345 The CAST6 encryption algorithm (synonymous with CAST-256) is
1346 described in RFC2612.
1348 This module provides the Cast6 cipher algorithm that processes
1349 eight blocks parallel using the AVX instruction set.
1352 tristate "DES and Triple DES EDE cipher algorithms"
1353 select CRYPTO_ALGAPI
1354 select CRYPTO_LIB_DES
1356 DES cipher algorithm (FIPS 46-2), and Triple DES EDE (FIPS 46-3).
1358 config CRYPTO_DES_SPARC64
1359 tristate "DES and Triple DES EDE cipher algorithms (SPARC64)"
1361 select CRYPTO_ALGAPI
1362 select CRYPTO_LIB_DES
1363 select CRYPTO_SKCIPHER
1365 DES cipher algorithm (FIPS 46-2), and Triple DES EDE (FIPS 46-3),
1366 optimized using SPARC64 crypto opcodes.
1368 config CRYPTO_DES3_EDE_X86_64
1369 tristate "Triple DES EDE cipher algorithm (x86-64)"
1370 depends on X86 && 64BIT
1371 select CRYPTO_SKCIPHER
1372 select CRYPTO_LIB_DES
1375 Triple DES EDE (FIPS 46-3) algorithm.
1377 This module provides implementation of the Triple DES EDE cipher
1378 algorithm that is optimized for x86-64 processors. Two versions of
1379 algorithm are provided; regular processing one input block and
1380 one that processes three blocks parallel.
1382 config CRYPTO_FCRYPT
1383 tristate "FCrypt cipher algorithm"
1384 select CRYPTO_ALGAPI
1385 select CRYPTO_SKCIPHER
1387 FCrypt algorithm used by RxRPC.
1389 config CRYPTO_KHAZAD
1390 tristate "Khazad cipher algorithm"
1391 depends on CRYPTO_USER_API_ENABLE_OBSOLETE
1392 select CRYPTO_ALGAPI
1394 Khazad cipher algorithm.
1396 Khazad was a finalist in the initial NESSIE competition. It is
1397 an algorithm optimized for 64-bit processors with good performance
1398 on 32-bit processors. Khazad uses an 128 bit key size.
1401 <http://www.larc.usp.br/~pbarreto/KhazadPage.html>
1403 config CRYPTO_CHACHA20
1404 tristate "ChaCha stream cipher algorithms"
1405 select CRYPTO_LIB_CHACHA_GENERIC
1406 select CRYPTO_SKCIPHER
1408 The ChaCha20, XChaCha20, and XChaCha12 stream cipher algorithms.
1410 ChaCha20 is a 256-bit high-speed stream cipher designed by Daniel J.
1411 Bernstein and further specified in RFC7539 for use in IETF protocols.
1412 This is the portable C implementation of ChaCha20. See also:
1413 <https://cr.yp.to/chacha/chacha-20080128.pdf>
1415 XChaCha20 is the application of the XSalsa20 construction to ChaCha20
1416 rather than to Salsa20. XChaCha20 extends ChaCha20's nonce length
1417 from 64 bits (or 96 bits using the RFC7539 convention) to 192 bits,
1418 while provably retaining ChaCha20's security. See also:
1419 <https://cr.yp.to/snuffle/xsalsa-20081128.pdf>
1421 XChaCha12 is XChaCha20 reduced to 12 rounds, with correspondingly
1422 reduced security margin but increased performance. It can be needed
1423 in some performance-sensitive scenarios.
1425 config CRYPTO_CHACHA20_X86_64
1426 tristate "ChaCha stream cipher algorithms (x86_64/SSSE3/AVX2/AVX-512VL)"
1427 depends on X86 && 64BIT
1428 select CRYPTO_SKCIPHER
1429 select CRYPTO_LIB_CHACHA_GENERIC
1430 select CRYPTO_ARCH_HAVE_LIB_CHACHA
1432 SSSE3, AVX2, and AVX-512VL optimized implementations of the ChaCha20,
1433 XChaCha20, and XChaCha12 stream ciphers.
1435 config CRYPTO_CHACHA_MIPS
1436 tristate "ChaCha stream cipher algorithms (MIPS 32r2 optimized)"
1437 depends on CPU_MIPS32_R2
1438 select CRYPTO_SKCIPHER
1439 select CRYPTO_ARCH_HAVE_LIB_CHACHA
1442 tristate "SEED cipher algorithm"
1443 depends on CRYPTO_USER_API_ENABLE_OBSOLETE
1444 select CRYPTO_ALGAPI
1446 SEED cipher algorithm (RFC4269).
1448 SEED is a 128-bit symmetric key block cipher that has been
1449 developed by KISA (Korea Information Security Agency) as a
1450 national standard encryption algorithm of the Republic of Korea.
1451 It is a 16 round block cipher with the key size of 128 bit.
1454 <http://www.kisa.or.kr/kisa/seed/jsp/seed_eng.jsp>
1456 config CRYPTO_SERPENT
1457 tristate "Serpent cipher algorithm"
1458 select CRYPTO_ALGAPI
1460 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1462 Keys are allowed to be from 0 to 256 bits in length, in steps
1463 of 8 bits. Also includes the 'Tnepres' algorithm, a reversed
1464 variant of Serpent for compatibility with old kerneli.org code.
1467 <https://www.cl.cam.ac.uk/~rja14/serpent.html>
1469 config CRYPTO_SERPENT_SSE2_X86_64
1470 tristate "Serpent cipher algorithm (x86_64/SSE2)"
1471 depends on X86 && 64BIT
1472 select CRYPTO_SKCIPHER
1473 select CRYPTO_SERPENT
1477 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1479 Keys are allowed to be from 0 to 256 bits in length, in steps
1482 This module provides Serpent cipher algorithm that processes eight
1483 blocks parallel using SSE2 instruction set.
1486 <https://www.cl.cam.ac.uk/~rja14/serpent.html>
1488 config CRYPTO_SERPENT_SSE2_586
1489 tristate "Serpent cipher algorithm (i586/SSE2)"
1490 depends on X86 && !64BIT
1491 select CRYPTO_SKCIPHER
1492 select CRYPTO_SERPENT
1496 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1498 Keys are allowed to be from 0 to 256 bits in length, in steps
1501 This module provides Serpent cipher algorithm that processes four
1502 blocks parallel using SSE2 instruction set.
1505 <https://www.cl.cam.ac.uk/~rja14/serpent.html>
1507 config CRYPTO_SERPENT_AVX_X86_64
1508 tristate "Serpent cipher algorithm (x86_64/AVX)"
1509 depends on X86 && 64BIT
1510 select CRYPTO_SKCIPHER
1511 select CRYPTO_SERPENT
1516 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1518 Keys are allowed to be from 0 to 256 bits in length, in steps
1521 This module provides the Serpent cipher algorithm that processes
1522 eight blocks parallel using the AVX instruction set.
1525 <https://www.cl.cam.ac.uk/~rja14/serpent.html>
1527 config CRYPTO_SERPENT_AVX2_X86_64
1528 tristate "Serpent cipher algorithm (x86_64/AVX2)"
1529 depends on X86 && 64BIT
1530 select CRYPTO_SERPENT_AVX_X86_64
1532 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1534 Keys are allowed to be from 0 to 256 bits in length, in steps
1537 This module provides Serpent cipher algorithm that processes 16
1538 blocks parallel using AVX2 instruction set.
1541 <https://www.cl.cam.ac.uk/~rja14/serpent.html>
1544 tristate "SM4 cipher algorithm"
1545 select CRYPTO_ALGAPI
1547 SM4 cipher algorithms (OSCCA GB/T 32907-2016).
1549 SM4 (GBT.32907-2016) is a cryptographic standard issued by the
1550 Organization of State Commercial Administration of China (OSCCA)
1551 as an authorized cryptographic algorithms for the use within China.
1553 SMS4 was originally created for use in protecting wireless
1554 networks, and is mandated in the Chinese National Standard for
1555 Wireless LAN WAPI (Wired Authentication and Privacy Infrastructure)
1558 The latest SM4 standard (GBT.32907-2016) was proposed by OSCCA and
1559 standardized through TC 260 of the Standardization Administration
1560 of the People's Republic of China (SAC).
1562 The input, output, and key of SMS4 are each 128 bits.
1564 See also: <https://eprint.iacr.org/2008/329.pdf>
1569 tristate "TEA, XTEA and XETA cipher algorithms"
1570 depends on CRYPTO_USER_API_ENABLE_OBSOLETE
1571 select CRYPTO_ALGAPI
1573 TEA cipher algorithm.
1575 Tiny Encryption Algorithm is a simple cipher that uses
1576 many rounds for security. It is very fast and uses
1579 Xtendend Tiny Encryption Algorithm is a modification to
1580 the TEA algorithm to address a potential key weakness
1581 in the TEA algorithm.
1583 Xtendend Encryption Tiny Algorithm is a mis-implementation
1584 of the XTEA algorithm for compatibility purposes.
1586 config CRYPTO_TWOFISH
1587 tristate "Twofish cipher algorithm"
1588 select CRYPTO_ALGAPI
1589 select CRYPTO_TWOFISH_COMMON
1591 Twofish cipher algorithm.
1593 Twofish was submitted as an AES (Advanced Encryption Standard)
1594 candidate cipher by researchers at CounterPane Systems. It is a
1595 16 round block cipher supporting key sizes of 128, 192, and 256
1599 <https://www.schneier.com/twofish.html>
1601 config CRYPTO_TWOFISH_COMMON
1604 Common parts of the Twofish cipher algorithm shared by the
1605 generic c and the assembler implementations.
1607 config CRYPTO_TWOFISH_586
1608 tristate "Twofish cipher algorithms (i586)"
1609 depends on (X86 || UML_X86) && !64BIT
1610 select CRYPTO_ALGAPI
1611 select CRYPTO_TWOFISH_COMMON
1614 Twofish cipher algorithm.
1616 Twofish was submitted as an AES (Advanced Encryption Standard)
1617 candidate cipher by researchers at CounterPane Systems. It is a
1618 16 round block cipher supporting key sizes of 128, 192, and 256
1622 <https://www.schneier.com/twofish.html>
1624 config CRYPTO_TWOFISH_X86_64
1625 tristate "Twofish cipher algorithm (x86_64)"
1626 depends on (X86 || UML_X86) && 64BIT
1627 select CRYPTO_ALGAPI
1628 select CRYPTO_TWOFISH_COMMON
1631 Twofish cipher algorithm (x86_64).
1633 Twofish was submitted as an AES (Advanced Encryption Standard)
1634 candidate cipher by researchers at CounterPane Systems. It is a
1635 16 round block cipher supporting key sizes of 128, 192, and 256
1639 <https://www.schneier.com/twofish.html>
1641 config CRYPTO_TWOFISH_X86_64_3WAY
1642 tristate "Twofish cipher algorithm (x86_64, 3-way parallel)"
1643 depends on X86 && 64BIT
1644 select CRYPTO_SKCIPHER
1645 select CRYPTO_TWOFISH_COMMON
1646 select CRYPTO_TWOFISH_X86_64
1648 Twofish cipher algorithm (x86_64, 3-way parallel).
1650 Twofish was submitted as an AES (Advanced Encryption Standard)
1651 candidate cipher by researchers at CounterPane Systems. It is a
1652 16 round block cipher supporting key sizes of 128, 192, and 256
1655 This module provides Twofish cipher algorithm that processes three
1656 blocks parallel, utilizing resources of out-of-order CPUs better.
1659 <https://www.schneier.com/twofish.html>
1661 config CRYPTO_TWOFISH_AVX_X86_64
1662 tristate "Twofish cipher algorithm (x86_64/AVX)"
1663 depends on X86 && 64BIT
1664 select CRYPTO_SKCIPHER
1666 select CRYPTO_TWOFISH_COMMON
1667 select CRYPTO_TWOFISH_X86_64
1668 select CRYPTO_TWOFISH_X86_64_3WAY
1671 Twofish cipher algorithm (x86_64/AVX).
1673 Twofish was submitted as an AES (Advanced Encryption Standard)
1674 candidate cipher by researchers at CounterPane Systems. It is a
1675 16 round block cipher supporting key sizes of 128, 192, and 256
1678 This module provides the Twofish cipher algorithm that processes
1679 eight blocks parallel using the AVX Instruction Set.
1682 <https://www.schneier.com/twofish.html>
1684 comment "Compression"
1686 config CRYPTO_DEFLATE
1687 tristate "Deflate compression algorithm"
1688 select CRYPTO_ALGAPI
1689 select CRYPTO_ACOMP2
1693 This is the Deflate algorithm (RFC1951), specified for use in
1694 IPSec with the IPCOMP protocol (RFC3173, RFC2394).
1696 You will most probably want this if using IPSec.
1699 tristate "LZO compression algorithm"
1700 select CRYPTO_ALGAPI
1701 select CRYPTO_ACOMP2
1703 select LZO_DECOMPRESS
1705 This is the LZO algorithm.
1708 tristate "842 compression algorithm"
1709 select CRYPTO_ALGAPI
1710 select CRYPTO_ACOMP2
1712 select 842_DECOMPRESS
1714 This is the 842 algorithm.
1717 tristate "LZ4 compression algorithm"
1718 select CRYPTO_ALGAPI
1719 select CRYPTO_ACOMP2
1721 select LZ4_DECOMPRESS
1723 This is the LZ4 algorithm.
1726 tristate "LZ4HC compression algorithm"
1727 select CRYPTO_ALGAPI
1728 select CRYPTO_ACOMP2
1729 select LZ4HC_COMPRESS
1730 select LZ4_DECOMPRESS
1732 This is the LZ4 high compression mode algorithm.
1735 tristate "Zstd compression algorithm"
1736 select CRYPTO_ALGAPI
1737 select CRYPTO_ACOMP2
1738 select ZSTD_COMPRESS
1739 select ZSTD_DECOMPRESS
1741 This is the zstd algorithm.
1743 comment "Random Number Generation"
1745 config CRYPTO_ANSI_CPRNG
1746 tristate "Pseudo Random Number Generation for Cryptographic modules"
1750 This option enables the generic pseudo random number generator
1751 for cryptographic modules. Uses the Algorithm specified in
1752 ANSI X9.31 A.2.4. Note that this option must be enabled if
1753 CRYPTO_FIPS is selected
1755 menuconfig CRYPTO_DRBG_MENU
1756 tristate "NIST SP800-90A DRBG"
1758 NIST SP800-90A compliant DRBG. In the following submenu, one or
1759 more of the DRBG types must be selected.
1763 config CRYPTO_DRBG_HMAC
1767 select CRYPTO_SHA256
1769 config CRYPTO_DRBG_HASH
1770 bool "Enable Hash DRBG"
1771 select CRYPTO_SHA256
1773 Enable the Hash DRBG variant as defined in NIST SP800-90A.
1775 config CRYPTO_DRBG_CTR
1776 bool "Enable CTR DRBG"
1780 Enable the CTR DRBG variant as defined in NIST SP800-90A.
1784 default CRYPTO_DRBG_MENU
1786 select CRYPTO_JITTERENTROPY
1788 endif # if CRYPTO_DRBG_MENU
1790 config CRYPTO_JITTERENTROPY
1791 tristate "Jitterentropy Non-Deterministic Random Number Generator"
1794 The Jitterentropy RNG is a noise that is intended
1795 to provide seed to another RNG. The RNG does not
1796 perform any cryptographic whitening of the generated
1797 random numbers. This Jitterentropy RNG registers with
1798 the kernel crypto API and can be used by any caller.
1800 config CRYPTO_USER_API
1803 config CRYPTO_USER_API_HASH
1804 tristate "User-space interface for hash algorithms"
1807 select CRYPTO_USER_API
1809 This option enables the user-spaces interface for hash
1812 config CRYPTO_USER_API_SKCIPHER
1813 tristate "User-space interface for symmetric key cipher algorithms"
1815 select CRYPTO_SKCIPHER
1816 select CRYPTO_USER_API
1818 This option enables the user-spaces interface for symmetric
1819 key cipher algorithms.
1821 config CRYPTO_USER_API_RNG
1822 tristate "User-space interface for random number generator algorithms"
1825 select CRYPTO_USER_API
1827 This option enables the user-spaces interface for random
1828 number generator algorithms.
1830 config CRYPTO_USER_API_RNG_CAVP
1831 bool "Enable CAVP testing of DRBG"
1832 depends on CRYPTO_USER_API_RNG && CRYPTO_DRBG
1834 This option enables extra API for CAVP testing via the user-space
1835 interface: resetting of DRBG entropy, and providing Additional Data.
1836 This should only be enabled for CAVP testing. You should say
1837 no unless you know what this is.
1839 config CRYPTO_USER_API_AEAD
1840 tristate "User-space interface for AEAD cipher algorithms"
1843 select CRYPTO_SKCIPHER
1845 select CRYPTO_USER_API
1847 This option enables the user-spaces interface for AEAD
1850 config CRYPTO_USER_API_ENABLE_OBSOLETE
1851 bool "Enable obsolete cryptographic algorithms for userspace"
1852 depends on CRYPTO_USER_API
1855 Allow obsolete cryptographic algorithms to be selected that have
1856 already been phased out from internal use by the kernel, and are
1857 only useful for userspace clients that still rely on them.
1860 bool "Crypto usage statistics for User-space"
1861 depends on CRYPTO_USER
1863 This option enables the gathering of crypto stats.
1865 - encrypt/decrypt size and numbers of symmeric operations
1866 - compress/decompress size and numbers of compress operations
1867 - size and numbers of hash operations
1868 - encrypt/decrypt/sign/verify numbers for asymmetric operations
1869 - generate/seed numbers for rng operations
1871 config CRYPTO_HASH_INFO
1874 source "lib/crypto/Kconfig"
1875 source "drivers/crypto/Kconfig"
1876 source "crypto/asymmetric_keys/Kconfig"
1877 source "certs/Kconfig"