1 # SPDX-License-Identifier: GPL-2.0
3 # Generic algorithms support
9 # async_tx api: hardware offloaded memory transfer/transform support
11 source "crypto/async_tx/Kconfig"
14 # Cryptographic API Configuration
17 tristate "Cryptographic API"
19 This option provides the core Cryptographic API.
23 comment "Crypto core or helper"
26 bool "FIPS 200 compliance"
27 depends on (CRYPTO_ANSI_CPRNG || CRYPTO_DRBG) && !CRYPTO_MANAGER_DISABLE_TESTS
28 depends on (MODULE_SIG || !MODULES)
30 This option enables the fips boot option which is
31 required if you want the system to operate in a FIPS 200
32 certification. You should say no unless you know what
39 This option provides the API for cryptographic algorithms.
55 config CRYPTO_SKCIPHER
57 select CRYPTO_SKCIPHER2
60 config CRYPTO_SKCIPHER2
83 config CRYPTO_RNG_DEFAULT
85 select CRYPTO_DRBG_MENU
87 config CRYPTO_AKCIPHER2
91 config CRYPTO_AKCIPHER
93 select CRYPTO_AKCIPHER2
107 select CRYPTO_ALGAPI2
115 config CRYPTO_MANAGER
116 tristate "Cryptographic algorithm manager"
117 select CRYPTO_MANAGER2
119 Create default cryptographic template instantiations such as
122 config CRYPTO_MANAGER2
123 def_tristate CRYPTO_MANAGER || (CRYPTO_MANAGER!=n && CRYPTO_ALGAPI=y)
126 select CRYPTO_SKCIPHER2
127 select CRYPTO_AKCIPHER2
132 tristate "Userspace cryptographic algorithm configuration"
134 select CRYPTO_MANAGER
136 Userspace configuration for cryptographic instantiations such as
139 config CRYPTO_MANAGER_DISABLE_TESTS
140 bool "Disable run-time self tests"
143 Disable run-time self tests that normally take place at
144 algorithm registration.
146 config CRYPTO_MANAGER_EXTRA_TESTS
147 bool "Enable extra run-time crypto self tests"
148 depends on DEBUG_KERNEL && !CRYPTO_MANAGER_DISABLE_TESTS && CRYPTO_MANAGER
150 Enable extra run-time self tests of registered crypto algorithms,
151 including randomized fuzz tests.
153 This is intended for developer use only, as these tests take much
154 longer to run than the normal self tests.
156 config CRYPTO_GF128MUL
160 tristate "Null algorithms"
163 These are 'Null' algorithms, used by IPsec, which do nothing.
167 select CRYPTO_ALGAPI2
168 select CRYPTO_SKCIPHER2
172 tristate "Parallel crypto engine"
175 select CRYPTO_MANAGER
178 This converts an arbitrary crypto algorithm into a parallel
179 algorithm that executes in kernel threads.
182 tristate "Software async crypto daemon"
183 select CRYPTO_SKCIPHER
185 select CRYPTO_MANAGER
187 This is a generic software asynchronous crypto daemon that
188 converts an arbitrary synchronous software crypto algorithm
189 into an asynchronous algorithm that executes in a kernel thread.
191 config CRYPTO_AUTHENC
192 tristate "Authenc support"
194 select CRYPTO_SKCIPHER
195 select CRYPTO_MANAGER
199 Authenc: Combined mode wrapper for IPsec.
200 This is required for IPSec.
203 tristate "Testing module"
204 depends on m || EXPERT
205 select CRYPTO_MANAGER
207 Quick & dirty crypto test module.
216 comment "Public-key cryptography"
219 tristate "RSA algorithm"
220 select CRYPTO_AKCIPHER
221 select CRYPTO_MANAGER
225 Generic implementation of the RSA public key algorithm.
228 tristate "Diffie-Hellman algorithm"
232 Generic implementation of the Diffie-Hellman algorithm.
238 tristate "ECDH algorithm"
241 select CRYPTO_RNG_DEFAULT
243 Generic implementation of the ECDH algorithm
246 tristate "ECDSA (NIST P192, P256 etc.) algorithm"
248 select CRYPTO_AKCIPHER
251 Elliptic Curve Digital Signature Algorithm (NIST P192, P256 etc.)
252 is A NIST cryptographic standard algorithm. Only signature verification
256 tristate "EC-RDSA (GOST 34.10) algorithm"
258 select CRYPTO_AKCIPHER
259 select CRYPTO_STREEBOG
263 Elliptic Curve Russian Digital Signature Algorithm (GOST R 34.10-2012,
264 RFC 7091, ISO/IEC 14888-3:2018) is one of the Russian cryptographic
265 standard algorithms (called GOST algorithms). Only signature verification
269 tristate "SM2 algorithm"
271 select CRYPTO_AKCIPHER
272 select CRYPTO_MANAGER
276 Generic implementation of the SM2 public key algorithm. It was
277 published by State Encryption Management Bureau, China.
278 as specified by OSCCA GM/T 0003.1-2012 -- 0003.5-2012.
281 https://tools.ietf.org/html/draft-shen-sm2-ecdsa-02
282 http://www.oscca.gov.cn/sca/xxgk/2010-12/17/content_1002386.shtml
283 http://www.gmbz.org.cn/main/bzlb.html
285 config CRYPTO_CURVE25519
286 tristate "Curve25519 algorithm"
288 select CRYPTO_LIB_CURVE25519_GENERIC
290 config CRYPTO_CURVE25519_X86
291 tristate "x86_64 accelerated Curve25519 scalar multiplication library"
292 depends on X86 && 64BIT
293 select CRYPTO_LIB_CURVE25519_GENERIC
294 select CRYPTO_ARCH_HAVE_LIB_CURVE25519
296 comment "Authenticated Encryption with Associated Data"
299 tristate "CCM support"
303 select CRYPTO_MANAGER
305 Support for Counter with CBC MAC. Required for IPsec.
308 tristate "GCM/GMAC support"
313 select CRYPTO_MANAGER
315 Support for Galois/Counter Mode (GCM) and Galois Message
316 Authentication Code (GMAC). Required for IPSec.
318 config CRYPTO_CHACHA20POLY1305
319 tristate "ChaCha20-Poly1305 AEAD support"
320 select CRYPTO_CHACHA20
321 select CRYPTO_POLY1305
323 select CRYPTO_MANAGER
325 ChaCha20-Poly1305 AEAD support, RFC7539.
327 Support for the AEAD wrapper using the ChaCha20 stream cipher combined
328 with the Poly1305 authenticator. It is defined in RFC7539 for use in
331 config CRYPTO_AEGIS128
332 tristate "AEGIS-128 AEAD algorithm"
334 select CRYPTO_AES # for AES S-box tables
336 Support for the AEGIS-128 dedicated AEAD algorithm.
338 config CRYPTO_AEGIS128_SIMD
339 bool "Support SIMD acceleration for AEGIS-128"
340 depends on CRYPTO_AEGIS128 && ((ARM || ARM64) && KERNEL_MODE_NEON)
343 config CRYPTO_AEGIS128_AESNI_SSE2
344 tristate "AEGIS-128 AEAD algorithm (x86_64 AESNI+SSE2 implementation)"
345 depends on X86 && 64BIT
349 AESNI+SSE2 implementation of the AEGIS-128 dedicated AEAD algorithm.
352 tristate "Sequence Number IV Generator"
354 select CRYPTO_SKCIPHER
356 select CRYPTO_RNG_DEFAULT
357 select CRYPTO_MANAGER
359 This IV generator generates an IV based on a sequence number by
360 xoring it with a salt. This algorithm is mainly useful for CTR
362 config CRYPTO_ECHAINIV
363 tristate "Encrypted Chain IV Generator"
366 select CRYPTO_RNG_DEFAULT
367 select CRYPTO_MANAGER
369 This IV generator generates an IV based on the encryption of
370 a sequence number xored with a salt. This is the default
373 comment "Block modes"
376 tristate "CBC support"
377 select CRYPTO_SKCIPHER
378 select CRYPTO_MANAGER
380 CBC: Cipher Block Chaining mode
381 This block cipher algorithm is required for IPSec.
384 tristate "CFB support"
385 select CRYPTO_SKCIPHER
386 select CRYPTO_MANAGER
388 CFB: Cipher FeedBack mode
389 This block cipher algorithm is required for TPM2 Cryptography.
392 tristate "CTR support"
393 select CRYPTO_SKCIPHER
394 select CRYPTO_MANAGER
397 This block cipher algorithm is required for IPSec.
400 tristate "CTS support"
401 select CRYPTO_SKCIPHER
402 select CRYPTO_MANAGER
404 CTS: Cipher Text Stealing
405 This is the Cipher Text Stealing mode as described by
406 Section 8 of rfc2040 and referenced by rfc3962
407 (rfc3962 includes errata information in its Appendix A) or
408 CBC-CS3 as defined by NIST in Sp800-38A addendum from Oct 2010.
409 This mode is required for Kerberos gss mechanism support
412 See: https://csrc.nist.gov/publications/detail/sp/800-38a/addendum/final
415 tristate "ECB support"
416 select CRYPTO_SKCIPHER
417 select CRYPTO_MANAGER
419 ECB: Electronic CodeBook mode
420 This is the simplest block cipher algorithm. It simply encrypts
421 the input block by block.
424 tristate "LRW support"
425 select CRYPTO_SKCIPHER
426 select CRYPTO_MANAGER
427 select CRYPTO_GF128MUL
429 LRW: Liskov Rivest Wagner, a tweakable, non malleable, non movable
430 narrow block cipher mode for dm-crypt. Use it with cipher
431 specification string aes-lrw-benbi, the key must be 256, 320 or 384.
432 The first 128, 192 or 256 bits in the key are used for AES and the
433 rest is used to tie each cipher block to its logical position.
436 tristate "OFB support"
437 select CRYPTO_SKCIPHER
438 select CRYPTO_MANAGER
440 OFB: the Output Feedback mode makes a block cipher into a synchronous
441 stream cipher. It generates keystream blocks, which are then XORed
442 with the plaintext blocks to get the ciphertext. Flipping a bit in the
443 ciphertext produces a flipped bit in the plaintext at the same
444 location. This property allows many error correcting codes to function
445 normally even when applied before encryption.
448 tristate "PCBC support"
449 select CRYPTO_SKCIPHER
450 select CRYPTO_MANAGER
452 PCBC: Propagating Cipher Block Chaining mode
453 This block cipher algorithm is required for RxRPC.
456 tristate "XTS support"
457 select CRYPTO_SKCIPHER
458 select CRYPTO_MANAGER
461 XTS: IEEE1619/D16 narrow block cipher use with aes-xts-plain,
462 key size 256, 384 or 512 bits. This implementation currently
463 can't handle a sectorsize which is not a multiple of 16 bytes.
465 config CRYPTO_KEYWRAP
466 tristate "Key wrapping support"
467 select CRYPTO_SKCIPHER
468 select CRYPTO_MANAGER
470 Support for key wrapping (NIST SP800-38F / RFC3394) without
473 config CRYPTO_NHPOLY1305
476 select CRYPTO_LIB_POLY1305_GENERIC
478 config CRYPTO_NHPOLY1305_SSE2
479 tristate "NHPoly1305 hash function (x86_64 SSE2 implementation)"
480 depends on X86 && 64BIT
481 select CRYPTO_NHPOLY1305
483 SSE2 optimized implementation of the hash function used by the
484 Adiantum encryption mode.
486 config CRYPTO_NHPOLY1305_AVX2
487 tristate "NHPoly1305 hash function (x86_64 AVX2 implementation)"
488 depends on X86 && 64BIT
489 select CRYPTO_NHPOLY1305
491 AVX2 optimized implementation of the hash function used by the
492 Adiantum encryption mode.
494 config CRYPTO_ADIANTUM
495 tristate "Adiantum support"
496 select CRYPTO_CHACHA20
497 select CRYPTO_LIB_POLY1305_GENERIC
498 select CRYPTO_NHPOLY1305
499 select CRYPTO_MANAGER
501 Adiantum is a tweakable, length-preserving encryption mode
502 designed for fast and secure disk encryption, especially on
503 CPUs without dedicated crypto instructions. It encrypts
504 each sector using the XChaCha12 stream cipher, two passes of
505 an ε-almost-∆-universal hash function, and an invocation of
506 the AES-256 block cipher on a single 16-byte block. On CPUs
507 without AES instructions, Adiantum is much faster than
510 Adiantum's security is provably reducible to that of its
511 underlying stream and block ciphers, subject to a security
512 bound. Unlike XTS, Adiantum is a true wide-block encryption
513 mode, so it actually provides an even stronger notion of
514 security than XTS, subject to the security bound.
519 tristate "ESSIV support for block encryption"
520 select CRYPTO_AUTHENC
522 Encrypted salt-sector initialization vector (ESSIV) is an IV
523 generation method that is used in some cases by fscrypt and/or
524 dm-crypt. It uses the hash of the block encryption key as the
525 symmetric key for a block encryption pass applied to the input
526 IV, making low entropy IV sources more suitable for block
529 This driver implements a crypto API template that can be
530 instantiated either as an skcipher or as an AEAD (depending on the
531 type of the first template argument), and which defers encryption
532 and decryption requests to the encapsulated cipher after applying
533 ESSIV to the input IV. Note that in the AEAD case, it is assumed
534 that the keys are presented in the same format used by the authenc
535 template, and that the IV appears at the end of the authenticated
536 associated data (AAD) region (which is how dm-crypt uses it.)
538 Note that the use of ESSIV is not recommended for new deployments,
539 and so this only needs to be enabled when interoperability with
540 existing encrypted volumes of filesystems is required, or when
541 building for a particular system that requires it (e.g., when
542 the SoC in question has accelerated CBC but not XTS, making CBC
543 combined with ESSIV the only feasible mode for h/w accelerated
549 tristate "CMAC support"
551 select CRYPTO_MANAGER
553 Cipher-based Message Authentication Code (CMAC) specified by
554 The National Institute of Standards and Technology (NIST).
556 https://tools.ietf.org/html/rfc4493
557 http://csrc.nist.gov/publications/nistpubs/800-38B/SP_800-38B.pdf
560 tristate "HMAC support"
562 select CRYPTO_MANAGER
564 HMAC: Keyed-Hashing for Message Authentication (RFC2104).
565 This is required for IPSec.
568 tristate "XCBC support"
570 select CRYPTO_MANAGER
572 XCBC: Keyed-Hashing with encryption algorithm
573 https://www.ietf.org/rfc/rfc3566.txt
574 http://csrc.nist.gov/encryption/modes/proposedmodes/
575 xcbc-mac/xcbc-mac-spec.pdf
578 tristate "VMAC support"
580 select CRYPTO_MANAGER
582 VMAC is a message authentication algorithm designed for
583 very high speed on 64-bit architectures.
586 <https://fastcrypto.org/vmac>
591 tristate "CRC32c CRC algorithm"
595 Castagnoli, et al Cyclic Redundancy-Check Algorithm. Used
596 by iSCSI for header and data digests and by others.
597 See Castagnoli93. Module will be crc32c.
599 config CRYPTO_CRC32C_INTEL
600 tristate "CRC32c INTEL hardware acceleration"
604 In Intel processor with SSE4.2 supported, the processor will
605 support CRC32C implementation using hardware accelerated CRC32
606 instruction. This option will create 'crc32c-intel' module,
607 which will enable any routine to use the CRC32 instruction to
608 gain performance compared with software implementation.
609 Module will be crc32c-intel.
611 config CRYPTO_CRC32C_VPMSUM
612 tristate "CRC32c CRC algorithm (powerpc64)"
613 depends on PPC64 && ALTIVEC
617 CRC32c algorithm implemented using vector polynomial multiply-sum
618 (vpmsum) instructions, introduced in POWER8. Enable on POWER8
619 and newer processors for improved performance.
622 config CRYPTO_CRC32C_SPARC64
623 tristate "CRC32c CRC algorithm (SPARC64)"
628 CRC32c CRC algorithm implemented using sparc64 crypto instructions,
632 tristate "CRC32 CRC algorithm"
636 CRC-32-IEEE 802.3 cyclic redundancy-check algorithm.
637 Shash crypto api wrappers to crc32_le function.
639 config CRYPTO_CRC32_PCLMUL
640 tristate "CRC32 PCLMULQDQ hardware acceleration"
645 From Intel Westmere and AMD Bulldozer processor with SSE4.2
646 and PCLMULQDQ supported, the processor will support
647 CRC32 PCLMULQDQ implementation using hardware accelerated PCLMULQDQ
648 instruction. This option will create 'crc32-pclmul' module,
649 which will enable any routine to use the CRC-32-IEEE 802.3 checksum
650 and gain better performance as compared with the table implementation.
652 config CRYPTO_CRC32_MIPS
653 tristate "CRC32c and CRC32 CRC algorithm (MIPS)"
654 depends on MIPS_CRC_SUPPORT
657 CRC32c and CRC32 CRC algorithms implemented using mips crypto
658 instructions, when available.
662 tristate "xxHash hash algorithm"
666 xxHash non-cryptographic hash algorithm. Extremely fast, working at
667 speeds close to RAM limits.
669 config CRYPTO_BLAKE2B
670 tristate "BLAKE2b digest algorithm"
673 Implementation of cryptographic hash function BLAKE2b (or just BLAKE2),
674 optimized for 64bit platforms and can produce digests of any size
675 between 1 to 64. The keyed hash is also implemented.
677 This module provides the following algorithms:
684 See https://blake2.net for further information.
686 config CRYPTO_BLAKE2S
687 tristate "BLAKE2s digest algorithm"
688 select CRYPTO_LIB_BLAKE2S_GENERIC
691 Implementation of cryptographic hash function BLAKE2s
692 optimized for 8-32bit platforms and can produce digests of any size
693 between 1 to 32. The keyed hash is also implemented.
695 This module provides the following algorithms:
702 See https://blake2.net for further information.
704 config CRYPTO_BLAKE2S_X86
705 tristate "BLAKE2s digest algorithm (x86 accelerated version)"
706 depends on X86 && 64BIT
707 select CRYPTO_LIB_BLAKE2S_GENERIC
708 select CRYPTO_ARCH_HAVE_LIB_BLAKE2S
710 config CRYPTO_CRCT10DIF
711 tristate "CRCT10DIF algorithm"
714 CRC T10 Data Integrity Field computation is being cast as
715 a crypto transform. This allows for faster crc t10 diff
716 transforms to be used if they are available.
718 config CRYPTO_CRCT10DIF_PCLMUL
719 tristate "CRCT10DIF PCLMULQDQ hardware acceleration"
720 depends on X86 && 64BIT && CRC_T10DIF
723 For x86_64 processors with SSE4.2 and PCLMULQDQ supported,
724 CRC T10 DIF PCLMULQDQ computation can be hardware
725 accelerated PCLMULQDQ instruction. This option will create
726 'crct10dif-pclmul' module, which is faster when computing the
727 crct10dif checksum as compared with the generic table implementation.
729 config CRYPTO_CRCT10DIF_VPMSUM
730 tristate "CRC32T10DIF powerpc64 hardware acceleration"
731 depends on PPC64 && ALTIVEC && CRC_T10DIF
734 CRC10T10DIF algorithm implemented using vector polynomial
735 multiply-sum (vpmsum) instructions, introduced in POWER8. Enable on
736 POWER8 and newer processors for improved performance.
738 config CRYPTO_VPMSUM_TESTER
739 tristate "Powerpc64 vpmsum hardware acceleration tester"
740 depends on CRYPTO_CRCT10DIF_VPMSUM && CRYPTO_CRC32C_VPMSUM
742 Stress test for CRC32c and CRC-T10DIF algorithms implemented with
743 POWER8 vpmsum instructions.
744 Unless you are testing these algorithms, you don't need this.
747 tristate "GHASH hash function"
748 select CRYPTO_GF128MUL
751 GHASH is the hash function used in GCM (Galois/Counter Mode).
752 It is not a general-purpose cryptographic hash function.
754 config CRYPTO_POLY1305
755 tristate "Poly1305 authenticator algorithm"
757 select CRYPTO_LIB_POLY1305_GENERIC
759 Poly1305 authenticator algorithm, RFC7539.
761 Poly1305 is an authenticator algorithm designed by Daniel J. Bernstein.
762 It is used for the ChaCha20-Poly1305 AEAD, specified in RFC7539 for use
763 in IETF protocols. This is the portable C implementation of Poly1305.
765 config CRYPTO_POLY1305_X86_64
766 tristate "Poly1305 authenticator algorithm (x86_64/SSE2/AVX2)"
767 depends on X86 && 64BIT
768 select CRYPTO_LIB_POLY1305_GENERIC
769 select CRYPTO_ARCH_HAVE_LIB_POLY1305
771 Poly1305 authenticator algorithm, RFC7539.
773 Poly1305 is an authenticator algorithm designed by Daniel J. Bernstein.
774 It is used for the ChaCha20-Poly1305 AEAD, specified in RFC7539 for use
775 in IETF protocols. This is the x86_64 assembler implementation using SIMD
778 config CRYPTO_POLY1305_MIPS
779 tristate "Poly1305 authenticator algorithm (MIPS optimized)"
781 select CRYPTO_ARCH_HAVE_LIB_POLY1305
784 tristate "MD4 digest algorithm"
787 MD4 message digest algorithm (RFC1320).
790 tristate "MD5 digest algorithm"
793 MD5 message digest algorithm (RFC1321).
795 config CRYPTO_MD5_OCTEON
796 tristate "MD5 digest algorithm (OCTEON)"
797 depends on CPU_CAVIUM_OCTEON
801 MD5 message digest algorithm (RFC1321) implemented
802 using OCTEON crypto instructions, when available.
804 config CRYPTO_MD5_PPC
805 tristate "MD5 digest algorithm (PPC)"
809 MD5 message digest algorithm (RFC1321) implemented
812 config CRYPTO_MD5_SPARC64
813 tristate "MD5 digest algorithm (SPARC64)"
818 MD5 message digest algorithm (RFC1321) implemented
819 using sparc64 crypto instructions, when available.
821 config CRYPTO_MICHAEL_MIC
822 tristate "Michael MIC keyed digest algorithm"
825 Michael MIC is used for message integrity protection in TKIP
826 (IEEE 802.11i). This algorithm is required for TKIP, but it
827 should not be used for other purposes because of the weakness
831 tristate "RIPEMD-160 digest algorithm"
834 RIPEMD-160 (ISO/IEC 10118-3:2004).
836 RIPEMD-160 is a 160-bit cryptographic hash function. It is intended
837 to be used as a secure replacement for the 128-bit hash functions
838 MD4, MD5 and it's predecessor RIPEMD
839 (not to be confused with RIPEMD-128).
841 It's speed is comparable to SHA1 and there are no known attacks
844 Developed by Hans Dobbertin, Antoon Bosselaers and Bart Preneel.
845 See <https://homes.esat.kuleuven.be/~bosselae/ripemd160.html>
848 tristate "SHA1 digest algorithm"
851 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2).
853 config CRYPTO_SHA1_SSSE3
854 tristate "SHA1 digest algorithm (SSSE3/AVX/AVX2/SHA-NI)"
855 depends on X86 && 64BIT
859 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2) implemented
860 using Supplemental SSE3 (SSSE3) instructions or Advanced Vector
861 Extensions (AVX/AVX2) or SHA-NI(SHA Extensions New Instructions),
864 config CRYPTO_SHA256_SSSE3
865 tristate "SHA256 digest algorithm (SSSE3/AVX/AVX2/SHA-NI)"
866 depends on X86 && 64BIT
870 SHA-256 secure hash standard (DFIPS 180-2) implemented
871 using Supplemental SSE3 (SSSE3) instructions, or Advanced Vector
872 Extensions version 1 (AVX1), or Advanced Vector Extensions
873 version 2 (AVX2) instructions, or SHA-NI (SHA Extensions New
874 Instructions) when available.
876 config CRYPTO_SHA512_SSSE3
877 tristate "SHA512 digest algorithm (SSSE3/AVX/AVX2)"
878 depends on X86 && 64BIT
882 SHA-512 secure hash standard (DFIPS 180-2) implemented
883 using Supplemental SSE3 (SSSE3) instructions, or Advanced Vector
884 Extensions version 1 (AVX1), or Advanced Vector Extensions
885 version 2 (AVX2) instructions, when available.
887 config CRYPTO_SHA1_OCTEON
888 tristate "SHA1 digest algorithm (OCTEON)"
889 depends on CPU_CAVIUM_OCTEON
893 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2) implemented
894 using OCTEON crypto instructions, when available.
896 config CRYPTO_SHA1_SPARC64
897 tristate "SHA1 digest algorithm (SPARC64)"
902 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2) implemented
903 using sparc64 crypto instructions, when available.
905 config CRYPTO_SHA1_PPC
906 tristate "SHA1 digest algorithm (powerpc)"
909 This is the powerpc hardware accelerated implementation of the
910 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2).
912 config CRYPTO_SHA1_PPC_SPE
913 tristate "SHA1 digest algorithm (PPC SPE)"
914 depends on PPC && SPE
916 SHA-1 secure hash standard (DFIPS 180-4) implemented
917 using powerpc SPE SIMD instruction set.
920 tristate "SHA224 and SHA256 digest algorithm"
922 select CRYPTO_LIB_SHA256
924 SHA256 secure hash standard (DFIPS 180-2).
926 This version of SHA implements a 256 bit hash with 128 bits of
927 security against collision attacks.
929 This code also includes SHA-224, a 224 bit hash with 112 bits
930 of security against collision attacks.
932 config CRYPTO_SHA256_PPC_SPE
933 tristate "SHA224 and SHA256 digest algorithm (PPC SPE)"
934 depends on PPC && SPE
938 SHA224 and SHA256 secure hash standard (DFIPS 180-2)
939 implemented using powerpc SPE SIMD instruction set.
941 config CRYPTO_SHA256_OCTEON
942 tristate "SHA224 and SHA256 digest algorithm (OCTEON)"
943 depends on CPU_CAVIUM_OCTEON
947 SHA-256 secure hash standard (DFIPS 180-2) implemented
948 using OCTEON crypto instructions, when available.
950 config CRYPTO_SHA256_SPARC64
951 tristate "SHA224 and SHA256 digest algorithm (SPARC64)"
956 SHA-256 secure hash standard (DFIPS 180-2) implemented
957 using sparc64 crypto instructions, when available.
960 tristate "SHA384 and SHA512 digest algorithms"
963 SHA512 secure hash standard (DFIPS 180-2).
965 This version of SHA implements a 512 bit hash with 256 bits of
966 security against collision attacks.
968 This code also includes SHA-384, a 384 bit hash with 192 bits
969 of security against collision attacks.
971 config CRYPTO_SHA512_OCTEON
972 tristate "SHA384 and SHA512 digest algorithms (OCTEON)"
973 depends on CPU_CAVIUM_OCTEON
977 SHA-512 secure hash standard (DFIPS 180-2) implemented
978 using OCTEON crypto instructions, when available.
980 config CRYPTO_SHA512_SPARC64
981 tristate "SHA384 and SHA512 digest algorithm (SPARC64)"
986 SHA-512 secure hash standard (DFIPS 180-2) implemented
987 using sparc64 crypto instructions, when available.
990 tristate "SHA3 digest algorithm"
993 SHA-3 secure hash standard (DFIPS 202). It's based on
994 cryptographic sponge function family called Keccak.
997 http://keccak.noekeon.org/
1000 tristate "SM3 digest algorithm"
1003 SM3 secure hash function as defined by OSCCA GM/T 0004-2012 SM3).
1004 It is part of the Chinese Commercial Cryptography suite.
1007 http://www.oscca.gov.cn/UpFile/20101222141857786.pdf
1008 https://datatracker.ietf.org/doc/html/draft-shen-sm3-hash
1010 config CRYPTO_STREEBOG
1011 tristate "Streebog Hash Function"
1014 Streebog Hash Function (GOST R 34.11-2012, RFC 6986) is one of the Russian
1015 cryptographic standard algorithms (called GOST algorithms).
1016 This setting enables two hash algorithms with 256 and 512 bits output.
1019 https://tc26.ru/upload/iblock/fed/feddbb4d26b685903faa2ba11aea43f6.pdf
1020 https://tools.ietf.org/html/rfc6986
1023 tristate "Whirlpool digest algorithms"
1026 Whirlpool hash algorithm 512, 384 and 256-bit hashes
1028 Whirlpool-512 is part of the NESSIE cryptographic primitives.
1029 Whirlpool will be part of the ISO/IEC 10118-3:2003(E) standard
1032 <http://www.larc.usp.br/~pbarreto/WhirlpoolPage.html>
1034 config CRYPTO_GHASH_CLMUL_NI_INTEL
1035 tristate "GHASH hash function (CLMUL-NI accelerated)"
1036 depends on X86 && 64BIT
1037 select CRYPTO_CRYPTD
1039 This is the x86_64 CLMUL-NI accelerated implementation of
1040 GHASH, the hash function used in GCM (Galois/Counter mode).
1045 tristate "AES cipher algorithms"
1046 select CRYPTO_ALGAPI
1047 select CRYPTO_LIB_AES
1049 AES cipher algorithms (FIPS-197). AES uses the Rijndael
1052 Rijndael appears to be consistently a very good performer in
1053 both hardware and software across a wide range of computing
1054 environments regardless of its use in feedback or non-feedback
1055 modes. Its key setup time is excellent, and its key agility is
1056 good. Rijndael's very low memory requirements make it very well
1057 suited for restricted-space environments, in which it also
1058 demonstrates excellent performance. Rijndael's operations are
1059 among the easiest to defend against power and timing attacks.
1061 The AES specifies three key sizes: 128, 192 and 256 bits
1063 See <http://csrc.nist.gov/CryptoToolkit/aes/> for more information.
1065 config CRYPTO_AES_TI
1066 tristate "Fixed time AES cipher"
1067 select CRYPTO_ALGAPI
1068 select CRYPTO_LIB_AES
1070 This is a generic implementation of AES that attempts to eliminate
1071 data dependent latencies as much as possible without affecting
1072 performance too much. It is intended for use by the generic CCM
1073 and GCM drivers, and other CTR or CMAC/XCBC based modes that rely
1074 solely on encryption (although decryption is supported as well, but
1075 with a more dramatic performance hit)
1077 Instead of using 16 lookup tables of 1 KB each, (8 for encryption and
1078 8 for decryption), this implementation only uses just two S-boxes of
1079 256 bytes each, and attempts to eliminate data dependent latencies by
1080 prefetching the entire table into the cache at the start of each
1081 block. Interrupts are also disabled to avoid races where cachelines
1082 are evicted when the CPU is interrupted to do something else.
1084 config CRYPTO_AES_NI_INTEL
1085 tristate "AES cipher algorithms (AES-NI)"
1088 select CRYPTO_LIB_AES
1089 select CRYPTO_ALGAPI
1090 select CRYPTO_SKCIPHER
1093 Use Intel AES-NI instructions for AES algorithm.
1095 AES cipher algorithms (FIPS-197). AES uses the Rijndael
1098 Rijndael appears to be consistently a very good performer in
1099 both hardware and software across a wide range of computing
1100 environments regardless of its use in feedback or non-feedback
1101 modes. Its key setup time is excellent, and its key agility is
1102 good. Rijndael's very low memory requirements make it very well
1103 suited for restricted-space environments, in which it also
1104 demonstrates excellent performance. Rijndael's operations are
1105 among the easiest to defend against power and timing attacks.
1107 The AES specifies three key sizes: 128, 192 and 256 bits
1109 See <http://csrc.nist.gov/encryption/aes/> for more information.
1111 In addition to AES cipher algorithm support, the acceleration
1112 for some popular block cipher mode is supported too, including
1113 ECB, CBC, LRW, XTS. The 64 bit version has additional
1114 acceleration for CTR.
1116 config CRYPTO_AES_SPARC64
1117 tristate "AES cipher algorithms (SPARC64)"
1119 select CRYPTO_SKCIPHER
1121 Use SPARC64 crypto opcodes for AES algorithm.
1123 AES cipher algorithms (FIPS-197). AES uses the Rijndael
1126 Rijndael appears to be consistently a very good performer in
1127 both hardware and software across a wide range of computing
1128 environments regardless of its use in feedback or non-feedback
1129 modes. Its key setup time is excellent, and its key agility is
1130 good. Rijndael's very low memory requirements make it very well
1131 suited for restricted-space environments, in which it also
1132 demonstrates excellent performance. Rijndael's operations are
1133 among the easiest to defend against power and timing attacks.
1135 The AES specifies three key sizes: 128, 192 and 256 bits
1137 See <http://csrc.nist.gov/encryption/aes/> for more information.
1139 In addition to AES cipher algorithm support, the acceleration
1140 for some popular block cipher mode is supported too, including
1143 config CRYPTO_AES_PPC_SPE
1144 tristate "AES cipher algorithms (PPC SPE)"
1145 depends on PPC && SPE
1146 select CRYPTO_SKCIPHER
1148 AES cipher algorithms (FIPS-197). Additionally the acceleration
1149 for popular block cipher modes ECB, CBC, CTR and XTS is supported.
1150 This module should only be used for low power (router) devices
1151 without hardware AES acceleration (e.g. caam crypto). It reduces the
1152 size of the AES tables from 16KB to 8KB + 256 bytes and mitigates
1153 timining attacks. Nevertheless it might be not as secure as other
1154 architecture specific assembler implementations that work on 1KB
1155 tables or 256 bytes S-boxes.
1157 config CRYPTO_ANUBIS
1158 tristate "Anubis cipher algorithm"
1159 depends on CRYPTO_USER_API_ENABLE_OBSOLETE
1160 select CRYPTO_ALGAPI
1162 Anubis cipher algorithm.
1164 Anubis is a variable key length cipher which can use keys from
1165 128 bits to 320 bits in length. It was evaluated as a entrant
1166 in the NESSIE competition.
1169 <https://www.cosic.esat.kuleuven.be/nessie/reports/>
1170 <http://www.larc.usp.br/~pbarreto/AnubisPage.html>
1173 tristate "ARC4 cipher algorithm"
1174 depends on CRYPTO_USER_API_ENABLE_OBSOLETE
1175 select CRYPTO_SKCIPHER
1176 select CRYPTO_LIB_ARC4
1178 ARC4 cipher algorithm.
1180 ARC4 is a stream cipher using keys ranging from 8 bits to 2048
1181 bits in length. This algorithm is required for driver-based
1182 WEP, but it should not be for other purposes because of the
1183 weakness of the algorithm.
1185 config CRYPTO_BLOWFISH
1186 tristate "Blowfish cipher algorithm"
1187 select CRYPTO_ALGAPI
1188 select CRYPTO_BLOWFISH_COMMON
1190 Blowfish cipher algorithm, by Bruce Schneier.
1192 This is a variable key length cipher which can use keys from 32
1193 bits to 448 bits in length. It's fast, simple and specifically
1194 designed for use on "large microprocessors".
1197 <https://www.schneier.com/blowfish.html>
1199 config CRYPTO_BLOWFISH_COMMON
1202 Common parts of the Blowfish cipher algorithm shared by the
1203 generic c and the assembler implementations.
1206 <https://www.schneier.com/blowfish.html>
1208 config CRYPTO_BLOWFISH_X86_64
1209 tristate "Blowfish cipher algorithm (x86_64)"
1210 depends on X86 && 64BIT
1211 select CRYPTO_SKCIPHER
1212 select CRYPTO_BLOWFISH_COMMON
1215 Blowfish cipher algorithm (x86_64), by Bruce Schneier.
1217 This is a variable key length cipher which can use keys from 32
1218 bits to 448 bits in length. It's fast, simple and specifically
1219 designed for use on "large microprocessors".
1222 <https://www.schneier.com/blowfish.html>
1224 config CRYPTO_CAMELLIA
1225 tristate "Camellia cipher algorithms"
1226 select CRYPTO_ALGAPI
1228 Camellia cipher algorithms module.
1230 Camellia is a symmetric key block cipher developed jointly
1231 at NTT and Mitsubishi Electric Corporation.
1233 The Camellia specifies three key sizes: 128, 192 and 256 bits.
1236 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
1238 config CRYPTO_CAMELLIA_X86_64
1239 tristate "Camellia cipher algorithm (x86_64)"
1240 depends on X86 && 64BIT
1241 select CRYPTO_SKCIPHER
1244 Camellia cipher algorithm module (x86_64).
1246 Camellia is a symmetric key block cipher developed jointly
1247 at NTT and Mitsubishi Electric Corporation.
1249 The Camellia specifies three key sizes: 128, 192 and 256 bits.
1252 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
1254 config CRYPTO_CAMELLIA_AESNI_AVX_X86_64
1255 tristate "Camellia cipher algorithm (x86_64/AES-NI/AVX)"
1256 depends on X86 && 64BIT
1257 select CRYPTO_SKCIPHER
1258 select CRYPTO_CAMELLIA_X86_64
1262 Camellia cipher algorithm module (x86_64/AES-NI/AVX).
1264 Camellia is a symmetric key block cipher developed jointly
1265 at NTT and Mitsubishi Electric Corporation.
1267 The Camellia specifies three key sizes: 128, 192 and 256 bits.
1270 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
1272 config CRYPTO_CAMELLIA_AESNI_AVX2_X86_64
1273 tristate "Camellia cipher algorithm (x86_64/AES-NI/AVX2)"
1274 depends on X86 && 64BIT
1275 select CRYPTO_CAMELLIA_AESNI_AVX_X86_64
1277 Camellia cipher algorithm module (x86_64/AES-NI/AVX2).
1279 Camellia is a symmetric key block cipher developed jointly
1280 at NTT and Mitsubishi Electric Corporation.
1282 The Camellia specifies three key sizes: 128, 192 and 256 bits.
1285 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
1287 config CRYPTO_CAMELLIA_SPARC64
1288 tristate "Camellia cipher algorithm (SPARC64)"
1290 select CRYPTO_ALGAPI
1291 select CRYPTO_SKCIPHER
1293 Camellia cipher algorithm module (SPARC64).
1295 Camellia is a symmetric key block cipher developed jointly
1296 at NTT and Mitsubishi Electric Corporation.
1298 The Camellia specifies three key sizes: 128, 192 and 256 bits.
1301 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
1303 config CRYPTO_CAST_COMMON
1306 Common parts of the CAST cipher algorithms shared by the
1307 generic c and the assembler implementations.
1310 tristate "CAST5 (CAST-128) cipher algorithm"
1311 select CRYPTO_ALGAPI
1312 select CRYPTO_CAST_COMMON
1314 The CAST5 encryption algorithm (synonymous with CAST-128) is
1315 described in RFC2144.
1317 config CRYPTO_CAST5_AVX_X86_64
1318 tristate "CAST5 (CAST-128) cipher algorithm (x86_64/AVX)"
1319 depends on X86 && 64BIT
1320 select CRYPTO_SKCIPHER
1322 select CRYPTO_CAST_COMMON
1326 The CAST5 encryption algorithm (synonymous with CAST-128) is
1327 described in RFC2144.
1329 This module provides the Cast5 cipher algorithm that processes
1330 sixteen blocks parallel using the AVX instruction set.
1333 tristate "CAST6 (CAST-256) cipher algorithm"
1334 select CRYPTO_ALGAPI
1335 select CRYPTO_CAST_COMMON
1337 The CAST6 encryption algorithm (synonymous with CAST-256) is
1338 described in RFC2612.
1340 config CRYPTO_CAST6_AVX_X86_64
1341 tristate "CAST6 (CAST-256) cipher algorithm (x86_64/AVX)"
1342 depends on X86 && 64BIT
1343 select CRYPTO_SKCIPHER
1345 select CRYPTO_CAST_COMMON
1350 The CAST6 encryption algorithm (synonymous with CAST-256) is
1351 described in RFC2612.
1353 This module provides the Cast6 cipher algorithm that processes
1354 eight blocks parallel using the AVX instruction set.
1357 tristate "DES and Triple DES EDE cipher algorithms"
1358 select CRYPTO_ALGAPI
1359 select CRYPTO_LIB_DES
1361 DES cipher algorithm (FIPS 46-2), and Triple DES EDE (FIPS 46-3).
1363 config CRYPTO_DES_SPARC64
1364 tristate "DES and Triple DES EDE cipher algorithms (SPARC64)"
1366 select CRYPTO_ALGAPI
1367 select CRYPTO_LIB_DES
1368 select CRYPTO_SKCIPHER
1370 DES cipher algorithm (FIPS 46-2), and Triple DES EDE (FIPS 46-3),
1371 optimized using SPARC64 crypto opcodes.
1373 config CRYPTO_DES3_EDE_X86_64
1374 tristate "Triple DES EDE cipher algorithm (x86-64)"
1375 depends on X86 && 64BIT
1376 select CRYPTO_SKCIPHER
1377 select CRYPTO_LIB_DES
1380 Triple DES EDE (FIPS 46-3) algorithm.
1382 This module provides implementation of the Triple DES EDE cipher
1383 algorithm that is optimized for x86-64 processors. Two versions of
1384 algorithm are provided; regular processing one input block and
1385 one that processes three blocks parallel.
1387 config CRYPTO_FCRYPT
1388 tristate "FCrypt cipher algorithm"
1389 select CRYPTO_ALGAPI
1390 select CRYPTO_SKCIPHER
1392 FCrypt algorithm used by RxRPC.
1394 config CRYPTO_KHAZAD
1395 tristate "Khazad cipher algorithm"
1396 depends on CRYPTO_USER_API_ENABLE_OBSOLETE
1397 select CRYPTO_ALGAPI
1399 Khazad cipher algorithm.
1401 Khazad was a finalist in the initial NESSIE competition. It is
1402 an algorithm optimized for 64-bit processors with good performance
1403 on 32-bit processors. Khazad uses an 128 bit key size.
1406 <http://www.larc.usp.br/~pbarreto/KhazadPage.html>
1408 config CRYPTO_CHACHA20
1409 tristate "ChaCha stream cipher algorithms"
1410 select CRYPTO_LIB_CHACHA_GENERIC
1411 select CRYPTO_SKCIPHER
1413 The ChaCha20, XChaCha20, and XChaCha12 stream cipher algorithms.
1415 ChaCha20 is a 256-bit high-speed stream cipher designed by Daniel J.
1416 Bernstein and further specified in RFC7539 for use in IETF protocols.
1417 This is the portable C implementation of ChaCha20. See also:
1418 <https://cr.yp.to/chacha/chacha-20080128.pdf>
1420 XChaCha20 is the application of the XSalsa20 construction to ChaCha20
1421 rather than to Salsa20. XChaCha20 extends ChaCha20's nonce length
1422 from 64 bits (or 96 bits using the RFC7539 convention) to 192 bits,
1423 while provably retaining ChaCha20's security. See also:
1424 <https://cr.yp.to/snuffle/xsalsa-20081128.pdf>
1426 XChaCha12 is XChaCha20 reduced to 12 rounds, with correspondingly
1427 reduced security margin but increased performance. It can be needed
1428 in some performance-sensitive scenarios.
1430 config CRYPTO_CHACHA20_X86_64
1431 tristate "ChaCha stream cipher algorithms (x86_64/SSSE3/AVX2/AVX-512VL)"
1432 depends on X86 && 64BIT
1433 select CRYPTO_SKCIPHER
1434 select CRYPTO_LIB_CHACHA_GENERIC
1435 select CRYPTO_ARCH_HAVE_LIB_CHACHA
1437 SSSE3, AVX2, and AVX-512VL optimized implementations of the ChaCha20,
1438 XChaCha20, and XChaCha12 stream ciphers.
1440 config CRYPTO_CHACHA_MIPS
1441 tristate "ChaCha stream cipher algorithms (MIPS 32r2 optimized)"
1442 depends on CPU_MIPS32_R2
1443 select CRYPTO_SKCIPHER
1444 select CRYPTO_ARCH_HAVE_LIB_CHACHA
1447 tristate "SEED cipher algorithm"
1448 depends on CRYPTO_USER_API_ENABLE_OBSOLETE
1449 select CRYPTO_ALGAPI
1451 SEED cipher algorithm (RFC4269).
1453 SEED is a 128-bit symmetric key block cipher that has been
1454 developed by KISA (Korea Information Security Agency) as a
1455 national standard encryption algorithm of the Republic of Korea.
1456 It is a 16 round block cipher with the key size of 128 bit.
1459 <http://www.kisa.or.kr/kisa/seed/jsp/seed_eng.jsp>
1461 config CRYPTO_SERPENT
1462 tristate "Serpent cipher algorithm"
1463 select CRYPTO_ALGAPI
1465 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1467 Keys are allowed to be from 0 to 256 bits in length, in steps
1471 <https://www.cl.cam.ac.uk/~rja14/serpent.html>
1473 config CRYPTO_SERPENT_SSE2_X86_64
1474 tristate "Serpent cipher algorithm (x86_64/SSE2)"
1475 depends on X86 && 64BIT
1476 select CRYPTO_SKCIPHER
1477 select CRYPTO_SERPENT
1481 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1483 Keys are allowed to be from 0 to 256 bits in length, in steps
1486 This module provides Serpent cipher algorithm that processes eight
1487 blocks parallel using SSE2 instruction set.
1490 <https://www.cl.cam.ac.uk/~rja14/serpent.html>
1492 config CRYPTO_SERPENT_SSE2_586
1493 tristate "Serpent cipher algorithm (i586/SSE2)"
1494 depends on X86 && !64BIT
1495 select CRYPTO_SKCIPHER
1496 select CRYPTO_SERPENT
1500 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1502 Keys are allowed to be from 0 to 256 bits in length, in steps
1505 This module provides Serpent cipher algorithm that processes four
1506 blocks parallel using SSE2 instruction set.
1509 <https://www.cl.cam.ac.uk/~rja14/serpent.html>
1511 config CRYPTO_SERPENT_AVX_X86_64
1512 tristate "Serpent cipher algorithm (x86_64/AVX)"
1513 depends on X86 && 64BIT
1514 select CRYPTO_SKCIPHER
1515 select CRYPTO_SERPENT
1520 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1522 Keys are allowed to be from 0 to 256 bits in length, in steps
1525 This module provides the Serpent cipher algorithm that processes
1526 eight blocks parallel using the AVX instruction set.
1529 <https://www.cl.cam.ac.uk/~rja14/serpent.html>
1531 config CRYPTO_SERPENT_AVX2_X86_64
1532 tristate "Serpent cipher algorithm (x86_64/AVX2)"
1533 depends on X86 && 64BIT
1534 select CRYPTO_SERPENT_AVX_X86_64
1536 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1538 Keys are allowed to be from 0 to 256 bits in length, in steps
1541 This module provides Serpent cipher algorithm that processes 16
1542 blocks parallel using AVX2 instruction set.
1545 <https://www.cl.cam.ac.uk/~rja14/serpent.html>
1548 tristate "SM4 cipher algorithm"
1549 select CRYPTO_ALGAPI
1551 SM4 cipher algorithms (OSCCA GB/T 32907-2016).
1553 SM4 (GBT.32907-2016) is a cryptographic standard issued by the
1554 Organization of State Commercial Administration of China (OSCCA)
1555 as an authorized cryptographic algorithms for the use within China.
1557 SMS4 was originally created for use in protecting wireless
1558 networks, and is mandated in the Chinese National Standard for
1559 Wireless LAN WAPI (Wired Authentication and Privacy Infrastructure)
1562 The latest SM4 standard (GBT.32907-2016) was proposed by OSCCA and
1563 standardized through TC 260 of the Standardization Administration
1564 of the People's Republic of China (SAC).
1566 The input, output, and key of SMS4 are each 128 bits.
1568 See also: <https://eprint.iacr.org/2008/329.pdf>
1573 tristate "TEA, XTEA and XETA cipher algorithms"
1574 depends on CRYPTO_USER_API_ENABLE_OBSOLETE
1575 select CRYPTO_ALGAPI
1577 TEA cipher algorithm.
1579 Tiny Encryption Algorithm is a simple cipher that uses
1580 many rounds for security. It is very fast and uses
1583 Xtendend Tiny Encryption Algorithm is a modification to
1584 the TEA algorithm to address a potential key weakness
1585 in the TEA algorithm.
1587 Xtendend Encryption Tiny Algorithm is a mis-implementation
1588 of the XTEA algorithm for compatibility purposes.
1590 config CRYPTO_TWOFISH
1591 tristate "Twofish cipher algorithm"
1592 select CRYPTO_ALGAPI
1593 select CRYPTO_TWOFISH_COMMON
1595 Twofish cipher algorithm.
1597 Twofish was submitted as an AES (Advanced Encryption Standard)
1598 candidate cipher by researchers at CounterPane Systems. It is a
1599 16 round block cipher supporting key sizes of 128, 192, and 256
1603 <https://www.schneier.com/twofish.html>
1605 config CRYPTO_TWOFISH_COMMON
1608 Common parts of the Twofish cipher algorithm shared by the
1609 generic c and the assembler implementations.
1611 config CRYPTO_TWOFISH_586
1612 tristate "Twofish cipher algorithms (i586)"
1613 depends on (X86 || UML_X86) && !64BIT
1614 select CRYPTO_ALGAPI
1615 select CRYPTO_TWOFISH_COMMON
1618 Twofish cipher algorithm.
1620 Twofish was submitted as an AES (Advanced Encryption Standard)
1621 candidate cipher by researchers at CounterPane Systems. It is a
1622 16 round block cipher supporting key sizes of 128, 192, and 256
1626 <https://www.schneier.com/twofish.html>
1628 config CRYPTO_TWOFISH_X86_64
1629 tristate "Twofish cipher algorithm (x86_64)"
1630 depends on (X86 || UML_X86) && 64BIT
1631 select CRYPTO_ALGAPI
1632 select CRYPTO_TWOFISH_COMMON
1635 Twofish cipher algorithm (x86_64).
1637 Twofish was submitted as an AES (Advanced Encryption Standard)
1638 candidate cipher by researchers at CounterPane Systems. It is a
1639 16 round block cipher supporting key sizes of 128, 192, and 256
1643 <https://www.schneier.com/twofish.html>
1645 config CRYPTO_TWOFISH_X86_64_3WAY
1646 tristate "Twofish cipher algorithm (x86_64, 3-way parallel)"
1647 depends on X86 && 64BIT
1648 select CRYPTO_SKCIPHER
1649 select CRYPTO_TWOFISH_COMMON
1650 select CRYPTO_TWOFISH_X86_64
1652 Twofish cipher algorithm (x86_64, 3-way parallel).
1654 Twofish was submitted as an AES (Advanced Encryption Standard)
1655 candidate cipher by researchers at CounterPane Systems. It is a
1656 16 round block cipher supporting key sizes of 128, 192, and 256
1659 This module provides Twofish cipher algorithm that processes three
1660 blocks parallel, utilizing resources of out-of-order CPUs better.
1663 <https://www.schneier.com/twofish.html>
1665 config CRYPTO_TWOFISH_AVX_X86_64
1666 tristate "Twofish cipher algorithm (x86_64/AVX)"
1667 depends on X86 && 64BIT
1668 select CRYPTO_SKCIPHER
1670 select CRYPTO_TWOFISH_COMMON
1671 select CRYPTO_TWOFISH_X86_64
1672 select CRYPTO_TWOFISH_X86_64_3WAY
1675 Twofish cipher algorithm (x86_64/AVX).
1677 Twofish was submitted as an AES (Advanced Encryption Standard)
1678 candidate cipher by researchers at CounterPane Systems. It is a
1679 16 round block cipher supporting key sizes of 128, 192, and 256
1682 This module provides the Twofish cipher algorithm that processes
1683 eight blocks parallel using the AVX Instruction Set.
1686 <https://www.schneier.com/twofish.html>
1688 comment "Compression"
1690 config CRYPTO_DEFLATE
1691 tristate "Deflate compression algorithm"
1692 select CRYPTO_ALGAPI
1693 select CRYPTO_ACOMP2
1697 This is the Deflate algorithm (RFC1951), specified for use in
1698 IPSec with the IPCOMP protocol (RFC3173, RFC2394).
1700 You will most probably want this if using IPSec.
1703 tristate "LZO compression algorithm"
1704 select CRYPTO_ALGAPI
1705 select CRYPTO_ACOMP2
1707 select LZO_DECOMPRESS
1709 This is the LZO algorithm.
1712 tristate "842 compression algorithm"
1713 select CRYPTO_ALGAPI
1714 select CRYPTO_ACOMP2
1716 select 842_DECOMPRESS
1718 This is the 842 algorithm.
1721 tristate "LZ4 compression algorithm"
1722 select CRYPTO_ALGAPI
1723 select CRYPTO_ACOMP2
1725 select LZ4_DECOMPRESS
1727 This is the LZ4 algorithm.
1730 tristate "LZ4HC compression algorithm"
1731 select CRYPTO_ALGAPI
1732 select CRYPTO_ACOMP2
1733 select LZ4HC_COMPRESS
1734 select LZ4_DECOMPRESS
1736 This is the LZ4 high compression mode algorithm.
1739 tristate "Zstd compression algorithm"
1740 select CRYPTO_ALGAPI
1741 select CRYPTO_ACOMP2
1742 select ZSTD_COMPRESS
1743 select ZSTD_DECOMPRESS
1745 This is the zstd algorithm.
1747 comment "Random Number Generation"
1749 config CRYPTO_ANSI_CPRNG
1750 tristate "Pseudo Random Number Generation for Cryptographic modules"
1754 This option enables the generic pseudo random number generator
1755 for cryptographic modules. Uses the Algorithm specified in
1756 ANSI X9.31 A.2.4. Note that this option must be enabled if
1757 CRYPTO_FIPS is selected
1759 menuconfig CRYPTO_DRBG_MENU
1760 tristate "NIST SP800-90A DRBG"
1762 NIST SP800-90A compliant DRBG. In the following submenu, one or
1763 more of the DRBG types must be selected.
1767 config CRYPTO_DRBG_HMAC
1771 select CRYPTO_SHA512
1773 config CRYPTO_DRBG_HASH
1774 bool "Enable Hash DRBG"
1775 select CRYPTO_SHA256
1777 Enable the Hash DRBG variant as defined in NIST SP800-90A.
1779 config CRYPTO_DRBG_CTR
1780 bool "Enable CTR DRBG"
1784 Enable the CTR DRBG variant as defined in NIST SP800-90A.
1788 default CRYPTO_DRBG_MENU
1790 select CRYPTO_JITTERENTROPY
1792 endif # if CRYPTO_DRBG_MENU
1794 config CRYPTO_JITTERENTROPY
1795 tristate "Jitterentropy Non-Deterministic Random Number Generator"
1798 The Jitterentropy RNG is a noise that is intended
1799 to provide seed to another RNG. The RNG does not
1800 perform any cryptographic whitening of the generated
1801 random numbers. This Jitterentropy RNG registers with
1802 the kernel crypto API and can be used by any caller.
1804 config CRYPTO_USER_API
1807 config CRYPTO_USER_API_HASH
1808 tristate "User-space interface for hash algorithms"
1811 select CRYPTO_USER_API
1813 This option enables the user-spaces interface for hash
1816 config CRYPTO_USER_API_SKCIPHER
1817 tristate "User-space interface for symmetric key cipher algorithms"
1819 select CRYPTO_SKCIPHER
1820 select CRYPTO_USER_API
1822 This option enables the user-spaces interface for symmetric
1823 key cipher algorithms.
1825 config CRYPTO_USER_API_RNG
1826 tristate "User-space interface for random number generator algorithms"
1829 select CRYPTO_USER_API
1831 This option enables the user-spaces interface for random
1832 number generator algorithms.
1834 config CRYPTO_USER_API_RNG_CAVP
1835 bool "Enable CAVP testing of DRBG"
1836 depends on CRYPTO_USER_API_RNG && CRYPTO_DRBG
1838 This option enables extra API for CAVP testing via the user-space
1839 interface: resetting of DRBG entropy, and providing Additional Data.
1840 This should only be enabled for CAVP testing. You should say
1841 no unless you know what this is.
1843 config CRYPTO_USER_API_AEAD
1844 tristate "User-space interface for AEAD cipher algorithms"
1847 select CRYPTO_SKCIPHER
1849 select CRYPTO_USER_API
1851 This option enables the user-spaces interface for AEAD
1854 config CRYPTO_USER_API_ENABLE_OBSOLETE
1855 bool "Enable obsolete cryptographic algorithms for userspace"
1856 depends on CRYPTO_USER_API
1859 Allow obsolete cryptographic algorithms to be selected that have
1860 already been phased out from internal use by the kernel, and are
1861 only useful for userspace clients that still rely on them.
1864 bool "Crypto usage statistics for User-space"
1865 depends on CRYPTO_USER
1867 This option enables the gathering of crypto stats.
1869 - encrypt/decrypt size and numbers of symmeric operations
1870 - compress/decompress size and numbers of compress operations
1871 - size and numbers of hash operations
1872 - encrypt/decrypt/sign/verify numbers for asymmetric operations
1873 - generate/seed numbers for rng operations
1875 config CRYPTO_HASH_INFO
1878 source "lib/crypto/Kconfig"
1879 source "drivers/crypto/Kconfig"
1880 source "crypto/asymmetric_keys/Kconfig"
1881 source "certs/Kconfig"