1 # SPDX-License-Identifier: GPL-2.0
3 # Generic algorithms support
9 # async_tx api: hardware offloaded memory transfer/transform support
11 source "crypto/async_tx/Kconfig"
14 # Cryptographic API Configuration
17 tristate "Cryptographic API"
19 This option provides the core Cryptographic API.
23 comment "Crypto core or helper"
26 bool "FIPS 200 compliance"
27 depends on (CRYPTO_ANSI_CPRNG || CRYPTO_DRBG) && !CRYPTO_MANAGER_DISABLE_TESTS
28 depends on (MODULE_SIG || !MODULES)
30 This option enables the fips boot option which is
31 required if you want the system to operate in a FIPS 200
32 certification. You should say no unless you know what
39 This option provides the API for cryptographic algorithms.
55 config CRYPTO_SKCIPHER
57 select CRYPTO_SKCIPHER2
60 config CRYPTO_SKCIPHER2
83 config CRYPTO_RNG_DEFAULT
85 select CRYPTO_DRBG_MENU
87 config CRYPTO_AKCIPHER2
91 config CRYPTO_AKCIPHER
93 select CRYPTO_AKCIPHER2
107 select CRYPTO_ALGAPI2
115 config CRYPTO_MANAGER
116 tristate "Cryptographic algorithm manager"
117 select CRYPTO_MANAGER2
119 Create default cryptographic template instantiations such as
122 config CRYPTO_MANAGER2
123 def_tristate CRYPTO_MANAGER || (CRYPTO_MANAGER!=n && CRYPTO_ALGAPI=y)
126 select CRYPTO_SKCIPHER2
127 select CRYPTO_AKCIPHER2
132 tristate "Userspace cryptographic algorithm configuration"
134 select CRYPTO_MANAGER
136 Userspace configuration for cryptographic instantiations such as
139 config CRYPTO_MANAGER_DISABLE_TESTS
140 bool "Disable run-time self tests"
143 Disable run-time self tests that normally take place at
144 algorithm registration.
146 config CRYPTO_MANAGER_EXTRA_TESTS
147 bool "Enable extra run-time crypto self tests"
148 depends on DEBUG_KERNEL && !CRYPTO_MANAGER_DISABLE_TESTS && CRYPTO_MANAGER
150 Enable extra run-time self tests of registered crypto algorithms,
151 including randomized fuzz tests.
153 This is intended for developer use only, as these tests take much
154 longer to run than the normal self tests.
156 config CRYPTO_GF128MUL
160 tristate "Null algorithms"
163 These are 'Null' algorithms, used by IPsec, which do nothing.
167 select CRYPTO_ALGAPI2
168 select CRYPTO_SKCIPHER2
172 tristate "Parallel crypto engine"
175 select CRYPTO_MANAGER
178 This converts an arbitrary crypto algorithm into a parallel
179 algorithm that executes in kernel threads.
182 tristate "Software async crypto daemon"
183 select CRYPTO_SKCIPHER
185 select CRYPTO_MANAGER
187 This is a generic software asynchronous crypto daemon that
188 converts an arbitrary synchronous software crypto algorithm
189 into an asynchronous algorithm that executes in a kernel thread.
191 config CRYPTO_AUTHENC
192 tristate "Authenc support"
194 select CRYPTO_SKCIPHER
195 select CRYPTO_MANAGER
199 Authenc: Combined mode wrapper for IPsec.
200 This is required for IPSec.
203 tristate "Testing module"
204 depends on m || EXPERT
205 select CRYPTO_MANAGER
207 Quick & dirty crypto test module.
216 comment "Public-key cryptography"
219 tristate "RSA algorithm"
220 select CRYPTO_AKCIPHER
221 select CRYPTO_MANAGER
225 Generic implementation of the RSA public key algorithm.
228 tristate "Diffie-Hellman algorithm"
232 Generic implementation of the Diffie-Hellman algorithm.
234 config CRYPTO_DH_RFC7919_GROUPS
235 bool "Support for RFC 7919 FFDHE group parameters"
237 select CRYPTO_RNG_DEFAULT
239 Provide support for RFC 7919 FFDHE group parameters. If unsure, say N.
243 select CRYPTO_RNG_DEFAULT
246 tristate "ECDH algorithm"
250 Generic implementation of the ECDH algorithm
253 tristate "ECDSA (NIST P192, P256 etc.) algorithm"
255 select CRYPTO_AKCIPHER
258 Elliptic Curve Digital Signature Algorithm (NIST P192, P256 etc.)
259 is A NIST cryptographic standard algorithm. Only signature verification
263 tristate "EC-RDSA (GOST 34.10) algorithm"
265 select CRYPTO_AKCIPHER
266 select CRYPTO_STREEBOG
270 Elliptic Curve Russian Digital Signature Algorithm (GOST R 34.10-2012,
271 RFC 7091, ISO/IEC 14888-3:2018) is one of the Russian cryptographic
272 standard algorithms (called GOST algorithms). Only signature verification
276 tristate "SM2 algorithm"
277 select CRYPTO_LIB_SM3
278 select CRYPTO_AKCIPHER
279 select CRYPTO_MANAGER
283 Generic implementation of the SM2 public key algorithm. It was
284 published by State Encryption Management Bureau, China.
285 as specified by OSCCA GM/T 0003.1-2012 -- 0003.5-2012.
288 https://tools.ietf.org/html/draft-shen-sm2-ecdsa-02
289 http://www.oscca.gov.cn/sca/xxgk/2010-12/17/content_1002386.shtml
290 http://www.gmbz.org.cn/main/bzlb.html
292 config CRYPTO_CURVE25519
293 tristate "Curve25519 algorithm"
295 select CRYPTO_LIB_CURVE25519_GENERIC
297 config CRYPTO_CURVE25519_X86
298 tristate "x86_64 accelerated Curve25519 scalar multiplication library"
299 depends on X86 && 64BIT
300 select CRYPTO_LIB_CURVE25519_GENERIC
301 select CRYPTO_ARCH_HAVE_LIB_CURVE25519
303 comment "Authenticated Encryption with Associated Data"
306 tristate "CCM support"
310 select CRYPTO_MANAGER
312 Support for Counter with CBC MAC. Required for IPsec.
315 tristate "GCM/GMAC support"
320 select CRYPTO_MANAGER
322 Support for Galois/Counter Mode (GCM) and Galois Message
323 Authentication Code (GMAC). Required for IPSec.
325 config CRYPTO_CHACHA20POLY1305
326 tristate "ChaCha20-Poly1305 AEAD support"
327 select CRYPTO_CHACHA20
328 select CRYPTO_POLY1305
330 select CRYPTO_MANAGER
332 ChaCha20-Poly1305 AEAD support, RFC7539.
334 Support for the AEAD wrapper using the ChaCha20 stream cipher combined
335 with the Poly1305 authenticator. It is defined in RFC7539 for use in
338 config CRYPTO_AEGIS128
339 tristate "AEGIS-128 AEAD algorithm"
341 select CRYPTO_AES # for AES S-box tables
343 Support for the AEGIS-128 dedicated AEAD algorithm.
345 config CRYPTO_AEGIS128_SIMD
346 bool "Support SIMD acceleration for AEGIS-128"
347 depends on CRYPTO_AEGIS128 && ((ARM || ARM64) && KERNEL_MODE_NEON)
350 config CRYPTO_AEGIS128_AESNI_SSE2
351 tristate "AEGIS-128 AEAD algorithm (x86_64 AESNI+SSE2 implementation)"
352 depends on X86 && 64BIT
356 AESNI+SSE2 implementation of the AEGIS-128 dedicated AEAD algorithm.
359 tristate "Sequence Number IV Generator"
361 select CRYPTO_SKCIPHER
363 select CRYPTO_RNG_DEFAULT
364 select CRYPTO_MANAGER
366 This IV generator generates an IV based on a sequence number by
367 xoring it with a salt. This algorithm is mainly useful for CTR
369 config CRYPTO_ECHAINIV
370 tristate "Encrypted Chain IV Generator"
373 select CRYPTO_RNG_DEFAULT
374 select CRYPTO_MANAGER
376 This IV generator generates an IV based on the encryption of
377 a sequence number xored with a salt. This is the default
380 comment "Block modes"
383 tristate "CBC support"
384 select CRYPTO_SKCIPHER
385 select CRYPTO_MANAGER
387 CBC: Cipher Block Chaining mode
388 This block cipher algorithm is required for IPSec.
391 tristate "CFB support"
392 select CRYPTO_SKCIPHER
393 select CRYPTO_MANAGER
395 CFB: Cipher FeedBack mode
396 This block cipher algorithm is required for TPM2 Cryptography.
399 tristate "CTR support"
400 select CRYPTO_SKCIPHER
401 select CRYPTO_MANAGER
404 This block cipher algorithm is required for IPSec.
407 tristate "CTS support"
408 select CRYPTO_SKCIPHER
409 select CRYPTO_MANAGER
411 CTS: Cipher Text Stealing
412 This is the Cipher Text Stealing mode as described by
413 Section 8 of rfc2040 and referenced by rfc3962
414 (rfc3962 includes errata information in its Appendix A) or
415 CBC-CS3 as defined by NIST in Sp800-38A addendum from Oct 2010.
416 This mode is required for Kerberos gss mechanism support
419 See: https://csrc.nist.gov/publications/detail/sp/800-38a/addendum/final
422 tristate "ECB support"
423 select CRYPTO_SKCIPHER
424 select CRYPTO_MANAGER
426 ECB: Electronic CodeBook mode
427 This is the simplest block cipher algorithm. It simply encrypts
428 the input block by block.
431 tristate "LRW support"
432 select CRYPTO_SKCIPHER
433 select CRYPTO_MANAGER
434 select CRYPTO_GF128MUL
437 LRW: Liskov Rivest Wagner, a tweakable, non malleable, non movable
438 narrow block cipher mode for dm-crypt. Use it with cipher
439 specification string aes-lrw-benbi, the key must be 256, 320 or 384.
440 The first 128, 192 or 256 bits in the key are used for AES and the
441 rest is used to tie each cipher block to its logical position.
444 tristate "OFB support"
445 select CRYPTO_SKCIPHER
446 select CRYPTO_MANAGER
448 OFB: the Output Feedback mode makes a block cipher into a synchronous
449 stream cipher. It generates keystream blocks, which are then XORed
450 with the plaintext blocks to get the ciphertext. Flipping a bit in the
451 ciphertext produces a flipped bit in the plaintext at the same
452 location. This property allows many error correcting codes to function
453 normally even when applied before encryption.
456 tristate "PCBC support"
457 select CRYPTO_SKCIPHER
458 select CRYPTO_MANAGER
460 PCBC: Propagating Cipher Block Chaining mode
461 This block cipher algorithm is required for RxRPC.
464 tristate "XTS support"
465 select CRYPTO_SKCIPHER
466 select CRYPTO_MANAGER
469 XTS: IEEE1619/D16 narrow block cipher use with aes-xts-plain,
470 key size 256, 384 or 512 bits. This implementation currently
471 can't handle a sectorsize which is not a multiple of 16 bytes.
473 config CRYPTO_KEYWRAP
474 tristate "Key wrapping support"
475 select CRYPTO_SKCIPHER
476 select CRYPTO_MANAGER
478 Support for key wrapping (NIST SP800-38F / RFC3394) without
481 config CRYPTO_NHPOLY1305
484 select CRYPTO_LIB_POLY1305_GENERIC
486 config CRYPTO_NHPOLY1305_SSE2
487 tristate "NHPoly1305 hash function (x86_64 SSE2 implementation)"
488 depends on X86 && 64BIT
489 select CRYPTO_NHPOLY1305
491 SSE2 optimized implementation of the hash function used by the
492 Adiantum encryption mode.
494 config CRYPTO_NHPOLY1305_AVX2
495 tristate "NHPoly1305 hash function (x86_64 AVX2 implementation)"
496 depends on X86 && 64BIT
497 select CRYPTO_NHPOLY1305
499 AVX2 optimized implementation of the hash function used by the
500 Adiantum encryption mode.
502 config CRYPTO_ADIANTUM
503 tristate "Adiantum support"
504 select CRYPTO_CHACHA20
505 select CRYPTO_LIB_POLY1305_GENERIC
506 select CRYPTO_NHPOLY1305
507 select CRYPTO_MANAGER
509 Adiantum is a tweakable, length-preserving encryption mode
510 designed for fast and secure disk encryption, especially on
511 CPUs without dedicated crypto instructions. It encrypts
512 each sector using the XChaCha12 stream cipher, two passes of
513 an ε-almost-∆-universal hash function, and an invocation of
514 the AES-256 block cipher on a single 16-byte block. On CPUs
515 without AES instructions, Adiantum is much faster than
518 Adiantum's security is provably reducible to that of its
519 underlying stream and block ciphers, subject to a security
520 bound. Unlike XTS, Adiantum is a true wide-block encryption
521 mode, so it actually provides an even stronger notion of
522 security than XTS, subject to the security bound.
527 tristate "ESSIV support for block encryption"
528 select CRYPTO_AUTHENC
530 Encrypted salt-sector initialization vector (ESSIV) is an IV
531 generation method that is used in some cases by fscrypt and/or
532 dm-crypt. It uses the hash of the block encryption key as the
533 symmetric key for a block encryption pass applied to the input
534 IV, making low entropy IV sources more suitable for block
537 This driver implements a crypto API template that can be
538 instantiated either as an skcipher or as an AEAD (depending on the
539 type of the first template argument), and which defers encryption
540 and decryption requests to the encapsulated cipher after applying
541 ESSIV to the input IV. Note that in the AEAD case, it is assumed
542 that the keys are presented in the same format used by the authenc
543 template, and that the IV appears at the end of the authenticated
544 associated data (AAD) region (which is how dm-crypt uses it.)
546 Note that the use of ESSIV is not recommended for new deployments,
547 and so this only needs to be enabled when interoperability with
548 existing encrypted volumes of filesystems is required, or when
549 building for a particular system that requires it (e.g., when
550 the SoC in question has accelerated CBC but not XTS, making CBC
551 combined with ESSIV the only feasible mode for h/w accelerated
557 tristate "CMAC support"
559 select CRYPTO_MANAGER
561 Cipher-based Message Authentication Code (CMAC) specified by
562 The National Institute of Standards and Technology (NIST).
564 https://tools.ietf.org/html/rfc4493
565 http://csrc.nist.gov/publications/nistpubs/800-38B/SP_800-38B.pdf
568 tristate "HMAC support"
570 select CRYPTO_MANAGER
572 HMAC: Keyed-Hashing for Message Authentication (RFC2104).
573 This is required for IPSec.
576 tristate "XCBC support"
578 select CRYPTO_MANAGER
580 XCBC: Keyed-Hashing with encryption algorithm
581 https://www.ietf.org/rfc/rfc3566.txt
582 http://csrc.nist.gov/encryption/modes/proposedmodes/
583 xcbc-mac/xcbc-mac-spec.pdf
586 tristate "VMAC support"
588 select CRYPTO_MANAGER
590 VMAC is a message authentication algorithm designed for
591 very high speed on 64-bit architectures.
594 <https://fastcrypto.org/vmac>
599 tristate "CRC32c CRC algorithm"
603 Castagnoli, et al Cyclic Redundancy-Check Algorithm. Used
604 by iSCSI for header and data digests and by others.
605 See Castagnoli93. Module will be crc32c.
607 config CRYPTO_CRC32C_INTEL
608 tristate "CRC32c INTEL hardware acceleration"
612 In Intel processor with SSE4.2 supported, the processor will
613 support CRC32C implementation using hardware accelerated CRC32
614 instruction. This option will create 'crc32c-intel' module,
615 which will enable any routine to use the CRC32 instruction to
616 gain performance compared with software implementation.
617 Module will be crc32c-intel.
619 config CRYPTO_CRC32C_VPMSUM
620 tristate "CRC32c CRC algorithm (powerpc64)"
621 depends on PPC64 && ALTIVEC
625 CRC32c algorithm implemented using vector polynomial multiply-sum
626 (vpmsum) instructions, introduced in POWER8. Enable on POWER8
627 and newer processors for improved performance.
630 config CRYPTO_CRC32C_SPARC64
631 tristate "CRC32c CRC algorithm (SPARC64)"
636 CRC32c CRC algorithm implemented using sparc64 crypto instructions,
640 tristate "CRC32 CRC algorithm"
644 CRC-32-IEEE 802.3 cyclic redundancy-check algorithm.
645 Shash crypto api wrappers to crc32_le function.
647 config CRYPTO_CRC32_PCLMUL
648 tristate "CRC32 PCLMULQDQ hardware acceleration"
653 From Intel Westmere and AMD Bulldozer processor with SSE4.2
654 and PCLMULQDQ supported, the processor will support
655 CRC32 PCLMULQDQ implementation using hardware accelerated PCLMULQDQ
656 instruction. This option will create 'crc32-pclmul' module,
657 which will enable any routine to use the CRC-32-IEEE 802.3 checksum
658 and gain better performance as compared with the table implementation.
660 config CRYPTO_CRC32_MIPS
661 tristate "CRC32c and CRC32 CRC algorithm (MIPS)"
662 depends on MIPS_CRC_SUPPORT
665 CRC32c and CRC32 CRC algorithms implemented using mips crypto
666 instructions, when available.
670 tristate "xxHash hash algorithm"
674 xxHash non-cryptographic hash algorithm. Extremely fast, working at
675 speeds close to RAM limits.
677 config CRYPTO_BLAKE2B
678 tristate "BLAKE2b digest algorithm"
681 Implementation of cryptographic hash function BLAKE2b (or just BLAKE2),
682 optimized for 64bit platforms and can produce digests of any size
683 between 1 to 64. The keyed hash is also implemented.
685 This module provides the following algorithms:
692 See https://blake2.net for further information.
694 config CRYPTO_BLAKE2S
695 tristate "BLAKE2s digest algorithm"
696 select CRYPTO_LIB_BLAKE2S_GENERIC
699 Implementation of cryptographic hash function BLAKE2s
700 optimized for 8-32bit platforms and can produce digests of any size
701 between 1 to 32. The keyed hash is also implemented.
703 This module provides the following algorithms:
710 See https://blake2.net for further information.
712 config CRYPTO_BLAKE2S_X86
713 tristate "BLAKE2s digest algorithm (x86 accelerated version)"
714 depends on X86 && 64BIT
715 select CRYPTO_LIB_BLAKE2S_GENERIC
716 select CRYPTO_ARCH_HAVE_LIB_BLAKE2S
718 config CRYPTO_CRCT10DIF
719 tristate "CRCT10DIF algorithm"
722 CRC T10 Data Integrity Field computation is being cast as
723 a crypto transform. This allows for faster crc t10 diff
724 transforms to be used if they are available.
726 config CRYPTO_CRCT10DIF_PCLMUL
727 tristate "CRCT10DIF PCLMULQDQ hardware acceleration"
728 depends on X86 && 64BIT && CRC_T10DIF
731 For x86_64 processors with SSE4.2 and PCLMULQDQ supported,
732 CRC T10 DIF PCLMULQDQ computation can be hardware
733 accelerated PCLMULQDQ instruction. This option will create
734 'crct10dif-pclmul' module, which is faster when computing the
735 crct10dif checksum as compared with the generic table implementation.
737 config CRYPTO_CRCT10DIF_VPMSUM
738 tristate "CRC32T10DIF powerpc64 hardware acceleration"
739 depends on PPC64 && ALTIVEC && CRC_T10DIF
742 CRC10T10DIF algorithm implemented using vector polynomial
743 multiply-sum (vpmsum) instructions, introduced in POWER8. Enable on
744 POWER8 and newer processors for improved performance.
746 config CRYPTO_VPMSUM_TESTER
747 tristate "Powerpc64 vpmsum hardware acceleration tester"
748 depends on CRYPTO_CRCT10DIF_VPMSUM && CRYPTO_CRC32C_VPMSUM
750 Stress test for CRC32c and CRC-T10DIF algorithms implemented with
751 POWER8 vpmsum instructions.
752 Unless you are testing these algorithms, you don't need this.
755 tristate "GHASH hash function"
756 select CRYPTO_GF128MUL
759 GHASH is the hash function used in GCM (Galois/Counter Mode).
760 It is not a general-purpose cryptographic hash function.
762 config CRYPTO_POLY1305
763 tristate "Poly1305 authenticator algorithm"
765 select CRYPTO_LIB_POLY1305_GENERIC
767 Poly1305 authenticator algorithm, RFC7539.
769 Poly1305 is an authenticator algorithm designed by Daniel J. Bernstein.
770 It is used for the ChaCha20-Poly1305 AEAD, specified in RFC7539 for use
771 in IETF protocols. This is the portable C implementation of Poly1305.
773 config CRYPTO_POLY1305_X86_64
774 tristate "Poly1305 authenticator algorithm (x86_64/SSE2/AVX2)"
775 depends on X86 && 64BIT
776 select CRYPTO_LIB_POLY1305_GENERIC
777 select CRYPTO_ARCH_HAVE_LIB_POLY1305
779 Poly1305 authenticator algorithm, RFC7539.
781 Poly1305 is an authenticator algorithm designed by Daniel J. Bernstein.
782 It is used for the ChaCha20-Poly1305 AEAD, specified in RFC7539 for use
783 in IETF protocols. This is the x86_64 assembler implementation using SIMD
786 config CRYPTO_POLY1305_MIPS
787 tristate "Poly1305 authenticator algorithm (MIPS optimized)"
789 select CRYPTO_ARCH_HAVE_LIB_POLY1305
792 tristate "MD4 digest algorithm"
795 MD4 message digest algorithm (RFC1320).
798 tristate "MD5 digest algorithm"
801 MD5 message digest algorithm (RFC1321).
803 config CRYPTO_MD5_OCTEON
804 tristate "MD5 digest algorithm (OCTEON)"
805 depends on CPU_CAVIUM_OCTEON
809 MD5 message digest algorithm (RFC1321) implemented
810 using OCTEON crypto instructions, when available.
812 config CRYPTO_MD5_PPC
813 tristate "MD5 digest algorithm (PPC)"
817 MD5 message digest algorithm (RFC1321) implemented
820 config CRYPTO_MD5_SPARC64
821 tristate "MD5 digest algorithm (SPARC64)"
826 MD5 message digest algorithm (RFC1321) implemented
827 using sparc64 crypto instructions, when available.
829 config CRYPTO_MICHAEL_MIC
830 tristate "Michael MIC keyed digest algorithm"
833 Michael MIC is used for message integrity protection in TKIP
834 (IEEE 802.11i). This algorithm is required for TKIP, but it
835 should not be used for other purposes because of the weakness
839 tristate "RIPEMD-160 digest algorithm"
842 RIPEMD-160 (ISO/IEC 10118-3:2004).
844 RIPEMD-160 is a 160-bit cryptographic hash function. It is intended
845 to be used as a secure replacement for the 128-bit hash functions
846 MD4, MD5 and it's predecessor RIPEMD
847 (not to be confused with RIPEMD-128).
849 It's speed is comparable to SHA1 and there are no known attacks
852 Developed by Hans Dobbertin, Antoon Bosselaers and Bart Preneel.
853 See <https://homes.esat.kuleuven.be/~bosselae/ripemd160.html>
856 tristate "SHA1 digest algorithm"
859 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2).
861 config CRYPTO_SHA1_SSSE3
862 tristate "SHA1 digest algorithm (SSSE3/AVX/AVX2/SHA-NI)"
863 depends on X86 && 64BIT
867 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2) implemented
868 using Supplemental SSE3 (SSSE3) instructions or Advanced Vector
869 Extensions (AVX/AVX2) or SHA-NI(SHA Extensions New Instructions),
872 config CRYPTO_SHA256_SSSE3
873 tristate "SHA256 digest algorithm (SSSE3/AVX/AVX2/SHA-NI)"
874 depends on X86 && 64BIT
878 SHA-256 secure hash standard (DFIPS 180-2) implemented
879 using Supplemental SSE3 (SSSE3) instructions, or Advanced Vector
880 Extensions version 1 (AVX1), or Advanced Vector Extensions
881 version 2 (AVX2) instructions, or SHA-NI (SHA Extensions New
882 Instructions) when available.
884 config CRYPTO_SHA512_SSSE3
885 tristate "SHA512 digest algorithm (SSSE3/AVX/AVX2)"
886 depends on X86 && 64BIT
890 SHA-512 secure hash standard (DFIPS 180-2) implemented
891 using Supplemental SSE3 (SSSE3) instructions, or Advanced Vector
892 Extensions version 1 (AVX1), or Advanced Vector Extensions
893 version 2 (AVX2) instructions, when available.
895 config CRYPTO_SHA1_OCTEON
896 tristate "SHA1 digest algorithm (OCTEON)"
897 depends on CPU_CAVIUM_OCTEON
901 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2) implemented
902 using OCTEON crypto instructions, when available.
904 config CRYPTO_SHA1_SPARC64
905 tristate "SHA1 digest algorithm (SPARC64)"
910 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2) implemented
911 using sparc64 crypto instructions, when available.
913 config CRYPTO_SHA1_PPC
914 tristate "SHA1 digest algorithm (powerpc)"
917 This is the powerpc hardware accelerated implementation of the
918 SHA-1 secure hash standard (FIPS 180-1/DFIPS 180-2).
920 config CRYPTO_SHA1_PPC_SPE
921 tristate "SHA1 digest algorithm (PPC SPE)"
922 depends on PPC && SPE
924 SHA-1 secure hash standard (DFIPS 180-4) implemented
925 using powerpc SPE SIMD instruction set.
928 tristate "SHA224 and SHA256 digest algorithm"
930 select CRYPTO_LIB_SHA256
932 SHA256 secure hash standard (DFIPS 180-2).
934 This version of SHA implements a 256 bit hash with 128 bits of
935 security against collision attacks.
937 This code also includes SHA-224, a 224 bit hash with 112 bits
938 of security against collision attacks.
940 config CRYPTO_SHA256_PPC_SPE
941 tristate "SHA224 and SHA256 digest algorithm (PPC SPE)"
942 depends on PPC && SPE
946 SHA224 and SHA256 secure hash standard (DFIPS 180-2)
947 implemented using powerpc SPE SIMD instruction set.
949 config CRYPTO_SHA256_OCTEON
950 tristate "SHA224 and SHA256 digest algorithm (OCTEON)"
951 depends on CPU_CAVIUM_OCTEON
955 SHA-256 secure hash standard (DFIPS 180-2) implemented
956 using OCTEON crypto instructions, when available.
958 config CRYPTO_SHA256_SPARC64
959 tristate "SHA224 and SHA256 digest algorithm (SPARC64)"
964 SHA-256 secure hash standard (DFIPS 180-2) implemented
965 using sparc64 crypto instructions, when available.
968 tristate "SHA384 and SHA512 digest algorithms"
971 SHA512 secure hash standard (DFIPS 180-2).
973 This version of SHA implements a 512 bit hash with 256 bits of
974 security against collision attacks.
976 This code also includes SHA-384, a 384 bit hash with 192 bits
977 of security against collision attacks.
979 config CRYPTO_SHA512_OCTEON
980 tristate "SHA384 and SHA512 digest algorithms (OCTEON)"
981 depends on CPU_CAVIUM_OCTEON
985 SHA-512 secure hash standard (DFIPS 180-2) implemented
986 using OCTEON crypto instructions, when available.
988 config CRYPTO_SHA512_SPARC64
989 tristate "SHA384 and SHA512 digest algorithm (SPARC64)"
994 SHA-512 secure hash standard (DFIPS 180-2) implemented
995 using sparc64 crypto instructions, when available.
998 tristate "SHA3 digest algorithm"
1001 SHA-3 secure hash standard (DFIPS 202). It's based on
1002 cryptographic sponge function family called Keccak.
1005 http://keccak.noekeon.org/
1008 tristate "SM3 digest algorithm"
1010 select CRYPTO_LIB_SM3
1012 SM3 secure hash function as defined by OSCCA GM/T 0004-2012 SM3).
1013 It is part of the Chinese Commercial Cryptography suite.
1016 http://www.oscca.gov.cn/UpFile/20101222141857786.pdf
1017 https://datatracker.ietf.org/doc/html/draft-shen-sm3-hash
1019 config CRYPTO_SM3_AVX_X86_64
1020 tristate "SM3 digest algorithm (x86_64/AVX)"
1021 depends on X86 && 64BIT
1023 select CRYPTO_LIB_SM3
1025 SM3 secure hash function as defined by OSCCA GM/T 0004-2012 SM3).
1026 It is part of the Chinese Commercial Cryptography suite. This is
1027 SM3 optimized implementation using Advanced Vector Extensions (AVX)
1032 config CRYPTO_STREEBOG
1033 tristate "Streebog Hash Function"
1036 Streebog Hash Function (GOST R 34.11-2012, RFC 6986) is one of the Russian
1037 cryptographic standard algorithms (called GOST algorithms).
1038 This setting enables two hash algorithms with 256 and 512 bits output.
1041 https://tc26.ru/upload/iblock/fed/feddbb4d26b685903faa2ba11aea43f6.pdf
1042 https://tools.ietf.org/html/rfc6986
1045 tristate "Whirlpool digest algorithms"
1048 Whirlpool hash algorithm 512, 384 and 256-bit hashes
1050 Whirlpool-512 is part of the NESSIE cryptographic primitives.
1051 Whirlpool will be part of the ISO/IEC 10118-3:2003(E) standard
1054 <http://www.larc.usp.br/~pbarreto/WhirlpoolPage.html>
1056 config CRYPTO_GHASH_CLMUL_NI_INTEL
1057 tristate "GHASH hash function (CLMUL-NI accelerated)"
1058 depends on X86 && 64BIT
1059 select CRYPTO_CRYPTD
1061 This is the x86_64 CLMUL-NI accelerated implementation of
1062 GHASH, the hash function used in GCM (Galois/Counter mode).
1067 tristate "AES cipher algorithms"
1068 select CRYPTO_ALGAPI
1069 select CRYPTO_LIB_AES
1071 AES cipher algorithms (FIPS-197). AES uses the Rijndael
1074 Rijndael appears to be consistently a very good performer in
1075 both hardware and software across a wide range of computing
1076 environments regardless of its use in feedback or non-feedback
1077 modes. Its key setup time is excellent, and its key agility is
1078 good. Rijndael's very low memory requirements make it very well
1079 suited for restricted-space environments, in which it also
1080 demonstrates excellent performance. Rijndael's operations are
1081 among the easiest to defend against power and timing attacks.
1083 The AES specifies three key sizes: 128, 192 and 256 bits
1085 See <http://csrc.nist.gov/CryptoToolkit/aes/> for more information.
1087 config CRYPTO_AES_TI
1088 tristate "Fixed time AES cipher"
1089 select CRYPTO_ALGAPI
1090 select CRYPTO_LIB_AES
1092 This is a generic implementation of AES that attempts to eliminate
1093 data dependent latencies as much as possible without affecting
1094 performance too much. It is intended for use by the generic CCM
1095 and GCM drivers, and other CTR or CMAC/XCBC based modes that rely
1096 solely on encryption (although decryption is supported as well, but
1097 with a more dramatic performance hit)
1099 Instead of using 16 lookup tables of 1 KB each, (8 for encryption and
1100 8 for decryption), this implementation only uses just two S-boxes of
1101 256 bytes each, and attempts to eliminate data dependent latencies by
1102 prefetching the entire table into the cache at the start of each
1103 block. Interrupts are also disabled to avoid races where cachelines
1104 are evicted when the CPU is interrupted to do something else.
1106 config CRYPTO_AES_NI_INTEL
1107 tristate "AES cipher algorithms (AES-NI)"
1110 select CRYPTO_LIB_AES
1111 select CRYPTO_ALGAPI
1112 select CRYPTO_SKCIPHER
1115 Use Intel AES-NI instructions for AES algorithm.
1117 AES cipher algorithms (FIPS-197). AES uses the Rijndael
1120 Rijndael appears to be consistently a very good performer in
1121 both hardware and software across a wide range of computing
1122 environments regardless of its use in feedback or non-feedback
1123 modes. Its key setup time is excellent, and its key agility is
1124 good. Rijndael's very low memory requirements make it very well
1125 suited for restricted-space environments, in which it also
1126 demonstrates excellent performance. Rijndael's operations are
1127 among the easiest to defend against power and timing attacks.
1129 The AES specifies three key sizes: 128, 192 and 256 bits
1131 See <http://csrc.nist.gov/encryption/aes/> for more information.
1133 In addition to AES cipher algorithm support, the acceleration
1134 for some popular block cipher mode is supported too, including
1135 ECB, CBC, LRW, XTS. The 64 bit version has additional
1136 acceleration for CTR.
1138 config CRYPTO_AES_SPARC64
1139 tristate "AES cipher algorithms (SPARC64)"
1141 select CRYPTO_SKCIPHER
1143 Use SPARC64 crypto opcodes for AES algorithm.
1145 AES cipher algorithms (FIPS-197). AES uses the Rijndael
1148 Rijndael appears to be consistently a very good performer in
1149 both hardware and software across a wide range of computing
1150 environments regardless of its use in feedback or non-feedback
1151 modes. Its key setup time is excellent, and its key agility is
1152 good. Rijndael's very low memory requirements make it very well
1153 suited for restricted-space environments, in which it also
1154 demonstrates excellent performance. Rijndael's operations are
1155 among the easiest to defend against power and timing attacks.
1157 The AES specifies three key sizes: 128, 192 and 256 bits
1159 See <http://csrc.nist.gov/encryption/aes/> for more information.
1161 In addition to AES cipher algorithm support, the acceleration
1162 for some popular block cipher mode is supported too, including
1165 config CRYPTO_AES_PPC_SPE
1166 tristate "AES cipher algorithms (PPC SPE)"
1167 depends on PPC && SPE
1168 select CRYPTO_SKCIPHER
1170 AES cipher algorithms (FIPS-197). Additionally the acceleration
1171 for popular block cipher modes ECB, CBC, CTR and XTS is supported.
1172 This module should only be used for low power (router) devices
1173 without hardware AES acceleration (e.g. caam crypto). It reduces the
1174 size of the AES tables from 16KB to 8KB + 256 bytes and mitigates
1175 timining attacks. Nevertheless it might be not as secure as other
1176 architecture specific assembler implementations that work on 1KB
1177 tables or 256 bytes S-boxes.
1179 config CRYPTO_ANUBIS
1180 tristate "Anubis cipher algorithm"
1181 depends on CRYPTO_USER_API_ENABLE_OBSOLETE
1182 select CRYPTO_ALGAPI
1184 Anubis cipher algorithm.
1186 Anubis is a variable key length cipher which can use keys from
1187 128 bits to 320 bits in length. It was evaluated as a entrant
1188 in the NESSIE competition.
1191 <https://www.cosic.esat.kuleuven.be/nessie/reports/>
1192 <http://www.larc.usp.br/~pbarreto/AnubisPage.html>
1195 tristate "ARC4 cipher algorithm"
1196 depends on CRYPTO_USER_API_ENABLE_OBSOLETE
1197 select CRYPTO_SKCIPHER
1198 select CRYPTO_LIB_ARC4
1200 ARC4 cipher algorithm.
1202 ARC4 is a stream cipher using keys ranging from 8 bits to 2048
1203 bits in length. This algorithm is required for driver-based
1204 WEP, but it should not be for other purposes because of the
1205 weakness of the algorithm.
1207 config CRYPTO_BLOWFISH
1208 tristate "Blowfish cipher algorithm"
1209 select CRYPTO_ALGAPI
1210 select CRYPTO_BLOWFISH_COMMON
1212 Blowfish cipher algorithm, by Bruce Schneier.
1214 This is a variable key length cipher which can use keys from 32
1215 bits to 448 bits in length. It's fast, simple and specifically
1216 designed for use on "large microprocessors".
1219 <https://www.schneier.com/blowfish.html>
1221 config CRYPTO_BLOWFISH_COMMON
1224 Common parts of the Blowfish cipher algorithm shared by the
1225 generic c and the assembler implementations.
1228 <https://www.schneier.com/blowfish.html>
1230 config CRYPTO_BLOWFISH_X86_64
1231 tristate "Blowfish cipher algorithm (x86_64)"
1232 depends on X86 && 64BIT
1233 select CRYPTO_SKCIPHER
1234 select CRYPTO_BLOWFISH_COMMON
1237 Blowfish cipher algorithm (x86_64), by Bruce Schneier.
1239 This is a variable key length cipher which can use keys from 32
1240 bits to 448 bits in length. It's fast, simple and specifically
1241 designed for use on "large microprocessors".
1244 <https://www.schneier.com/blowfish.html>
1246 config CRYPTO_CAMELLIA
1247 tristate "Camellia cipher algorithms"
1248 select CRYPTO_ALGAPI
1250 Camellia cipher algorithms module.
1252 Camellia is a symmetric key block cipher developed jointly
1253 at NTT and Mitsubishi Electric Corporation.
1255 The Camellia specifies three key sizes: 128, 192 and 256 bits.
1258 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
1260 config CRYPTO_CAMELLIA_X86_64
1261 tristate "Camellia cipher algorithm (x86_64)"
1262 depends on X86 && 64BIT
1263 select CRYPTO_SKCIPHER
1266 Camellia cipher algorithm module (x86_64).
1268 Camellia is a symmetric key block cipher developed jointly
1269 at NTT and Mitsubishi Electric Corporation.
1271 The Camellia specifies three key sizes: 128, 192 and 256 bits.
1274 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
1276 config CRYPTO_CAMELLIA_AESNI_AVX_X86_64
1277 tristate "Camellia cipher algorithm (x86_64/AES-NI/AVX)"
1278 depends on X86 && 64BIT
1279 select CRYPTO_SKCIPHER
1280 select CRYPTO_CAMELLIA_X86_64
1284 Camellia cipher algorithm module (x86_64/AES-NI/AVX).
1286 Camellia is a symmetric key block cipher developed jointly
1287 at NTT and Mitsubishi Electric Corporation.
1289 The Camellia specifies three key sizes: 128, 192 and 256 bits.
1292 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
1294 config CRYPTO_CAMELLIA_AESNI_AVX2_X86_64
1295 tristate "Camellia cipher algorithm (x86_64/AES-NI/AVX2)"
1296 depends on X86 && 64BIT
1297 select CRYPTO_CAMELLIA_AESNI_AVX_X86_64
1299 Camellia cipher algorithm module (x86_64/AES-NI/AVX2).
1301 Camellia is a symmetric key block cipher developed jointly
1302 at NTT and Mitsubishi Electric Corporation.
1304 The Camellia specifies three key sizes: 128, 192 and 256 bits.
1307 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
1309 config CRYPTO_CAMELLIA_SPARC64
1310 tristate "Camellia cipher algorithm (SPARC64)"
1312 select CRYPTO_ALGAPI
1313 select CRYPTO_SKCIPHER
1315 Camellia cipher algorithm module (SPARC64).
1317 Camellia is a symmetric key block cipher developed jointly
1318 at NTT and Mitsubishi Electric Corporation.
1320 The Camellia specifies three key sizes: 128, 192 and 256 bits.
1323 <https://info.isl.ntt.co.jp/crypt/eng/camellia/index_s.html>
1325 config CRYPTO_CAST_COMMON
1328 Common parts of the CAST cipher algorithms shared by the
1329 generic c and the assembler implementations.
1332 tristate "CAST5 (CAST-128) cipher algorithm"
1333 select CRYPTO_ALGAPI
1334 select CRYPTO_CAST_COMMON
1336 The CAST5 encryption algorithm (synonymous with CAST-128) is
1337 described in RFC2144.
1339 config CRYPTO_CAST5_AVX_X86_64
1340 tristate "CAST5 (CAST-128) cipher algorithm (x86_64/AVX)"
1341 depends on X86 && 64BIT
1342 select CRYPTO_SKCIPHER
1344 select CRYPTO_CAST_COMMON
1348 The CAST5 encryption algorithm (synonymous with CAST-128) is
1349 described in RFC2144.
1351 This module provides the Cast5 cipher algorithm that processes
1352 sixteen blocks parallel using the AVX instruction set.
1355 tristate "CAST6 (CAST-256) cipher algorithm"
1356 select CRYPTO_ALGAPI
1357 select CRYPTO_CAST_COMMON
1359 The CAST6 encryption algorithm (synonymous with CAST-256) is
1360 described in RFC2612.
1362 config CRYPTO_CAST6_AVX_X86_64
1363 tristate "CAST6 (CAST-256) cipher algorithm (x86_64/AVX)"
1364 depends on X86 && 64BIT
1365 select CRYPTO_SKCIPHER
1367 select CRYPTO_CAST_COMMON
1372 The CAST6 encryption algorithm (synonymous with CAST-256) is
1373 described in RFC2612.
1375 This module provides the Cast6 cipher algorithm that processes
1376 eight blocks parallel using the AVX instruction set.
1379 tristate "DES and Triple DES EDE cipher algorithms"
1380 select CRYPTO_ALGAPI
1381 select CRYPTO_LIB_DES
1383 DES cipher algorithm (FIPS 46-2), and Triple DES EDE (FIPS 46-3).
1385 config CRYPTO_DES_SPARC64
1386 tristate "DES and Triple DES EDE cipher algorithms (SPARC64)"
1388 select CRYPTO_ALGAPI
1389 select CRYPTO_LIB_DES
1390 select CRYPTO_SKCIPHER
1392 DES cipher algorithm (FIPS 46-2), and Triple DES EDE (FIPS 46-3),
1393 optimized using SPARC64 crypto opcodes.
1395 config CRYPTO_DES3_EDE_X86_64
1396 tristate "Triple DES EDE cipher algorithm (x86-64)"
1397 depends on X86 && 64BIT
1398 select CRYPTO_SKCIPHER
1399 select CRYPTO_LIB_DES
1402 Triple DES EDE (FIPS 46-3) algorithm.
1404 This module provides implementation of the Triple DES EDE cipher
1405 algorithm that is optimized for x86-64 processors. Two versions of
1406 algorithm are provided; regular processing one input block and
1407 one that processes three blocks parallel.
1409 config CRYPTO_FCRYPT
1410 tristate "FCrypt cipher algorithm"
1411 select CRYPTO_ALGAPI
1412 select CRYPTO_SKCIPHER
1414 FCrypt algorithm used by RxRPC.
1416 config CRYPTO_KHAZAD
1417 tristate "Khazad cipher algorithm"
1418 depends on CRYPTO_USER_API_ENABLE_OBSOLETE
1419 select CRYPTO_ALGAPI
1421 Khazad cipher algorithm.
1423 Khazad was a finalist in the initial NESSIE competition. It is
1424 an algorithm optimized for 64-bit processors with good performance
1425 on 32-bit processors. Khazad uses an 128 bit key size.
1428 <http://www.larc.usp.br/~pbarreto/KhazadPage.html>
1430 config CRYPTO_CHACHA20
1431 tristate "ChaCha stream cipher algorithms"
1432 select CRYPTO_LIB_CHACHA_GENERIC
1433 select CRYPTO_SKCIPHER
1435 The ChaCha20, XChaCha20, and XChaCha12 stream cipher algorithms.
1437 ChaCha20 is a 256-bit high-speed stream cipher designed by Daniel J.
1438 Bernstein and further specified in RFC7539 for use in IETF protocols.
1439 This is the portable C implementation of ChaCha20. See also:
1440 <https://cr.yp.to/chacha/chacha-20080128.pdf>
1442 XChaCha20 is the application of the XSalsa20 construction to ChaCha20
1443 rather than to Salsa20. XChaCha20 extends ChaCha20's nonce length
1444 from 64 bits (or 96 bits using the RFC7539 convention) to 192 bits,
1445 while provably retaining ChaCha20's security. See also:
1446 <https://cr.yp.to/snuffle/xsalsa-20081128.pdf>
1448 XChaCha12 is XChaCha20 reduced to 12 rounds, with correspondingly
1449 reduced security margin but increased performance. It can be needed
1450 in some performance-sensitive scenarios.
1452 config CRYPTO_CHACHA20_X86_64
1453 tristate "ChaCha stream cipher algorithms (x86_64/SSSE3/AVX2/AVX-512VL)"
1454 depends on X86 && 64BIT
1455 select CRYPTO_SKCIPHER
1456 select CRYPTO_LIB_CHACHA_GENERIC
1457 select CRYPTO_ARCH_HAVE_LIB_CHACHA
1459 SSSE3, AVX2, and AVX-512VL optimized implementations of the ChaCha20,
1460 XChaCha20, and XChaCha12 stream ciphers.
1462 config CRYPTO_CHACHA_MIPS
1463 tristate "ChaCha stream cipher algorithms (MIPS 32r2 optimized)"
1464 depends on CPU_MIPS32_R2
1465 select CRYPTO_SKCIPHER
1466 select CRYPTO_ARCH_HAVE_LIB_CHACHA
1469 tristate "SEED cipher algorithm"
1470 depends on CRYPTO_USER_API_ENABLE_OBSOLETE
1471 select CRYPTO_ALGAPI
1473 SEED cipher algorithm (RFC4269).
1475 SEED is a 128-bit symmetric key block cipher that has been
1476 developed by KISA (Korea Information Security Agency) as a
1477 national standard encryption algorithm of the Republic of Korea.
1478 It is a 16 round block cipher with the key size of 128 bit.
1481 <http://www.kisa.or.kr/kisa/seed/jsp/seed_eng.jsp>
1483 config CRYPTO_SERPENT
1484 tristate "Serpent cipher algorithm"
1485 select CRYPTO_ALGAPI
1487 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1489 Keys are allowed to be from 0 to 256 bits in length, in steps
1493 <https://www.cl.cam.ac.uk/~rja14/serpent.html>
1495 config CRYPTO_SERPENT_SSE2_X86_64
1496 tristate "Serpent cipher algorithm (x86_64/SSE2)"
1497 depends on X86 && 64BIT
1498 select CRYPTO_SKCIPHER
1499 select CRYPTO_SERPENT
1503 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1505 Keys are allowed to be from 0 to 256 bits in length, in steps
1508 This module provides Serpent cipher algorithm that processes eight
1509 blocks parallel using SSE2 instruction set.
1512 <https://www.cl.cam.ac.uk/~rja14/serpent.html>
1514 config CRYPTO_SERPENT_SSE2_586
1515 tristate "Serpent cipher algorithm (i586/SSE2)"
1516 depends on X86 && !64BIT
1517 select CRYPTO_SKCIPHER
1518 select CRYPTO_SERPENT
1522 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1524 Keys are allowed to be from 0 to 256 bits in length, in steps
1527 This module provides Serpent cipher algorithm that processes four
1528 blocks parallel using SSE2 instruction set.
1531 <https://www.cl.cam.ac.uk/~rja14/serpent.html>
1533 config CRYPTO_SERPENT_AVX_X86_64
1534 tristate "Serpent cipher algorithm (x86_64/AVX)"
1535 depends on X86 && 64BIT
1536 select CRYPTO_SKCIPHER
1537 select CRYPTO_SERPENT
1542 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1544 Keys are allowed to be from 0 to 256 bits in length, in steps
1547 This module provides the Serpent cipher algorithm that processes
1548 eight blocks parallel using the AVX instruction set.
1551 <https://www.cl.cam.ac.uk/~rja14/serpent.html>
1553 config CRYPTO_SERPENT_AVX2_X86_64
1554 tristate "Serpent cipher algorithm (x86_64/AVX2)"
1555 depends on X86 && 64BIT
1556 select CRYPTO_SERPENT_AVX_X86_64
1558 Serpent cipher algorithm, by Anderson, Biham & Knudsen.
1560 Keys are allowed to be from 0 to 256 bits in length, in steps
1563 This module provides Serpent cipher algorithm that processes 16
1564 blocks parallel using AVX2 instruction set.
1567 <https://www.cl.cam.ac.uk/~rja14/serpent.html>
1570 tristate "SM4 cipher algorithm"
1571 select CRYPTO_ALGAPI
1572 select CRYPTO_LIB_SM4
1574 SM4 cipher algorithms (OSCCA GB/T 32907-2016).
1576 SM4 (GBT.32907-2016) is a cryptographic standard issued by the
1577 Organization of State Commercial Administration of China (OSCCA)
1578 as an authorized cryptographic algorithms for the use within China.
1580 SMS4 was originally created for use in protecting wireless
1581 networks, and is mandated in the Chinese National Standard for
1582 Wireless LAN WAPI (Wired Authentication and Privacy Infrastructure)
1585 The latest SM4 standard (GBT.32907-2016) was proposed by OSCCA and
1586 standardized through TC 260 of the Standardization Administration
1587 of the People's Republic of China (SAC).
1589 The input, output, and key of SMS4 are each 128 bits.
1591 See also: <https://eprint.iacr.org/2008/329.pdf>
1595 config CRYPTO_SM4_AESNI_AVX_X86_64
1596 tristate "SM4 cipher algorithm (x86_64/AES-NI/AVX)"
1597 depends on X86 && 64BIT
1598 select CRYPTO_SKCIPHER
1600 select CRYPTO_ALGAPI
1601 select CRYPTO_LIB_SM4
1603 SM4 cipher algorithms (OSCCA GB/T 32907-2016) (x86_64/AES-NI/AVX).
1605 SM4 (GBT.32907-2016) is a cryptographic standard issued by the
1606 Organization of State Commercial Administration of China (OSCCA)
1607 as an authorized cryptographic algorithms for the use within China.
1609 This is SM4 optimized implementation using AES-NI/AVX/x86_64
1610 instruction set for block cipher. Through two affine transforms,
1611 we can use the AES S-Box to simulate the SM4 S-Box to achieve the
1612 effect of instruction acceleration.
1616 config CRYPTO_SM4_AESNI_AVX2_X86_64
1617 tristate "SM4 cipher algorithm (x86_64/AES-NI/AVX2)"
1618 depends on X86 && 64BIT
1619 select CRYPTO_SKCIPHER
1621 select CRYPTO_ALGAPI
1622 select CRYPTO_LIB_SM4
1623 select CRYPTO_SM4_AESNI_AVX_X86_64
1625 SM4 cipher algorithms (OSCCA GB/T 32907-2016) (x86_64/AES-NI/AVX2).
1627 SM4 (GBT.32907-2016) is a cryptographic standard issued by the
1628 Organization of State Commercial Administration of China (OSCCA)
1629 as an authorized cryptographic algorithms for the use within China.
1631 This is SM4 optimized implementation using AES-NI/AVX2/x86_64
1632 instruction set for block cipher. Through two affine transforms,
1633 we can use the AES S-Box to simulate the SM4 S-Box to achieve the
1634 effect of instruction acceleration.
1639 tristate "TEA, XTEA and XETA cipher algorithms"
1640 depends on CRYPTO_USER_API_ENABLE_OBSOLETE
1641 select CRYPTO_ALGAPI
1643 TEA cipher algorithm.
1645 Tiny Encryption Algorithm is a simple cipher that uses
1646 many rounds for security. It is very fast and uses
1649 Xtendend Tiny Encryption Algorithm is a modification to
1650 the TEA algorithm to address a potential key weakness
1651 in the TEA algorithm.
1653 Xtendend Encryption Tiny Algorithm is a mis-implementation
1654 of the XTEA algorithm for compatibility purposes.
1656 config CRYPTO_TWOFISH
1657 tristate "Twofish cipher algorithm"
1658 select CRYPTO_ALGAPI
1659 select CRYPTO_TWOFISH_COMMON
1661 Twofish cipher algorithm.
1663 Twofish was submitted as an AES (Advanced Encryption Standard)
1664 candidate cipher by researchers at CounterPane Systems. It is a
1665 16 round block cipher supporting key sizes of 128, 192, and 256
1669 <https://www.schneier.com/twofish.html>
1671 config CRYPTO_TWOFISH_COMMON
1674 Common parts of the Twofish cipher algorithm shared by the
1675 generic c and the assembler implementations.
1677 config CRYPTO_TWOFISH_586
1678 tristate "Twofish cipher algorithms (i586)"
1679 depends on (X86 || UML_X86) && !64BIT
1680 select CRYPTO_ALGAPI
1681 select CRYPTO_TWOFISH_COMMON
1684 Twofish cipher algorithm.
1686 Twofish was submitted as an AES (Advanced Encryption Standard)
1687 candidate cipher by researchers at CounterPane Systems. It is a
1688 16 round block cipher supporting key sizes of 128, 192, and 256
1692 <https://www.schneier.com/twofish.html>
1694 config CRYPTO_TWOFISH_X86_64
1695 tristate "Twofish cipher algorithm (x86_64)"
1696 depends on (X86 || UML_X86) && 64BIT
1697 select CRYPTO_ALGAPI
1698 select CRYPTO_TWOFISH_COMMON
1701 Twofish cipher algorithm (x86_64).
1703 Twofish was submitted as an AES (Advanced Encryption Standard)
1704 candidate cipher by researchers at CounterPane Systems. It is a
1705 16 round block cipher supporting key sizes of 128, 192, and 256
1709 <https://www.schneier.com/twofish.html>
1711 config CRYPTO_TWOFISH_X86_64_3WAY
1712 tristate "Twofish cipher algorithm (x86_64, 3-way parallel)"
1713 depends on X86 && 64BIT
1714 select CRYPTO_SKCIPHER
1715 select CRYPTO_TWOFISH_COMMON
1716 select CRYPTO_TWOFISH_X86_64
1718 Twofish cipher algorithm (x86_64, 3-way parallel).
1720 Twofish was submitted as an AES (Advanced Encryption Standard)
1721 candidate cipher by researchers at CounterPane Systems. It is a
1722 16 round block cipher supporting key sizes of 128, 192, and 256
1725 This module provides Twofish cipher algorithm that processes three
1726 blocks parallel, utilizing resources of out-of-order CPUs better.
1729 <https://www.schneier.com/twofish.html>
1731 config CRYPTO_TWOFISH_AVX_X86_64
1732 tristate "Twofish cipher algorithm (x86_64/AVX)"
1733 depends on X86 && 64BIT
1734 select CRYPTO_SKCIPHER
1736 select CRYPTO_TWOFISH_COMMON
1737 select CRYPTO_TWOFISH_X86_64
1738 select CRYPTO_TWOFISH_X86_64_3WAY
1741 Twofish cipher algorithm (x86_64/AVX).
1743 Twofish was submitted as an AES (Advanced Encryption Standard)
1744 candidate cipher by researchers at CounterPane Systems. It is a
1745 16 round block cipher supporting key sizes of 128, 192, and 256
1748 This module provides the Twofish cipher algorithm that processes
1749 eight blocks parallel using the AVX Instruction Set.
1752 <https://www.schneier.com/twofish.html>
1754 comment "Compression"
1756 config CRYPTO_DEFLATE
1757 tristate "Deflate compression algorithm"
1758 select CRYPTO_ALGAPI
1759 select CRYPTO_ACOMP2
1763 This is the Deflate algorithm (RFC1951), specified for use in
1764 IPSec with the IPCOMP protocol (RFC3173, RFC2394).
1766 You will most probably want this if using IPSec.
1769 tristate "LZO compression algorithm"
1770 select CRYPTO_ALGAPI
1771 select CRYPTO_ACOMP2
1773 select LZO_DECOMPRESS
1775 This is the LZO algorithm.
1778 tristate "842 compression algorithm"
1779 select CRYPTO_ALGAPI
1780 select CRYPTO_ACOMP2
1782 select 842_DECOMPRESS
1784 This is the 842 algorithm.
1787 tristate "LZ4 compression algorithm"
1788 select CRYPTO_ALGAPI
1789 select CRYPTO_ACOMP2
1791 select LZ4_DECOMPRESS
1793 This is the LZ4 algorithm.
1796 tristate "LZ4HC compression algorithm"
1797 select CRYPTO_ALGAPI
1798 select CRYPTO_ACOMP2
1799 select LZ4HC_COMPRESS
1800 select LZ4_DECOMPRESS
1802 This is the LZ4 high compression mode algorithm.
1805 tristate "Zstd compression algorithm"
1806 select CRYPTO_ALGAPI
1807 select CRYPTO_ACOMP2
1808 select ZSTD_COMPRESS
1809 select ZSTD_DECOMPRESS
1811 This is the zstd algorithm.
1813 comment "Random Number Generation"
1815 config CRYPTO_ANSI_CPRNG
1816 tristate "Pseudo Random Number Generation for Cryptographic modules"
1820 This option enables the generic pseudo random number generator
1821 for cryptographic modules. Uses the Algorithm specified in
1822 ANSI X9.31 A.2.4. Note that this option must be enabled if
1823 CRYPTO_FIPS is selected
1825 menuconfig CRYPTO_DRBG_MENU
1826 tristate "NIST SP800-90A DRBG"
1828 NIST SP800-90A compliant DRBG. In the following submenu, one or
1829 more of the DRBG types must be selected.
1833 config CRYPTO_DRBG_HMAC
1837 select CRYPTO_SHA512
1839 config CRYPTO_DRBG_HASH
1840 bool "Enable Hash DRBG"
1841 select CRYPTO_SHA256
1843 Enable the Hash DRBG variant as defined in NIST SP800-90A.
1845 config CRYPTO_DRBG_CTR
1846 bool "Enable CTR DRBG"
1850 Enable the CTR DRBG variant as defined in NIST SP800-90A.
1854 default CRYPTO_DRBG_MENU
1856 select CRYPTO_JITTERENTROPY
1858 endif # if CRYPTO_DRBG_MENU
1860 config CRYPTO_JITTERENTROPY
1861 tristate "Jitterentropy Non-Deterministic Random Number Generator"
1864 The Jitterentropy RNG is a noise that is intended
1865 to provide seed to another RNG. The RNG does not
1866 perform any cryptographic whitening of the generated
1867 random numbers. This Jitterentropy RNG registers with
1868 the kernel crypto API and can be used by any caller.
1870 config CRYPTO_KDF800108_CTR
1873 select CRYPTO_SHA256
1875 config CRYPTO_USER_API
1878 config CRYPTO_USER_API_HASH
1879 tristate "User-space interface for hash algorithms"
1882 select CRYPTO_USER_API
1884 This option enables the user-spaces interface for hash
1887 config CRYPTO_USER_API_SKCIPHER
1888 tristate "User-space interface for symmetric key cipher algorithms"
1890 select CRYPTO_SKCIPHER
1891 select CRYPTO_USER_API
1893 This option enables the user-spaces interface for symmetric
1894 key cipher algorithms.
1896 config CRYPTO_USER_API_RNG
1897 tristate "User-space interface for random number generator algorithms"
1900 select CRYPTO_USER_API
1902 This option enables the user-spaces interface for random
1903 number generator algorithms.
1905 config CRYPTO_USER_API_RNG_CAVP
1906 bool "Enable CAVP testing of DRBG"
1907 depends on CRYPTO_USER_API_RNG && CRYPTO_DRBG
1909 This option enables extra API for CAVP testing via the user-space
1910 interface: resetting of DRBG entropy, and providing Additional Data.
1911 This should only be enabled for CAVP testing. You should say
1912 no unless you know what this is.
1914 config CRYPTO_USER_API_AEAD
1915 tristate "User-space interface for AEAD cipher algorithms"
1918 select CRYPTO_SKCIPHER
1920 select CRYPTO_USER_API
1922 This option enables the user-spaces interface for AEAD
1925 config CRYPTO_USER_API_ENABLE_OBSOLETE
1926 bool "Enable obsolete cryptographic algorithms for userspace"
1927 depends on CRYPTO_USER_API
1930 Allow obsolete cryptographic algorithms to be selected that have
1931 already been phased out from internal use by the kernel, and are
1932 only useful for userspace clients that still rely on them.
1935 bool "Crypto usage statistics for User-space"
1936 depends on CRYPTO_USER
1938 This option enables the gathering of crypto stats.
1940 - encrypt/decrypt size and numbers of symmeric operations
1941 - compress/decompress size and numbers of compress operations
1942 - size and numbers of hash operations
1943 - encrypt/decrypt/sign/verify numbers for asymmetric operations
1944 - generate/seed numbers for rng operations
1946 config CRYPTO_HASH_INFO
1949 source "drivers/crypto/Kconfig"
1950 source "crypto/asymmetric_keys/Kconfig"
1951 source "certs/Kconfig"