Commit | Line | Data |
---|---|---|
f0894940 DH |
1 | # |
2 | # Key management configuration | |
3 | # | |
4 | ||
5 | config KEYS | |
6 | bool "Enable access key retention support" | |
b2a4df20 | 7 | select ASSOCIATIVE_ARRAY |
f0894940 DH |
8 | help |
9 | This option provides support for retaining authentication tokens and | |
10 | access keys in the kernel. | |
11 | ||
12 | It also includes provision of methods by which such keys might be | |
13 | associated with a process so that network filesystems, encryption | |
14 | support and the like can find them. | |
15 | ||
16 | Furthermore, a special type of key is available that acts as keyring: | |
17 | a searchable sequence of keys. Each process is equipped with access | |
18 | to five standard keyrings: UID-specific, GID-specific, session, | |
19 | process and thread. | |
20 | ||
21 | If you are unsure as to whether this is required, answer N. | |
22 | ||
47b2c3ff BA |
23 | config KEYS_COMPAT |
24 | def_bool y | |
25 | depends on COMPAT && KEYS | |
26 | ||
f36f8c75 DH |
27 | config PERSISTENT_KEYRINGS |
28 | bool "Enable register of persistent per-UID keyrings" | |
29 | depends on KEYS | |
30 | help | |
31 | This option provides a register of persistent per-UID keyrings, | |
32 | primarily aimed at Kerberos key storage. The keyrings are persistent | |
33 | in the sense that they stay around after all processes of that UID | |
34 | have exited, not that they survive the machine being rebooted. | |
35 | ||
36 | A particular keyring may be accessed by either the user whose keyring | |
37 | it is or by a process with administrative privileges. The active | |
38 | LSMs gets to rule on which admin-level processes get to access the | |
39 | cache. | |
40 | ||
41 | Keyrings are created and added into the register upon demand and get | |
42 | removed if they expire (a default timeout is set upon creation). | |
43 | ||
ab3c3587 | 44 | config BIG_KEYS |
2eaf6b5d | 45 | bool "Large payload keys" |
ab3c3587 DH |
46 | depends on KEYS |
47 | depends on TMPFS | |
3cd18d19 | 48 | select CRYPTO |
13100a72 | 49 | select CRYPTO_AES |
428490e3 | 50 | select CRYPTO_GCM |
ab3c3587 DH |
51 | help |
52 | This option provides support for holding large keys within the kernel | |
53 | (for example Kerberos ticket caches). The data may be stored out to | |
54 | swapspace by tmpfs. | |
55 | ||
56 | If you are unsure as to whether this is required, answer N. | |
57 | ||
f0894940 DH |
58 | config TRUSTED_KEYS |
59 | tristate "TRUSTED KEYS" | |
60 | depends on KEYS && TCG_TPM | |
61 | select CRYPTO | |
62 | select CRYPTO_HMAC | |
63 | select CRYPTO_SHA1 | |
5ca4c20c | 64 | select CRYPTO_HASH_INFO |
f0894940 DH |
65 | help |
66 | This option provides support for creating, sealing, and unsealing | |
67 | keys in the kernel. Trusted keys are random number symmetric keys, | |
68 | generated and RSA-sealed by the TPM. The TPM only unseals the keys, | |
69 | if the boot PCRs and other criteria match. Userspace will only ever | |
70 | see encrypted blobs. | |
71 | ||
72 | If you are unsure as to whether this is required, answer N. | |
73 | ||
74 | config ENCRYPTED_KEYS | |
75 | tristate "ENCRYPTED KEYS" | |
76 | depends on KEYS | |
77 | select CRYPTO | |
78 | select CRYPTO_HMAC | |
79 | select CRYPTO_AES | |
80 | select CRYPTO_CBC | |
81 | select CRYPTO_SHA256 | |
82 | select CRYPTO_RNG | |
83 | help | |
84 | This option provides support for create/encrypting/decrypting keys | |
85 | in the kernel. Encrypted keys are kernel generated random numbers, | |
86 | which are encrypted/decrypted with a 'master' symmetric key. The | |
87 | 'master' key can be either a trusted-key or user-key type. | |
88 | Userspace only ever sees/stores encrypted blobs. | |
89 | ||
90 | If you are unsure as to whether this is required, answer N. | |
ddbb4114 MM |
91 | |
92 | config KEY_DH_OPERATIONS | |
93 | bool "Diffie-Hellman operations on retained keys" | |
94 | depends on KEYS | |
4cd4ca7c | 95 | select CRYPTO |
f1c316a3 | 96 | select CRYPTO_HASH |
7cbe0932 | 97 | select CRYPTO_DH |
ddbb4114 MM |
98 | help |
99 | This option provides support for calculating Diffie-Hellman | |
100 | public keys and shared secrets using values stored as keys | |
101 | in the kernel. | |
102 | ||
103 | If you are unsure as to whether this is required, answer N. |